A safe online therapy provider verifies who you are and where you are, records an emergency contact, agrees a crisis plan, and secures your informed consent before any session begins. These steps align with BACP guidance on telephone and online counselling and NHS assessment practice. You can ask to see these checks in writing, and you can decline any service that will not show you how it handles them.
TL;DR:
- Online therapy providers must verify your identity and location at each session, not just during initial sign-up, to ensure safety.
- They should record an emergency contact, have a clear crisis plan, and provide written privacy notices compliant with ICO guidelines before starting therapy.
- Sessions require explicit consent, and therapists should ask direct questions about recent risk factors like self-harm or harm to others during assessments.
- Providers need to have contingency plans for dropped connections, and any recordings must be made only with explicit written consent.
- Checking therapist credentials through recognized registration bodies and verifying secure payment methods and encrypted communication platforms are essential safety steps.
Table of Contents
- At a glance: the essential safety checks a provider should run
- Before your first session: paperwork, assessment and practical preparations
- During sessions: live safety checks, therapist conduct and signs they are following best practice
- After the session and crisis procedures: follow-up, escalation and referrals
- Plain-language privacy: what to look for in privacy notices and data handling statements
- Questions to ask before you book: a practical checklist to verify safety
- Verification of therapist credentials and licenses
- Secure payment and billing procedures
- Use of encrypted communication platforms
- Guidelines for consent and patient agreements specific to online therapy
- Recognizing and handling potential technological vulnerabilities or risks
- Publisher perspective: how MySafeTherapy implements these checks
- If you're ready: how to start with MySafeTherapy
- FAQ
- Sources
At a glance: the essential safety checks a provider should run
Online therapy safety checks exist to replace the physical presence a face-to-face clinic provides. A therapist cannot see your front door or call a receptionist if something goes wrong, so the checks below stand in for that missing context. Each one answers a specific question: who are you, where are you, what happens if this connection drops, and what happens if things get serious.
A provider that has thought this through will cover the following before your first live session ends:
- Your identity and current location are confirmed at the start of each session, not just once at sign-up.
- An initial assessment screens for risk factors such as self-harm or harm to others, using structured, direct questions.
- A named emergency contact is recorded, along with an agreed plan for who gets contacted and when.
- Written privacy information explains how your data is stored, who can see it, and for how long, in line with ICO guidance for health and social care services.
- A contingency plan covers lost connections and gives you a safe, agreed way to end a session if you need to.
If a provider cannot describe these in plain language when you ask, that is a reasonable reason to look elsewhere. Our guide to online therapy safety covers each of these in more depth.
Before your first session: paperwork, assessment and practical preparations
Most providers ask you to complete a short questionnaire before your first appointment, covering your history, current symptoms and any immediate concerns, acknowledging some of the common barriers men face when seeking help. This feeds into a structured initial assessment that commonly lasts around 40 to 50 minutes, according to NHS talking therapies guidance, and a private, distraction-free space is expected for it.
During that assessment, a therapist will ask about current risk, including thoughts of self-harm or harm to others. These questions are asked directly but sensitively, because a vague answer gives the therapist less to work with if a crisis develops later.
Expect the following before your first live session:
- Complete a pre-assessment questionnaire covering your history and current concerns.
- Attend a 40 to 50 minute structured assessment in a private space.
- Provide an emergency contact and confirm your general location.
- Check your device, connection and a backup phone number in advance.
- Read and sign written consent and privacy documents before any paid session starts.
A quiet room, headphones and a charged device matter more online than they do in a waiting room, because there is no receptionist to notice if something has gone wrong. Written consent should name who can access your records, how long they are kept, and what happens if you want to stop therapy.
During sessions: live safety checks, therapist conduct and signs they are following best practice
A well-run session opens with a quick, low-key check: confirming who you are, where you are, and whether anyone else can hear you. BACP's guidance on telephone and online counselling treats this location check as a basic safety step at the start of every appointment, not a one-off formality.
Online sessions lose some of the non-verbal information a therapist would pick up in a room, so a competent practitioner asks more direct, clarifying questions to compensate. If you go quiet or your tone shifts, expect to be asked about it rather than left to carry on.
Some practical measures are specific to remote delivery. A therapist may agree a code word with you in advance that signals you need to end the call quickly. Camera-off sessions, where offered, still involve an agreed procedure for check-ins and a backup contact method if video or audio fails. Recording is only done with your explicit written consent, and a trustworthy therapist will tell you who would have access to any recording and why, a point also raised in BACP's online and phone therapy user guide. Boundaries around contact outside sessions, including social media, should be discussed early rather than left unspoken. If something you say signals a risk to your safety or someone else's, the therapist will tell you they need to act on it before they do, rather than after.
After the session and crisis procedures: follow-up, escalation and referrals
Safety does not end when the call does. A responsible provider checks in on how you are progressing across sessions, not just in the moment of crisis, and keeps a record of any safety concerns raised.
- Routine outcome monitoring tracks how you are doing session by session, flagging any change in risk.
- Emergency services or your named contact are only approached when there is a genuine risk to your safety or someone else's.
- Safety concerns are documented factually, recording what was said, what action was taken and why.
- You may be referred elsewhere if your needs go beyond what online therapy is suited to handle.
- If confidentiality has to be broken for duty of care, the therapist should explain what happened and why as soon as it is safe to do so.
BACP's ethical framework sets out that confidentiality can be broken where there is a risk of serious harm, a safeguarding concern, or a legal requirement to disclose. A therapist working to this standard will try to keep you informed before taking that step, not simply act unilaterally.
Plain-language privacy: what to look for in privacy notices and data handling statements
Health information is "special category data" under UK GDPR, which means a provider needs a specific legal basis, under Article 9, to process it, on top of the general basis required under Article 6. ICO guidance for health and social care organisations sets out what a compliant privacy notice should contain and when a data protection impact assessment, or DPIA, is advisable for higher-risk processing.
