GDPR and privacy for online EMDR tools
Mental health data is special-category data under GDPR. Before you use any online EMDR tool with clients, it is worth knowing exactly what the tool collects and where data goes.
This page describes how EMDR Pro is designed. It is not legal advice. Your own obligations as a data controller depend on your jurisdiction and practice, so check with your professional body or a data protection adviser.
Why privacy matters more for EMDR tools
Therapists in the EU and UK handle health information that GDPR treats as special-category data. A bilateral stimulation tool sits in the room with your client during trauma work, so you should be able to answer simple questions: does the client need an account, does the tool store anything about them, and does it track them?
A checklist for any EMDR tool
| Question to ask | Why it matters |
|---|---|
| Does the client have to register or give personal details? | Fewer details collected means less to protect and less to disclose. |
| Are session notes or client information stored on the provider's servers? | Stored data creates retention, breach and access-request duties. |
| Are cookies or analytics running during the session? | Tracking during therapy is hard to justify and needs consent. |
| Which third parties process data (sync, payments, email)? | You need to know your processors and their roles. |
| Is there a clear privacy policy you can show clients? | You must be able to explain it in plain language. |
How EMDR Pro approaches privacy
- No client account. Clients join a session through a link or code and do not register.
- No retained client personal data. EMDR Pro is built to retain no client personal data, so there is no client file to leak or to answer access requests about.
- Cookie-free app and client pages. Cookies are only used on the home page, after consent. The session workspace and these guide pages are cookie-free.
- Real-time sync only. Your controls reach the client through a real-time messaging service (Ably) used to synchronise the session.
- Therapist account. Therapists sign in with an email link. Subscription payments are handled by Stripe, so EMDR Pro does not handle your card details.
What you still need to do
A privacy-conscious tool reduces risk but does not replace your own compliance. Keep your own session notes in your usual secure records system, tell clients which tools you use in your consent paperwork, and make sure your remote setup (video platform, location, confidentiality) is also appropriate. Our remote EMDR guide covers the practical side, and the full privacy policy sets out the details.
Frequently asked questions
Is EMDR Pro GDPR compliant?
EMDR Pro is designed around privacy: no client accounts, no retained client personal data and no cookies in the session workspace. You remain responsible for your own compliance as a practitioner, so please read the privacy policy and take advice where needed.
Does my client need to give an email address?
No. Clients join with a link or code. Only the therapist signs in.
Are cookies used?
Only on the home page, and only after consent. The app and client pages are cookie-free.
Who processes payments?
Stripe handles subscription payments.