AI ethical use policy

Version: 1.0 | Effective date: 5 October 2026

The main points

AI helps us with paperwork and admin. It never makes decisions about your care.
Your sessions are not audio recorded. Where an AI note tool is used, speech becomes text in real time and the audio is immediately discarded.
A qualified clinician reviews everything AI drafts before it goes anywhere near your record.
Your data is never used to train AI models.
Nothing AI-related happens in your sessions without your explicit consent, and saying no changes nothing about your care.
Some psychologists dictate their own summary of a session into an approved AI note tool, such as Heidi Health, after the session has ended, without your name or identifying details. You can ask them not to.
You do not need to ask. If AI would touch your clinical care, your psychologist will raise it with you first.

Purpose and scope
What we mean by AI
Guiding principles
How we use AI day to day
Our independent clinician model
Our endorsed tool: Heidi
Other AI tools, and why you never need to ask
Minimum standards for any AI tool
What AI is never used for
Your rights
Consent in detail
Governance and review
If something goes wrong
Complaints
Questions and updates

1. Purpose and scope

This policy explains how Thriving Minds Collective Ltd, trading as The Bromley Psychologists (“we”), and the independent clinical psychologists associated with our practice, in their work with our clients, use artificial intelligence, the standards every tool must meet, and the protections you have. It sits alongside our privacy policy, which covers how we look after your information more broadly.

2. What we mean by AI

By “AI” we mean software built on large language models or speech recognition that supports clinical or practice work. In this practice that currently means three things:

Practice administration: software tools that help us run the practice behind the scenes. These never make, or influence, any decision about your care.
Transcription and note drafting: turning what was said in a session into text and a structured first draft of clinical notes, for the psychologist to edit and approve.
Dictated note summaries: a psychologist speaking their own summary of a session into an approved AI note tool, such as Heidi Health, after the session has ended, without the client’s name or identifying details, so the tool can turn it into a draft note.

Ordinary practice software with no AI in it (our diary, invoicing and secure record systems) is outside the scope of this policy. Our get-started questionnaire is a structured set of questions, not AI: your answers go directly to our clinical team.

3. Guiding principles

Human-led care. AI assists with paperwork; your therapy, and every clinical judgement in it, stays with your psychologist.
Transparency. You are told whenever AI is involved in your clinical care, what it does, and which tool it is.
Explicit consent. AI is only used in your sessions with your informed, voluntary consent. Refusing never affects your access to therapy.
Clinician oversight. Every AI output is reviewed, edited and approved by a qualified clinician before it enters your record.
Data minimisation. AI tools only see what they need for the task at hand.
No model training. Your personal and clinical information is never used to train AI systems.
No autonomous decisions. AI cannot triage risk, diagnose, recommend treatment or influence your care.
Accountability. Your treating clinical psychologist is responsible and accountable for the AI tools they choose to use, and for ensuring those tools meet the standards set out in this policy.

4. How we use AI day to day

Session notes (with your consent). Some of our psychologists use an AI note tool to help write up sessions, so they can give you their full attention instead of scribbling. Sessions are not recorded: speech is converted to text in real time and the audio is immediately discarded. Your psychologist reviews and approves every note before it enters your record. There is more on this in sections 6 and 7.

Dictated summaries after a session. Some of our psychologists write up their notes by speaking their own summary of the session into an approved AI note tool, such as Heidi Health, once the session has ended, instead of typing it. The tool does not listen to or record your session. It only hears your psychologist’s own summary afterwards, and they leave out your name and any identifying details. Because this is your psychologist writing their own note, rather than a tool listening to your session, we do not ask for separate consent each time. The tool must still meet every standard in section 8, and your psychologist reviews the draft before it is saved to your record. If you would prefer your psychologist did not do this, just tell them or email us, and they will type their notes instead.

Practice administration. AI tools help us build and maintain the secure systems that keep the practice organised behind the scenes. When you contact us by email or through our get-started questionnaire, a person reads your message and a person replies. The decision about your care, including which psychologist we suggest for you, is always made by our Clinical Director or another clinician, never by software.

5. Our independent clinician model

The psychologists in our team are independent practitioners rather than employees, and each is the data controller for the clinical records they create (our privacy policy explains this in full). That means each psychologist chooses and is responsible for their own tools, including any AI note tool.

What we do centrally:

set the minimum standards in section 8, which every tool must meet before it can be used with our clients;
endorse one tool, Heidi (section 6), that we know meets them;
act as your central point of contact for any question, preference or complaint, so you never have to navigate this alone.

6. Our endorsed tool: Heidi

The tool we officially endorse for session documentation is Heidi, an AI medical scribe that is widely used in healthcare, including by clinicians across the NHS. It acts as a data processor for the psychologist using it.

No audio kept. Sessions are not recorded. Speech becomes text in real time and the audio is immediately discarded; only the text remains.
Clinician approval. Your psychologist reviews, edits and approves every draft before it is stored in your clinical record.
No model training. Heidi is contractually prohibited from using client information to train or improve its AI models.
UK data protection. Heidi operates under UK GDPR with a signed data processing agreement and UK data hosting, and each psychologist completes a data protection impact assessment before using it.

