GDPR-Compliant Intake Form on Your Therapist Website

Most intake forms you find on therapist websites ask too much, too soon. Name, address, phone, email, date of birth, GP, insurance, a brief description of the complaint, medication, previous treatments. All on the first page, before a conversation has even taken place. For someone who is seeking help right now, that is a mini-overwhelm.

The GDPR Basics

Special categories of personal data (health, mental well-being) may only be processed with an explicit legal basis. For therapists, this is typically 'performance of a contract' plus explicit consent. Practically, this means: prior to any data processing, the client must know what data you collect, why, how long you store it, and who you share it with.

Two Moments, Not One

Split the intake into two moments. The first is a light registration: name, email, a sentence about what's going on, and preferred contact time. That's enough to schedule an introductory meeting. The second is the full intake, which takes place after the introductory meeting, once both parties have decided to proceed. Only then do medical history, medication, and GP details go into a protected system.

What Belongs on the Short Registration Form

• Name (full name, no middle name fields).
• Email address.
• Phone number (optional, only if you actually call back).
• An open text field: "What's briefly going on?" Maximum five lines, not mandatory.
• Preferred contact method: email or phone.
• One checkbox: I agree to the privacy statement (with link).

What Does NOT Belong on the Short Form

• Diagnostic questions or symptom checklists.
• Medication overview.
• Social security number.
• Insurance details (unless you bill directly; then only after agreement on the treatment plan).
• Date of birth (ask during the intake session or at the start of the treatment).

Linking the Privacy Statement

The checkbox "I agree to the privacy statement" only works if that statement truly exists and is accessible. Write it in understandable language: what data do you collect, why, how long do you store it, with whom do you share it (accountant, any substitute, hosting), and how can someone request access or deletion. No copy-paste legal boilerplate that no one reads.

Technical Side

A form that arrives in your email is technically data processing in your mailbox. This is workable provided your mailbox has two-factor authentication, you do not forward data outside secure channels, and you periodically clean it up. For growing practices, a form that lands directly in practice software (instead of your inbox) is safer in the long run.

The Gentle Side

Above the form, write one calm sentence: "You don't need to fill in much. A brief outline of what's going on is enough for me to think along with you." This lowers the threshold and provides a first experience of how you work. No mandatory fields where there is no reason for them.