AI for Psychology Practices: Scheduling Without Exposing Confidentiality

AI for psychology practices works well when it stays on the administrative side: scheduling, confirmations, reminders and billing, using the minimum data needed. Anything that reveals clinical content, such as the reason for the visit, complaints, session notes and patient records, should stay out of the agent's reach. Professional confidentiality requires it, and under Brazil's LGPD (the national data protection law), health data is sensitive personal data.

Key takeaways

• The agent can handle time slots, confirmations, rescheduling, reminders and payment requests, as long as it works with very few fields (name, contact, appointment time, payment status).
• Clinical content, patient records, patient accounts of their situation and any risk screening stay outside the agent, with no exception for convenience.
• The mere fact that someone is a patient is already sensitive information: messages should be neutral and permission to make contact should be recorded.
• Limiting what the agent can see (permissions, tools, fields) protects more than any instruction written in a prompt.
• Start with a single flow, with logs and a clear rule for handing off to the professional, then decide whether to expand, adjust or stop.

Why does a psychology practice need a different design from other businesses?

In a shop or a repair garage, a scheduling mistake costs you an annoyed customer. In a psychology practice, a misdirected message can reveal to a third party that someone is in therapy, and that is already an exposure. On top of that, confidentiality is a duty of the professional, set out in Brazil's Psychologist's Code of Professional Ethics, and it is not something you delegate to a tool. The psychologist or the clinic remains answerable for it.

The LGPD reinforces this. Health-related data is among the sensitive personal data categories, which have stricter processing rules. For questions of interpretation, consult the material from ANPD (Brazil's data protection authority), a legal professional and the guidance of your regional professional council. This article organizes the operational decision. It does not replace legal advice or council rulings.

A note on how to read this: what appears in the LGPD and in professional rules is official documentation. What we describe about agent design comes from implementation experience in customer service processes. Anything that is a hypothesis is presented as a hypothesis, such as the idea that a neutral notice lowers the risk of exposure on a phone screen.

What can an AI agent safely handle?

The practical rule is simple: the agent can handle what the front desk handled, and only what the front desk needed to see. That means repetitive, predictable tasks with no clinical content.

• Share available time slots and record an appointment the patient requests.
• Confirm attendance with a short, neutral message.
• Reschedule or cancel within defined rules (minimum notice, limit on reschedules).
• Send session reminders and reminders about pending administrative documents, such as a signed service agreement.
• Send the payment request: payment link, Pix key and receipt confirmation, without describing the service in detail.
• Answer fixed questions: address, payment methods, missed-appointment policy, link for online sessions.
• Alert the professional when a request falls outside the script.

All of these work best as a deterministic flow, with the AI stepping in only to understand the patient's written message (for example, recognizing that "I need to move it to next week" is a rescheduling request). If you want to understand how the channel works, read automatic appointment scheduling on WhatsApp with AI.

What must stay out of the agent's reach?

The point is not to tell the agent "don't talk about" certain subjects. It is to make sure it has no access to them. A prompt instruction can fail; a permission that does not exist cannot.

• Patient records, progress notes, assessments, reports and any clinical annotation.
• Reason for the visit, complaints, health history and diagnoses, including when the patient volunteers them in the conversation.
• Risk screening, crises and any situation in which the person expresses intense distress. These go straight to a human, with an immediate alert.
• Therapeutic guidance, interpretation of symptoms, suggested techniques or "emotional support" delivered by the AI in place of the professional.
• Decisions about starting, pausing or ending treatment.
• Contact with third parties (family members, school, employer, health insurer) without express and specific authorization.
• Recording and transcribing sessions. This is a separate topic and, if it ever enters the clinic, it needs a clear legal basis and consent, as we discuss in recording meetings with AI and the LGPD.

For a broader view of what AI should never do in clinical practice, see superintelligence in psychology: what AI must never do.

What happens when a patient writes something clinical to the agent?

It will happen. A patient asks to reschedule and adds that "the week was awful" or describes a serious situation. The flow design needs to cover three things:

• The agent does not comment on the content. It replies with a fixed sentence, such as "Your message will be forwarded to the professional."
• The message is forwarded to the psychologist through a channel they actually monitor, with priority when alert words appear.
• The clinical passage is not saved in fields the agent reuses later, and it does not enter summaries, spreadsheets or billing tools.

The third item is the one most often forgotten. If the full conversation history feeds the agent on every reply, clinical information typed once keeps circulating. Deciding how much history the agent sees is a privacy decision, not only a quality decision. Anthropic's engineering material on context engineering for AI agents helps with thinking about this boundary, and our explainer on the context window in AI covers the basics.

How do you handle WhatsApp, reminders and billing without exposing the patient?

