Who this guide is for

This guide is for registered psychotherapists in Ontario who are thinking about using an AI note tool, or who already do and want to check their setup. It is a practical checklist, not legal advice. Your regulator, your insurer and a privacy lawyer are the right sources for questions about your own situation.

Two points frame everything below. First, in many private practices the clinician is the health information custodian under Ontario's Personal Health Information Protection Act, 2004 (PHIPA), which means the duties for protecting client information sit with you even when a vendor handles it. Second, the Information and Privacy Commissioner of Ontario and the College of Registered Psychotherapists of Ontario (CRPO) have both published material on AI in health care. Read their current documents directly; they are linked at the end. For a wider look at Canadian rules, see AI note takers for Canadian therapists.

1. Consent

Recording a session or running it through an AI tool is something clients should know about and agree to before it happens. Do not assume that general consent to treatment covers it.

  • Tell clients what the tool does in plain language: that the session is turned into text and a draft note is produced, and that you review the result.
  • Say where the processing happens, whether on your computer or on a vendor's servers, and what is kept.
  • Offer a real alternative. A client who declines should receive the same care, with notes written the usual way.
  • Record the consent in the client file, and make it easy to withdraw at any point.
  • Ask again when circumstances change, for example if you switch tools or begin recording telehealth sessions.
  • Think about couples, family and group sessions. Every participant needs to understand and agree, and one person declining may mean the tool should not be used for that session.

Consider asking at the start of each recorded session as well as at intake. Astralcyte Notes includes a consent confirmation before it captures a conversation, and denying it erases the audio without transcribing it. The prompt supports your process but does not replace it; you still explain the tool and document the agreement.

2. Where the data goes

This is the question that separates one kind of tool from another. Ask the vendor, in writing, and keep the reply.

  • Is the audio processed on my device or sent to a server? If sent, to which country and which providers?
  • Does any third party, such as a cloud AI provider or analytics service, receive the audio, transcript or note? Ask for the list.
  • Is the data used to train or improve models? Is that optional, and is it off by default?
  • How is it protected in transit and at rest, and who at the vendor can see it?
  • What happens if there is a breach? Will the vendor tell you promptly, and does the contract say how?
  • Does the vendor sign an agreement describing its role as your service provider? PHIPA lets custodians use agents and electronic service providers, with conditions, so ask what the contract covers.

A tool that processes everything on your own computer removes most of the transmission questions, because the session is not sent to the vendor. It does not remove your own duties: you still need to secure the computer, back it up and control who can use it. Astralcyte Notes keeps its data in an encrypted local vault and is designed for PHIPA and other provincial privacy rules; the practice page sets out how it relates to the guidance for Ontario psychotherapists. For a deeper comparison, see this comparison of cloud note takers and an offline alternative.

3. Retention and deletion

Two kinds of retention matter here: what the tool keeps, and what your professional obligations require you to keep.

  • Audio. Find out whether it is kept at all, and for how long. The safest answer is that it is deleted as soon as the transcript or note exists. Astralcyte Notes deletes the temporary audio once the transcript is saved.
  • Transcripts. A transcript is a record of everything said. Decide whether you need it after the note is approved. Many clinicians do not, and a shorter retention reduces what could be exposed. Where your record-keeping requirements allow it, Astralcyte lets you set transcripts to be deleted after note approval.
  • Notes. The approved note is part of the clinical record, and its retention period is set by your college and by law, not by the tool. Check CRPO's record-keeping standards and ask your insurer.
  • Exit. Ask how you get your data out if you stop using the tool, and what the vendor deletes when you cancel.
  • Backups. Know whether the tool, or your own backup software, makes copies of transcripts and where those copies are held.

4. Reviewing drafts

An AI draft is a proposal. The note you sign is your professional statement, and you answer for its accuracy. Build review into the routine so it does not depend on how busy the day is.

  • Read every draft against what you remember of the session, not only for typos. Check names, medications, dates, risk statements and quoted words.
  • Look for what is missing as well as what is wrong. Drafts can omit a disclosure that mattered.
  • Watch for statements the client did not make. If a sentence is not supported by the session, delete it.
  • Check attribution in sessions with more than one speaker. Speaker labels can be wrong.
  • Do not sign a draft you have not edited into your own clinical judgment, especially in the Assessment and Plan.
  • Keep your prompt or template under your control, so the structure matches your standards of documentation.

Astralcyte Notes leaves each generated note as an editable draft, and it is built around a prompt you write yourself. The draft does not enter your record until you put it there.

5. What to document

A short paper trail protects you and your clients if questions arise later.

  • The date you started using the tool and the version.
  • The vendor's answers to your data questions, kept with your privacy documentation.
  • A short written policy for your practice: when you use the tool, how consent is obtained, how drafts are reviewed and what is deleted.
  • Your consent wording and how clients receive it.
  • A note of any privacy impact assessment or risk review you carried out. The Commissioner has published guidance on AI scribes that you can use as a framework.

Warning signs in a vendor's answers

Some replies should slow you down. Be cautious if a vendor cannot say where data is processed, gives only a marketing summary instead of a written answer, reserves the right to use session content to train models without a clear opt-out, keeps recordings with no stated deletion point, or describes its tool as meeting every privacy law without saying how. A vendor that answers plainly, including about what it does not do, is easier to trust than one that promises everything.

A pre-launch test

Before using a tool with a real client, run it on yourself.

  1. Record a mock session with a colleague and compare the draft with what was said.
  2. Disconnect from the internet and confirm what still works, if you are relying on local processing.
  3. Check where files are stored on your computer and who can reach them.
  4. Delete a test session and verify what remains.
  5. Practise your consent explanation aloud.

Related reading

If you want to improve the note itself, how to write SOAP notes faster, with examples covers structure and prompts. The practice page lists what each Ontario regulator has published about AI tools and how the app relates to it. Rules change, so check the regulator's current text before you rely on any summary, including ours.

Sources