In this guide 6 sections
Ask where notes are stored, who can open them, whether the vendor’s staff can see them, how consent and referrals are recorded, and how you take your data out. Get every answer in writing. GullySystem answers these before building anything. For a solo practice, a ready app with clear privacy terms is often enough.
Where notes live and who can open them
Begin with progress notes, the most sensitive record you keep. Find out which country the server sits in and whose account holds it. Confirm that stored notes are encrypted.
Then turn to access. Can each note be limited to the therapist who wrote it? Is every opening logged with a name and time? In a group practice, can the owner see calendars without seeing notes?
- Server location and the account that owns it
- Encryption of stored notes
- Notes limited to the therapist who wrote them
- A log of each access, with name and time
What the vendor’s own team can see
Support staff sometimes need access to fix a fault. Request a written description of that access and when it is used. It should be logged every time.
A demo needs no real client records. Screenshots or a demo login are enough. A vendor who asks for live data to show the product has answered your question.
Consent, intake and referrals
Intake forms and informed consent belong with the client record. The date consent was given should be stored. You should be able to show it later without searching old emails.
Referrals and supervision involve sharing. A good system notes what was shared, with whom and on what consent. Your lawyer can say which privacy rules apply to your practice.
Bookings, fees and the awkward conversations
Check how clients book and receive reminders. Most systems do not run the video call, so the appointment should carry the link. Cancellations should be recorded against the policy you stated.
Fees need a lighter touch. Can a sliding scale rate be held per client? Can receipts go out without chasing on WhatsApp? Can totals reach your accountant with no clinical detail?
- Booking only from slots you open
- Reminders that carry the joining link
- Cancellations logged against your policy
- Sliding scale fees held per client
- Accountant exports with no clinical detail
Leaving, ownership and the ready-app question
Find out how you would take every record out if you stopped. The answer should name a format. It should also say what happens to the vendor’s copy.
Last, weigh a ready app against a custom system. A solo practice is often well served by a ready app with honest privacy terms. Custom work suits group practices, or therapists who want the data wholly in their own hands.
Practice software privacy questionnaire
A two-page list of the questions above, with space beside each for a vendor’s written answer. Send it before any demo. Compare answers side by side, and treat a blank as a no.
Open a blank worksheet to printQuestions owners ask
Does practice software run the video session?
Not usually, and the system GullySystem builds does not. Teletherapy stays on the video tool you already use. The appointment holds the link, so the client gets one message with time and joining details.
Can software make my practice compliant with privacy law?
Not on its own. Software can keep notes private, log access and record consent. Whether that meets the rules for your practice is a question for your lawyer.
Should I avoid ready therapy apps?
No. For a solo practice a ready app is often the simplest choice. Check where it stores data and how you can leave.
Will a vendor need real client records for a demo?
It should not. A demo login or screenshots are enough to judge the product.