If your psychologist proposes using Heidi, they will explain it and ask for your consent first. You can say no, or change your mind later, without it affecting your therapy in any way.

7. Other AI tools, and why you never need to ask

Because our psychologists are independent, some may prefer a different note tool. Any alternative must meet every minimum standard in section 8, and the psychologist using it is responsible for checking that it does.

You do not need to ask, or check, or worry that something is happening without you knowing. If your psychologist wants to use an AI tool in your sessions, they will raise it with you before it is used: which tool, what it does, where your information is stored, and what protections apply. You will have the chance to ask questions and decide, and you can withdraw your consent at any point afterwards. The one exception is a summary your psychologist dictates after a session has ended, described in section 4, which you can ask them not to do at any time. If you would rather talk it through with someone other than your psychologist, contact us at [email protected] and we will handle it.

8. Minimum standards for any AI tool

Every AI tool used with our clients, whoever the psychologist and whatever the product, must meet all of the following. A tool that cannot is not used in client care.

No audio recording. Sessions are never stored as audio. Transcription happens in real time and audio is immediately discarded; only text is kept.
UK GDPR and Data Protection Act 2018 compliance, demonstrably.
A signed data processing agreement between psychologist and vendor before any client data is processed.
No model training on client data, guaranteed in the contract.
Human review of every output. Nothing AI-generated is stored unreviewed.
No autonomous clinical decisions. No triage, diagnosis, risk assessment or treatment recommendation without clinician oversight.
A completed data protection impact assessment by the psychologist before use with clients.
Explicit, documented client consent before any tool is used in a session, with the right to refuse or withdraw at any time without any effect on care. A summary the psychologist dictates after the session has ended (section 4) does not need separate consent, but clients are told about it in this policy and can ask their psychologist not to do it at any time.
Appropriate security: encryption in transit and at rest, access controls, and breach notification procedures.
Lawful international transfers where any processing happens outside the UK, using UK GDPR-approved mechanisms, with UK hosting preferred.

9. What AI is never used for

Diagnosis, treatment decisions or risk assessment
Deciding whether we can offer you a service, or triaging referrals
Replacing contact with a real clinician (we do not use chatbots)
Profiling clients or predicting clinical outcomes
Replacing clinical supervision or professional judgement
Training or improving AI models with your data
Content presented as a clinician’s personal opinion without their review

Looking ahead: we do not use client-facing AI such as chatbots, symptom screeners or automated replies to enquiries. If that ever changed, we would update this policy first and tell you clearly before anything affected you.

10. Your rights

The right to know. Before any AI is used in your sessions, your psychologist tells you which tool and what it does. If your psychologist dictates their own summary after a session, you can ask which tool they use.
The right to ask. At any time, ask your psychologist or us which tools are involved, how they work and what safeguards apply.
The right to say no. AI in your sessions needs your explicit consent, and declining changes nothing about your access to therapy.
The right to change your mind. Withdraw consent whenever you like, by telling your psychologist or emailing us. Section 11 explains what happens to existing notes.
The right to correction. If anything in your record looks wrong, AI-involved or not, tell us and we will correct it. This is your legal right under UK GDPR.
The right to complain. See section 14. You can also go to the ICO directly at any time.

Joint sessions. If more than one person is in a session, AI tools need everyone’s consent. If any one person says no, the tool is not used in that session, and anyone can withdraw at any point in therapy.

Accuracy. Your psychologist, not the software, is responsible for your record being accurate. AI output is only ever a draft until a clinician has reviewed and corrected it.

If you withdraw consent. Withdrawal stops all future AI use straight away. Notes that already exist stay in your record, because the law and our professional bodies require us to keep accurate clinical records, but you can ask for corrections to any entry at any time, and withdrawal does not undo the lawfulness of what you previously agreed to (UK GDPR Article 7(3)).

12. Governance and review

Our Clinical Director is responsible for this policy and acts as our data protection and AI governance lead. We review the policy at least once a year and whenever our AI use changes, and we follow guidance from the Information Commissioner’s Office (ICO), the Health and Care Professions Council (HCPC) and the British Psychological Society (BPS).

13. If something goes wrong

If a data incident involves client information, whether in our systems, a psychologist’s practice or an AI vendor, we investigate immediately and keep a record. We report to the ICO within 72 hours where the legal threshold is met, and if a breach is likely to put you at high risk we contact you directly and promptly: what happened, what information was involved, what we are doing, and what you can do. Vendors are contractually required to tell us about breaches without delay. If you ever suspect a problem with your data, contact us and we will investigate.

14. Complaints

Talk to your psychologist, who will explain what was used and put right what they can.
Or come to us: email [email protected]. We will acknowledge your complaint promptly, investigate, and respond without undue delay.
Or go to the ICO at any time, whether or not you have spoken to us first: ico.org.uk, 0303 123 1113.

15. Questions and updates

Ask us anything about AI in this practice at [email protected]. When we update this policy, the version number and effective date at the top will always tell you what is current, and we will communicate significant changes clearly.