Counselling records are among the most sensitive a practice can hold, and a growing share of sessions happen over video. The IT that matters is therefore narrow and serious: notes stored where UAE rules permit, reachable only by the clinician, and a video session that stays private and does not drop.
What makes mental health practice IT distinct?
Two things. The first is the sensitivity of the record. A counselling note is not a treatment log; it can contain disclosures about a client's family, employment, immigration position or safety. The consequence of that record being seen by the wrong person is not administrative inconvenience, and it deserves controls chosen with that in mind.
The second is that the session itself is now often a piece of technology. When therapy happens over video, the platform is part of the clinical setting. A call that drops in the middle of a difficult disclosure is a clinical problem, not an IT annoyance, and a platform that records by default is a confidentiality problem waiting to be discovered.
Where may session records be stored?
UAE federal law governing the use of information and communication technology in health fields restricts storing, processing or transferring health data relating to services provided in the UAE outside the country, unless the relevant health authority approves it. It also sets a minimum retention period for health records measured in decades. Mental health records fall within health data.
That makes the choice of practice-management or note-taking software a compliance decision rather than a preference. Many popular platforms store data in the United States or Europe by default, and some offer no way to select or confirm a region. The question to put to any supplier is simple and should get a direct answer in writing: in which country is our client data stored?
We establish those facts rather than interpret the law for you. The assessment produces a list of every system holding client data and the country each one stores it in. You then confirm your obligations with the Dubai Health Authority, the Ministry of Health and Prevention or, depending on your licence and scope, the Community Development Authority, together with your legal advisor.
How should teletherapy be set up?
- A platform whose recording behaviour you have confirmed, and switched off unless consent is explicit.
- A wired connection at the clinician's position rather than Wi-Fi where it is possible.
- A second internet path, so a provider fault does not cancel a session with no notice.
- Headphones always, and a room where the other side of the conversation is not audible.
- A locked screen and closed notes when the session ends, enforced by policy not memory.
- An agreed fallback contact method for when the connection genuinely fails mid-session.
Why does the connection matter more than the camera?
Practitioners tend to invest in a better camera and microphone, which improves a call that is already working. What fails is the path in between. Video conferencing needs consistent upload capacity, and home or small-office connections are usually sold on their download figure, with far less available in the direction a session travels.
We test upload capacity and stability rather than headline speed, then fix the shortest path we can: a wired connection to the desk, quality-of-service settings that give the session priority over everything else on the line, and a second connection that takes over automatically. That sequence removes most mid-session drops, and it is considerably cheaper than people expect.
How is confidentiality protected on the practitioner's own devices?
Most small practices run on a laptop and a phone that go home. Both should be encrypted, both should need a passcode, and neither should hold the only copy of anything. Notifications are an underrated risk: a client's name appearing on a lock screen in a waiting room or on a shared screen during a call is a disclosure nobody intended.
Multi-factor authentication belongs on every account that can reach client records, and Conditional Access can restrict sign-ins to devices the practice actually controls. Microsoft's app protection policies keep practice data inside approved apps on a phone, so it cannot be copied into personal messaging.
What about a practice with several clinicians?
Once more than one clinician is involved, the question becomes who can read whose notes. The default in most software is that everybody can, which is rarely what a practice actually intends. Access should follow the clinical relationship, with a documented exception route for supervision and cover rather than open access to everyone.
Joiners and leavers then become the process that matters most. A clinician leaving a mental health practice should lose access the same day, and that should be a written step somebody owns, not a verbal request. Our offboarding checklist covers the sequence for exactly this.
A practice where notes never leave the right hands
The assessment is deliberately unglamorous: what holds client data, where it is stored, who can reach it, how sessions connect, and what happens if a device is lost. For most practices that produces a short, clear list of things to change, and several of them cost nothing but configuration.
Projects are quoted as a fixed scope, from AED 2,500 to AED 30,000 depending on requirement, and support is a fixed monthly fee with written response times. Practices offering physical therapies alongside counselling will also want the therapists page, and larger multi-clinician operations the clinic page.
If you are weighing the decision behind this rather than the support, our guide on setting up teletherapy properly goes into the detail an assessment would cover.
Frequently asked questions
That depends on where it stores data and whether it records. Establish both in writing from the supplier, then confirm with your regulator whether it satisfies your obligations. We can tell you what a platform actually does technically, which is usually the missing piece rather than the legal question.
Only if it is encrypted, needs a passcode, has multi-factor authentication on the account, and is not the sole copy of the record. Those four together turn a lost laptop into a lost asset rather than a disclosure. Without them a single theft is a serious confidentiality incident.
Usually not. Video sessions need consistent upload capacity and stability, and packages are advertised on download speed. We measure upload and jitter first, then fix the path: a wired desk connection, priority for the session on the line, and a second connection that fails over automatically.
That is a clinical and legal decision rather than a technical one, and the technical default often makes it for you. Many platforms can record without an obvious indication. We confirm what yours does and switch recording off unless you have decided otherwise with explicit consent.
Turn off message previews on lock screens and during screen sharing, and keep practice email and notes inside managed apps rather than personal ones. It is a small configuration change and it removes one of the more likely accidental disclosures in a small practice.
We handle the technical controls and we are explicit about the boundary: we establish the facts about where data sits and who can reach it, and we implement the controls. Clinical and legal judgements remain yours, taken with your regulator and your legal advisor, and our job is that you make them with accurate information.
Written by Srinivasan Ramachandran, Founder, Listonics · Last reviewed September 27, 2026