Superintelligence for Psychology Practices: Scheduling With Limits

In practice, the superintelligence reaching psychology practices is a scheduling agent: a system that answers patients on WhatsApp, offers open time slots, confirms and reschedules sessions, and passes to the team anything outside its script. It is useful for administrative routine precisely because it does not need to know clinical content. The rule guiding the project is simple: the agent looks after the calendar, and the practice remains responsible for confidentiality.

Key takeaways

• The term superintelligence often appears as a generic promise. For a practice, what matters is what the agent does with the calendar and what it deliberately leaves alone.
• A scheduling agent should work with minimal data: contact name, time slot, format and session status. Reason for visit, complaints and session notes stay out of the flow.
• Confidentiality is not solved by a conversation rule alone. It also involves phone notifications, group chats, files, WhatsApp history, internal permissions and the model provider.
• Every message that touches distress, risk or urgency needs a fixed path to a human, defined before launch.
• The safe route is to map the current flow, limit data and actions, pilot with one type of appointment, and only then decide whether to expand, adjust or stop.

What the word superintelligence means in practice for a clinic

The term carries expectations of an assistant that understands everything, suggests treatment steps and even evaluates patients. None of those roles fits in the calendar of a psychology practice, and forcing them in creates risk without operational gain. That is why the useful discussion is about concrete functions and explicit limits. For a more realistic view of what is at stake, read Superintelligence in Psychology Practice.

In our reading, the gain from a scheduling agent shows up as fewer administrative back-and-forths: confirmations that never arrive, slots left empty after a cancellation, reschedules requested outside office hours. These problems are real, but they are process problems. A well-configured agent solves part of them without needing to know why someone is seeking therapy.

What a scheduling agent can safely do

The safe scope is usually short and well defined. In general, the agent can:

• Check open slots according to the professional's rules, such as gaps between sessions, working days and in-person or online format.
• Book, reschedule and cancel within permitted windows, recording only date, time, format and status.
• Send reminders and confirmations using standard texts approved by the practice.
• Offer a waitlist spot when a cancellation opens, following an order and criteria that are written down.
• Forward any message outside the script to reception or the professional, without attempting to answer it.

All of these actions share one trait: they are administrative and verifiable. You can check in the scheduling system whether a reschedule happened and at what time.

What the agent must never receive, record or interpret

The list of prohibitions matters as much as the list of permissions. The agent should not handle:

• Accounts of symptoms, suffering, history, medication, substance use or family situation.
• Reason for visit in free text, because that field often carries clinical content without the patient realizing it.
• Session notes, hypotheses, referrals, summaries or any part of a clinical record.
• Requests for guidance, opinion or risk assessment.

If a patient writes clinical content anyway, the flow should not store that information or reply with analysis. The response should be a fixed protocol that routes the person to a human channel. This point must be tested before any use with real patients.

Stronger protection: what LGPD requires in practice

Brazil's LGPD classifies health data as sensitive personal data (art. 5, item II). Even a booked slot with a psychologist reveals health information, so under a conservative reading, the entire schedule should be treated as sensitive. This does not rule out using AI, but it changes the level of control required. For the specific legal analysis of your case, the practice should consult its lawyer or a specialized advisor.

In practice, a few controls are the starting point:

• Data map: which fields enter, where they are kept, how long they are retained and who can access them.
• Role-based access: reception, professional and system with separate permissions, plus a record of who viewed what.
• Location and transfer: verify where the model processes data and which contracts apply. The topic has its own guide in International Data Transfer Under LGPD When Using AI Providers.
• Minimization inside the conversation itself: the agent asks only for what the booking requires, nothing more.
• Short retention: define how long conversations are kept and schedule their deletion.
• Human review: decisions that affect the patient, such as declining a booking through an automatic rule, need a path for contest and review.

There is also a less obvious security risk. Patients may paste long texts, tell the agent to ignore its rules, or try to get it to reveal information about other patients. The OWASP foundation documents this type of attack, called prompt injection, in its prevention cheat sheet. Defenses include separating instructions from user content, not giving the agent access to data it does not need, and validating actions before executing them. For permissions, OWASP's authorization cheat sheet is the practical reference for checking who can do what.

Checklist for rolling out in a practice

This is a lean sequence to complete before connecting the agent to real patients:

• Define the scope: which session types are included, which days, which channels and which actions are enabled.
• Write the standard message script, free of clinical terms and without describing the nature of the service.
• List the allowed and forbidden fields in the registration and in the conversation.
• Configure escalation triggers to a human, with a fixed response protocol.
• Test with test accounts and risk cases before any real contact. A good starting point is Mock Tools for Testing AI Agents: Safe Sandbox Testing Guide.
• Review phone notification previews, because the message can appear on a locked screen.
• Define retention, export and who is allowed to perform it.
• Keep a decision log: what the agent did, when and under which rule.
• Agree with the patient on the communication channel and on consent to receive messages through WhatsApp.

Illustrative scenario: the message that is not about scheduling

Illustrative scenario: a practice with two psychologists and one receptionist uses an agent to confirm sessions. On a Thursday evening, a patient replies to a confirmation with a sentence saying they cannot take it anymore and do not know whether they will come back the following week. The agent does not try to comfort them, does not give advice and does not save the text to the patient file. It replies with a fixed protocol, explaining that it cannot help with this kind of content through this channel and that, in a risk situation, the person should seek immediate care through SAMU (192) or CVV (188). It then sends an internal alert to reception, without copying the content of the message, so that a human contacts the patient through the agreed channel. The log keeps only the time, the trigger activated and the action taken. This design protects confidentiality and makes sure the person is not left without a response.

How to apply the method in a lean way

The method we use has four steps: map, limit, pilot and hand over. In a practice, mapping means describing how scheduling works today, where the failures are and which data circulates. Limiting means turning that map into data and action rules. Piloting means testing a single flow, such as confirming recurring sessions, with logs and an agreed metric defined before starting, for example the number of reschedules completed without team intervention. Handing over means delivering the flow with documentation and deciding, based on the pilot, whether to expand, adjust or stop.

Our working hypothesis, to be validated in each case, is that the safest pilot is the one with the least sensitive content along its path. When operations become continuous, maintenance can be handled through Be Human. To understand how this fits with appointment booking in general, see Automatic Appointment Scheduling on WhatsApp with AI: How It Works.

Frequently asked questions

Can the scheduling agent check a patient's history? It should not. To book a session, it needs contact details, availability and status, not the clinical record. If the practice connects the agent to the records system, the permission should be minimal read access, limited to administrative fields, and logged.

Does a WhatsApp appointment reminder breach confidentiality? It depends on the content and the format. A message that mentions only date and time, sent to the registered contact and free of clinical terms, greatly reduces exposure. The bigger risk is usually the notification preview and shared phone numbers, so agree on the channel with the patient before the first send.

Do I need consent to use AI for scheduling? The appropriate legal basis depends on the purpose and context, and there is no single answer that fits every practice. For outbound messages, the topic of permission and templates is covered in WhatsApp Outbound Messages: Templates, Opt-In and Best Practices. For the specific legal question, guidance should come from a qualified professional.

Can I start without replacing the records system? In most cases, yes. The safest approach is to start with an agent that acts only on the calendar and confirmations, with minimal data, and to evaluate deeper integrations only after the pilot is stable and the logs show the expected behavior.

Sources

• OWASP: LLM Prompt Injection Prevention Cheat Sheet
• OWASP: Authorization Cheat Sheet
• NIST AI Risk Management Framework