Website Security for UK Therapists, Counsellors, and Mental Health Practitioners

The Sensitivity of Therapy Data

Mental health data occupies a category of its own. A client's name and email address is sensitive. The fact that they are seeing a therapist, the issues they are working through, and the contents of any notes or communications between client and practitioner are among the most sensitive personal data that exists.

Under UK GDPR, health data — which explicitly includes mental health data — is special category data. Processing it carries the highest legal obligations and the most serious consequences for breaches. An ICO investigation into a data breach at a therapy practice is not a theoretical risk; the regulator has investigated and fined healthcare and mental health providers whose technical security was found to be inadequate.

For clients, the consequences of their therapy data being exposed can be severe. Mental health disclosures can affect employment, insurance, custody proceedings, and relationships. The trust required for effective therapy depends on absolute confidentiality. A security breach does not just create a legal and reputational problem for the practitioner — it causes real harm to real people.

What Therapy Websites Typically Handle

Even a solo practitioner's website — a few service pages and a contact form — may process more sensitive data than is immediately obvious.

**Initial enquiry forms** — A client contacting a therapist for the first time may briefly describe what they are seeking support with. This is health data even in a general contact form.

**Intake forms and questionnaires** — Many therapists use online forms to gather background information before an initial session. These forms routinely ask about current symptoms, previous diagnoses, medication, previous therapy, family history, and crisis history. Storing this data insecurely is a serious breach of both legal and ethical obligations.

**Appointment booking systems** — An appointment record connecting a named individual to a therapy practice is itself sensitive data, even without any clinical content.

**Secure messaging or client portals** — Some practitioners use online platforms for between-session communication or to share resources. Any message containing client disclosures is special category data.

**Payment records** — Therapy payment records, if connected to the practice's own website or billing system, can reveal that a named individual is a client.

Common Vulnerabilities in Therapy Practice Websites

Insecure contact and intake forms

Contact forms that send data by email are storing that data — sometimes briefly, sometimes permanently — in email inboxes, email marketing platforms, and web server databases. If the email account has a weak password and no two-factor authentication, or if the email marketing service has a data breach, client enquiries are exposed.

Intake forms that collect detailed clinical information and store responses in a third-party form tool or spreadsheet are often configured with default sharing settings that are far too permissive. A Google Form that stores responses in a shared Google Sheet, accessible to anyone with the link, is a realistic scenario that practitioners set up without realising the implications.

No HTTPS on form pages

An HTTP contact or intake form sends client data across the network without encryption. Anyone able to intercept the network traffic — on a shared WiFi network, for example — can read the form contents. Therapy clients completing intake forms at home, at a café, or on public WiFi deserve better than plaintext transmission of their health disclosures.

Outdated website platforms

A therapy website built on WordPress four years ago and never updated is running known vulnerabilities. A WordPress plugin that sends appointment confirmations may have an [SQL injection](/blog/what-is-sql-injection) vulnerability that was patched eighteen months ago. If the plugin is not updated, the site is exploitable.

Third-party booking and telehealth platforms

Many therapists use third-party platforms — Calendly, Jane App, Healthie, or similar — for booking and session hosting. While the data security obligations for the platform sit partly with the platform provider, the practitioner remains the data controller under UK GDPR and is responsible for choosing a provider whose security is adequate and whose data processing agreement is in place.

The risks are: using a platform that does not offer a data processing agreement; configuring the platform with weak access credentials; or embedding a third-party booking widget into a website without understanding where the data goes.

Weak email security

Therapists communicate with clients primarily by email. Without [DMARC at enforcement policy](/blog/http-security-headers-explained-uk), an attacker can send emails that appear to come from the therapist's domain — potentially used for phishing, fraud, or impersonation. Without strong credentials and two-factor authentication on the email account, a compromised email account exposes every client communication ever exchanged.

Legal Obligations for Therapy Practitioners

UK GDPR requires that special category data — including health and mental health data — be processed under a lawful basis, and that appropriate technical and organisational measures are in place to protect it.

For therapists, the relevant professional bodies — BACP, UKCP, BPS, and others — publish ethical frameworks and data protection guidance that align with UK GDPR requirements. BACP's Ethical Framework explicitly addresses confidentiality and data protection. A security breach that is found to have resulted from inadequate technical measures could result in both ICO enforcement and professional body disciplinary proceedings.

The ICO's expectation for special category data includes: encryption of data at rest and in transit, access controls that limit who can access client records, audit logging of data access, and a process for detecting and reporting breaches within 72 hours.

What Yrzo AI Covers for Therapy Practices

The [Essential scan (£149)](/checkout/starter) covers the security baseline that every therapy website should meet:

- HTTPS on all pages including contact and booking forms - Security headers including Content Security Policy and HSTS - Email authentication — SPF, DKIM, and DMARC for your domain - Third-party script inventory — identifying scripts loaded from external sources that could capture form inputs - Exposed admin panels and default credentials - SSL certificate validity

For practices using a client portal or patient management system, the [Professional scan (£399)](/checkout/standard) includes authenticated testing — scanning the platform as a logged-in user to check access controls, session security, and data exposure in authenticated areas.

The report provides specific, actionable remediation steps that can be taken by the practitioner or passed to a web developer. [Start with a free scan](/free) to see your current security posture.

Related reading: [GDPR Website Security Requirements UK](/blog/gdpr-website-security-requirements-uk) · [Website Security for Care Homes](/blog/website-security-care-homes-uk) · [Two-Factor Authentication for Website Security](/blog/two-factor-authentication-website-security-uk)