Can the receptionist see therapy notes?

They should not need to. Booking, contact details and payment status are enough for front desk work. Under the DPDP Rules a clinic is expected to control access to personal data, and session content is the most sensitive part of a client's record.

Can a clinic owner read every therapist's notes?

It depends on how the clinic is run. If the owner is the clinical lead and answerable for records, access can be justified. Tell clients who can read their notes, and log every access.

Is it okay to keep therapy notes in a shared document or a note app?

It is not unlawful, but check that you can limit access by role, turn off link sharing, have a valid contract with the provider under the DPDP Act, and find and erase every copy when a client asks.

Guide

Keeping session notes private inside a clinic

Published 23 October 2026Updated 23 October 2026

Who in a therapy clinic should be able to read session notes?

Only the people treating the client: the therapist who wrote the note, the client's own therapist if that is someone else, and a supervisor who reviews their work, plus whoever the clinic makes answerable for clinical records. Front desk staff, other therapists and billing do not need session notes to do their jobs. The DPDP Rules expect access controls and logs of who opened what, and for mental health care the Mental Healthcare Act already makes confidentiality a right.

Why need to know is the rule

The Mental Healthcare Act, 2017 gives a person with mental illness a right to confidentiality about their mental health and treatment (section 23(1)), which applies to "all information stored in electronic or digital format" (section 24(2)). The exceptions in section 23(2) let information go to "other mental health professionals and other health professionals to enable them to provide care", not to everyone who works in the building.
Under the DPDP Act, the clinic must take "reasonable security safeguards to prevent personal data breach" (section 8(5)). A colleague with no reason to read a note who opens it is the kind of breach those safeguards exist to stop.
Rule 6 of the DPDP Rules, 2025 lists the minimum: encryption or masking, "appropriate measures to control access", and logs, monitoring and review of who accessed the data, with the logs kept for a year.

Who needs what

The treating therapist: everything, including notes, plans and assessments.
A supervisor: the notes of the therapists they supervise, to review and sign off. Tell clients at intake that supervision happens; the NIMHANS tele-psychotherapy guidelines ask that exceptions such as supervision discussions be discussed explicitly.
The clinic owner or clinical lead: access when they are answerable for clinical records, ideally as a named role rather than everyone senior.
Front desk: the calendar, contact details and payment status. Not the content of sessions, diagnoses or assessment scores.
Other therapists: that a slot is busy, not who is in it, unless they are also treating the client.
Billing or an accountant: invoices and payments, never clinical detail. Keep invoice descriptions plain, such as "Therapy session".

Shared documents and note apps

Some therapists keep notes in a shared drive, a document editor or a general note-taking app. None of these is unlawful in itself, but check four things before you rely on one:

Access by role. Can you stop the front desk or a colleague from opening a note while still sharing the calendar with them? A single shared folder usually cannot.
Links. A note shared with "anyone with the link" can travel well beyond your clinic. Turn link sharing off for clinical files.
A contract. Under the DPDP Act you may use a processor "only under a valid contract" (section 8(2)), and Rule 6 expects that contract to require security safeguards. Check the provider's terms or data processing agreement.
Erasure and logs. When a client asks, can you find every copy and erase it? Can you see who opened a note last month?

Whatever you use, keep notes off personal phones and out of chat apps, use two-step sign-in, and remove access the day someone leaves the clinic.

A short checklist for clinic owners

List every role in the clinic and what each one needs to see.
Set up your tools so that each role sees only that, and test it by signing in as each role.
Name who supervises whom, and who is answerable for clinical records.
Tell clients at intake who can read their notes, including supervision.
Check the access log now and then, and act on anything unexpected.
Remove access as soon as someone leaves, and review roles when people change jobs.

How Bliss helps

Session notes open only for the therapist who wrote them, the client's own therapist, their supervisor, and clinic owners and admins. The front desk never sees them.

Colleagues see each other's sessions as busy blocks, never client names. Supervisors review notes from the therapists they supervise in one queue.

Each note keeps a history of who opened, changed, finalized or exported it, without holding what it says. A finalized note is locked; changes are added as addenda.

A Bliss support session is never given the permission to read every client's session notes.

Questions people ask

Can the receptionist see therapy notes?: They should not need to. Booking, contact details and payment status are enough for front desk work. Under the DPDP Rules a clinic is expected to control access to personal data, and session content is the most sensitive part of a client's record.
Can a clinic owner read every therapist's notes?: It depends on how the clinic is run. If the owner is the clinical lead and answerable for records, access can be justified. Tell clients who can read their notes, and log every access.
Is it okay to keep therapy notes in a shared document or a note app?: It is not unlawful, but check that you can limit access by role, turn off link sharing, have a valid contract with the provider under the DPDP Act, and find and erase every copy when a client asks.