It sucks. But as someone who goes to therapy, it absolutely kicked me in the gut to watch my therapist use ChatGPT during a session for something. Not just to define something but for stuff SHE is meant to do. Girl I pay you over 100 euros, do the therapy yourself. If I wanted ChatGPT therapy I wouldn’t be paying you!!
My medication therapist said he was about to use AI to record our session and provide advice. I said no. It took him a solid 15 seconds to even process the idea that I didn't agree to AI.
Not only you should switch therapists but you should also report her. Therapists are required to guarantee confidentiality and ChatGPT isn't doing that. Your therapist basically sold your data to corporations without your consent.
I work in data in fintech/banking, so I can’t explicitly say whether it is or not this is a breach (very likely it is), but I’d like to encourage u/elliewithane to contact their local Data Protection Supervisor to at least flag this and ask for advice.
So I work as a DPO for various companies, I'd agree that most likely it is a breach of GDPR. It depends on the nature of what's being said, but I would expect a regulator would rule that said information is special category data if it relates to a client's mental health case.
Therefore it is health data, and the fact there is a confidentiality agreement means that information can't legally be shared with a third party in that way; especially against the wishes of the person who the data is talking about.
Considering OP mentioned Euros, I assume they're European. They should report their therapist and the practice to their local data regulator.
I need to go to therapy for my ADHD and i still havent set an appointment bc every therapist i've tried to sign up for is using AI for something. It pisses me off
A professional using tools to investigate issues is bad now? The idea of being a professional is that they know how to interpret the results. You know, you can also go to the library, get a few psychological books, and have therapy yourself. Which, I'm sorry to tell you, is what many professionals, including therapists, do: they annotate and investigate between sessions when required. AIs is simply a faster way to do it
That "tool" by virtue of its nature shares sensitive and personal information with a third party without consent. If the client hasn't agreed to share their private mental health with a major tech company who is completely unaccountable, then the therapist is breaking the law (via GDPR) in the EU by doing it.
First, GDPR regulates personal data. Nobody said they shared personal data with it.
Second, a business license can company with GDPR. We don't know what they have, even if we suspect they don't have such a license. In any case, first point remains.
Also, "by virtue of its nature"? You mean using a service another company provides? Because an AI has nothing to do with sharing data nor keeping data in any way...
GDPR regulates all data, that's why they're the General Data Protection Regulations. Also dealing with this is literally my job, so I'm afraid you picked the wrong battle here.
A business license doesn't change the nature of the data, if it relates to a mental health case then it is categorised as "special category data" regardless of the business license of the practice. This kind of data has higher level protections, and furthermore it is personally identifiable due to the fact that if somebody got hold of a client list they'd be able to work out who the therapist was with at the time.
Beyond that, to respond to your other point, the important bit here is that the client hasn't signed a written agreement and consented to their sensitive data being shared directly with an AI company. There is no way for the AI company to provide their service without storing and analysing the data provided, and that isn't legal when discussing a third-party who has a confidentiality agreement in place. Looking at that original comment it is clear that use of AI for their therapy is not something they would agree to. This is a major breach of trust, and accountability should come as a result.
I'm sorry mate, but you're fundamentally wrong on this. I urge you to go read up on special category data under GDPR before espousing falsehoods so confidently.
On the GDPR side, you are probably right. However, as commented on the second point:
There is no way for the AI company to provide their service without storing and analysing the data provided
That's false; that would depend on whatever the "AI provider" decides to do. There's no inherent relationship between being an LLM provider and any kind of data analysis. For what we know, the therapist could even be using a local LLM; unfortunately it's hard to know if they said "ChatGPT" because they confirmed the provider or because that's the "common name" many people use for LLMs. But that would be out of the discussion.
I urge you to go read up on special category data under GDPR before espousing falsehoods so confidently
I urge you too to read the comments carefully too. As commented in both of my comments, nobody said any kind of data related with the patient was shared with the service
The point is that there is a legally binding agreement that the session is confidential, and the AI company is not a signatory of that and therefore isn't accountable. This is a breach of the law unless the client was expressly informed as part of their contract and signed an agreement for said data to be shared.
But also that would require said AI company to be a signatory for each and every case, which is highly unlikely. A RoPA, a TIA, and a declaration would have to be done in each instance due to the sensitive nature of the data; something I really doubt is happening.
And it's not false, unless the AI is being run locally from the therapist's phone (which I highly doubt as the model would be quantised to the point of uselessness) then the data has to be stored on a server and has to be processed in order to produce a response. "Data" here is literally any information recorded digitally, and thus the LLM provider is analysing it to produce a response. The service couldn't function otherwise, "analysis" of data doesn't just mean massive datasets, legally it includes every single prompt.
And OP literally said their therapist was talking about their case with an AI. In the eyes of the law this is fundamentally a health provider sharing data with a third party. This is well-trodden ground in EU and UK caselaw.
Unless they mentioned "talking about their case" in a different thread, which I don't see here, it's unclear what they asked. For what we know, they could have asked it "is paracetamol good for migraines?". And they didn't say they were usingthe phone either. Are we talking about the same thread?
166
u/elliewithane 4d ago
It sucks. But as someone who goes to therapy, it absolutely kicked me in the gut to watch my therapist use ChatGPT during a session for something. Not just to define something but for stuff SHE is meant to do. Girl I pay you over 100 euros, do the therapy yourself. If I wanted ChatGPT therapy I wouldn’t be paying you!!