WhatsApp is the most common channel in Brazil and also the one that exposes the most. Notifications show on lock screens, phones are shared, and conversations stay saved on devices. A few decisions reduce the risk:

• Neutral text. "Your Thursday 10 a.m. appointment is confirmed. Reply 1 to confirm or 2 to reschedule." No words like therapy, psychologist or clinical session, and no names of conditions.
• A discreet contact name, when the patient prefers it.
• Permission recorded before any outbound message. See WhatsApp outbound messages: templates, opt-in and best practices for the channel and consent side.
• Billing with an amount and a link, with no description of the service beyond what is necessary. No group billing and no automatic follow-ups in a pressuring tone.
• An alternative channel for people who do not want to be contacted on WhatsApp, such as email or a phone call.

Patients also need to know when they are talking to an automated system, and how to reach a person. This is good transparency practice, and it connects with the right to review automated decisions under the LGPD, explained in LGPD automated decision-making: the right to review.

Illustrative scenario: a day of scheduling with limits

This is an illustrative scenario, unrelated to any real clinic. A psychologist works alone, uses a digital calendar and the practice's WhatsApp number. She configures the agent with access to only four fields: name, phone number, session date and time, and payment status.

In the morning, the agent sends neutral reminders for the next day's sessions. One patient replies that they need to reschedule, and the agent offers free slots within the clinic's notice rule. Another patient writes that they can't come because they are "doing really badly and don't know what to do." The agent does not respond to that. It sends the fixed forwarding sentence and alerts the psychologist immediately, and she takes over the conversation.

In the afternoon, the agent sends the payment link for a session already held and marks it as paid when the confirmation arrives. At the end of the day, the psychologist reviews the decision log: what the agent sent, what it forwarded and what it could not resolve. At no point did it have access to the patient records, which live in a different system.

How to apply the method: map, limit, pilot, hand over

For a practice or clinic, the path we use in AI customer service projects is short and conservative.

• Map. List what the front desk does today: who schedules, how confirmation works, how billing works, what happens with no-shows and reschedules. Note how much time this takes and where errors occur, so you have a baseline.
• Limit. Define the fields the agent can see, the actions it can perform and what must always go to a human. Apply the principle of least privilege: OWASP's authorization cheat sheet describes this logic clearly.
• Pilot. Choose a single flow, such as session confirmation, with a log of every decision and a metric agreed in advance (for example, fewer last-minute reschedules or less time spent on confirmations). Run it with a small group of patients who agreed to it.
• Hand over. Deliver the operation with documentation, review rules and a named owner. Then decide whether to expand, adjust or end the pilot. Stopping is also a valid outcome.

For structured risk management, the NIST AI Risk Management Framework offers a useful vocabulary, even though it was designed for larger organizations. If you want to see how we usually approach these projects, read how Juan Carlo works with companies.

Decision checklist before you sign up for a tool

Before connecting any agent to your WhatsApp or your calendar, answer these questions. If any one is left unanswered, the project is not ready.

• Where is the data processed and stored? Is any of it transferred outside Brazil? See international data transfer under LGPD when using AI providers.
• Does the vendor use conversations to train models? Can that be switched off by contract?
• Which fields does the agent read and which does it write? Is there a separate permission for each?
• Are the patient records in a system the agent cannot reach, even through an indirect integration?
• Is every agent action logged, with date, input and output, in a way you can review?
• Is there a fixed sentence and a fast path to a human when clinical content or a risk signal appears?
• Has the patient been told about the automated service and given permission to be contacted through this channel?
• Who deletes the data when treatment ends, and within what deadline set by you and by the applicable rules?

In addition, the OWASP catalog of risks for applications built on language models lists problems such as information leakage and excessive autonomy, which are exactly the ones that matter here.

Frequently asked questions

Can I use a general-purpose ChatGPT to reply to my patients? It is not a good idea. General-use tools, without a contract, without data controls and without action logs, are not suitable for patient messages. If you want to use AI, prefer a flow designed for the practice, with limited permissions and human review. Our company policy for employee ChatGPT use guide covers what to allow and what to ban.

Can the agent screen new patients? It can collect administrative data, such as name, contact and preferred time. It should not ask about complaints, symptoms or history, and it should not assess urgency. That conversation belongs to the professional, who decides how and when to receive the request.

Do I need to tell patients that an automated service exists? Yes, it is the safest and most transparent practice. Explain in simple terms that scheduling and reminders are handled by a system, that there is no clinical content in that conversation and that they can speak to a person. Also record their permission to be contacted on WhatsApp.

Is automatic billing risky for the therapeutic relationship? It can be, if poorly calibrated. Use courteous messages, avoid aggressive repetition, and decide that cases of prolonged delay or conversations about fees are handled by the professional personally. Automation is for sending the link and confirming receipt, not for negotiating.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• OWASP: guia de autorização
• NIST AI Risk Management Framework
• OWASP Top 10 para aplicações com LLM