Intake and consent forms for therapy practices in India

• Name, date of birth (or age), phone and email, and how the client prefers to be contacted.
• An emergency contact, and when you would use it.
• What brings them to therapy, in their own words, and what they hope will change.
• Previous therapy or psychiatric care, current medication and the name of any doctor treating them, if they are happy to share it.
• Current risk: thoughts of self-harm or suicide, and safety at home. Ask plainly; it is easier on paper for some clients.
• Practical details: in-person or online, preferred times, and who pays (the client, a parent or an employer).

The DPDP Act limits consent to the personal data "necessary for such specified purpose" (section 6(1)), so leave out anything therapy does not need. Therapy rarely needs an Aadhaar number, a full home address for online clients, or a copy of an identity card.

Under section 5 of the DPDP Act, every request for consent comes with a notice. Rule 3 of the DPDP Rules, 2025 says the notice must stand on its own, in clear and plain language, and give at least an itemised description of the data, the purpose, and how the client can withdraw consent as easily as they gave it, exercise their rights and complain to the Data Protection Board. The client can ask to read it in English or any language in the Eighth Schedule of the Constitution (section 5(3)). Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1)), so use a tick box or signature the client actively gives, never a pre-ticked one. These duties start in full on 13 May 2027.

A therapy consent form usually covers:

• What therapy involves, how long sessions last, and that the client can stop at any time.
• What you record (notes, forms, questionnaire scores), where you keep it, who can see it, and for how long. See our guide on how long to keep therapy notes.
• Supervision: whether you discuss cases with a supervisor, and that you share only what is needed.
• The limits of confidentiality, set out below.
• Online sessions, if you offer them: the platform, privacy on both sides, and that neither side records.
• How you will contact the client (email, phone, WhatsApp) and that messages are not for emergencies.
• Fees, how to pay, and your cancellation and no-show policy.
• How to withdraw consent, ask for a copy or erasure of their data, and complain.

Clients should know before they start when you may have to share what they tell you. The Mental Healthcare Act, 2017 sets confidentiality as a right of a person with mental illness (section 23(1)) and lists exceptions in section 23(2), including release to protect another person from harm or violence, to prevent a threat to life, to the person's nominated representative, to other professionals providing their care, and when a court or the Mental Health Review Board orders it.

For children there is a hard limit. Section 19 of the POCSO Act, 2012 says any person who knows of, or apprehends, a sexual offence against a child "shall provide such information" to the Special Juvenile Police Unit or the local police, and section 21 makes failing to report an offence. Say this plainly in forms for minors and their parents.

The NIMHANS guidelines for tele-psychotherapy (2020) put it simply: "concerns regarding the risk of harm to the client or others constitute the limits to confidentiality and these need to be discussed with the client."

• Under the DPDP Act a child is anyone under 18 (section 2(f)), and their data needs verifiable consent from a parent or lawful guardian (section 9(1)). The 2025 Rules exempt a healthcare professional or clinical establishment from this only to the extent needed to provide health services to the child, and whether every counsellor counts as a healthcare professional is not settled, so take a parent's consent anyway.
• The NIMHANS guidelines ask for informed consent from a parent or guardian and assent from the minor, both before sessions begin.
• Agree at the start what you will and will not tell parents, and write it down, so the child knows what stays private.

1. Send the form before the first session, so the client can read it at home and ask questions.
2. Keep it short. A long form full of legal words is not informed consent.
3. Collect answers somewhere secure, not as photos or attachments in chat.
4. Add a standard questionnaire such as the PHQ-9 or GAD-7 if you use them, so you have a baseline.
5. Include crisis numbers for between sessions: 112 for emergencies and Tele MANAS on 14416.
6. Review the form once a year, and when the DPDP Rules start in May 2027.

This is not legal advice. Ask a lawyer to review your consent form, especially if you work with children or in a hospital.