A privacy notice worth trusting will cover:
- What data is collected and why, in specific terms rather than vague categories.
- The legal basis for processing it, including the Article 9 condition relied on for health data.
- How long data is kept and when it is deleted.
- Whether any third-party processors (billing providers, cloud storage) have access to it.
- How to make a data subject access request and get a response.
Pro tip: A trustworthy privacy summary fits in one short paragraph on the booking page, with a clear link through to the full notice, rather than burying everything in a long document you are expected to find yourself.
Our page on confidential online support explains how this applies specifically to therapy platforms.
Questions to ask before you book: a practical checklist to verify safety
You are entitled to ask a provider to show, not just claim, that these checks are in place. A direct answer to each of the following tells you more than a general reassurance ever will.
- Ask to see the therapist's registration with BACP, UKCP or NCPS and confirm it independently if you can.
- Ask exactly when and how they record your emergency contact details, and under what circumstances they would use them.
- Ask what their contingency plan is if the call drops or a crisis emerges mid-session.
- Ask whether sessions are recorded, how supervision works, and what training the therapist has in online delivery specifically.
- Ask for written privacy information covering retention periods and any third parties who handle your data.
A provider that answers these clearly, without hedging, is doing the basic work. One that cannot, or will not, is telling you something too.
Verification of therapist credentials and licenses
Anyone can claim to be a therapist online. Checking a credential is one of the few safety steps you can do yourself before you ever book a session. UK-based practitioners are typically registered with a recognised body such as BACP, UKCP or NCPS, each of which maintains a public register you can search independently of what the provider's website tells you.
A registration number alone is not proof of good standing. Check that the registration is current, that it covers the type of therapy being offered, and that there is no record of a live disciplinary action against the practitioner. A platform that lists therapist credentials openly, rather than only on request, is generally easier to verify and gives you less reason to take claims on trust.
Licensing and registration also tell you which ethical framework a therapist is bound by, which matters directly for the other checks in this article: it is the professional body's rules, not the platform's own policy, that set the baseline for confidentiality, consent and risk handling. If a provider cannot name the body a therapist is registered with, that absence is worth treating as a warning sign rather than an oversight.
Secure payment and billing procedures
Payment details are sensitive in their own right, separate from the clinical information you share in sessions. A secure provider processes payments through a recognised payment gateway rather than taking card details directly by email, phone or chat message, and never stores full card numbers on its own systems.
Look for billing pages served over an encrypted connection (the address bar should show a lock icon and "https"), and check that invoices or receipts do not describe the service in a way that reveals sensitive detail to anyone who might see your statement or inbox later. A provider that separates billing records from clinical notes is handling two different categories of risk correctly rather than mixing them into one system.
It is also reasonable to ask whether payment is per session or subscription-based, and what happens to your billing history if you stop therapy. A platform that is transparent about pricing structure, including subscription tiers and per-session fees, tends to be equally transparent about how that payment data is handled.
Use of encrypted communication platforms
Video, chat and voice sessions should run over an encrypted connection, meaning the content of your session cannot easily be intercepted while it is in transit between your device and the therapist's. Digital delivery guidance for technology-enabled care recommends secure networks over open or public Wi-Fi, and treats registration with the ICO, where applicable, as a baseline expectation rather than an optional extra.
In practice, this means avoiding public Wi-Fi for your own sessions where possible, keeping your device and browser updated, and checking that the platform you use is the one the provider actually built or vetted for therapy, rather than a general consumer video app repurposed for sensitive conversations. A platform designed for therapy will usually have features a generic video call tool does not, such as session-specific access controls and no persistent public chat logs.
If a therapist asks to move a session to an unencrypted or unfamiliar app at short notice, that is worth questioning rather than accepting automatically. It is a reasonable thing to raise directly, and a provider with proper safety procedures will have an answer ready.
Guidelines for consent and patient agreements specific to online therapy
Informed consent for online therapy covers more ground than its in-person equivalent, because remote delivery introduces risks that do not exist in a clinic room. BACP's ethical framework expects consent to be written and to explain, in plain terms, how your data is stored, who can access your records and what the practical limits of privacy are when sessions happen over a screen rather than in a room with a closed door.
A proper online consent agreement will typically set out the therapist's crisis procedure, the conditions under which confidentiality may be broken, how recordings (if any) are handled, and what happens if the connection fails mid-session. It should be something you read and agree to before paying for or attending a first session, not a document buried in onboarding emails you are expected to have absorbed by implication.
Consent is not a one-off signature either. A good provider revisits it if your circumstances change, for example if you move, change device, or if the therapist proposes a different format such as chat therapy instead of video. Each format carries slightly different privacy considerations, and your agreement should reflect the one you are actually using.
Recognizing and handling potential technological vulnerabilities or risks
Technology introduces failure points that simply do not exist in a face-to-face room: a dropped call, a hacked account, a shared device that is not actually private, or a notification popping up on screen at the wrong moment. Recognising these risks before they happen is part of what separates a safety-conscious provider from one that has only thought about the clinical side of its service.
A sound contingency plan, the kind described in digital delivery guidance for technology-enabled care, covers what happens if a session drops unexpectedly, including a backup phone number and an agreed next step rather than simply waiting to see if the other person reconnects. It is one of the simplest and most effective safety measures available for remote therapy.
On your side, that means checking your device for software updates before a session, using a password-protected device and account, logging out of shared computers afterwards, and keeping a charged phone nearby as a fallback. If you use chat-based or avatar-based sessions, the same principles apply to the device and account you are using. Our camera-off safety checklist covers device and connection checks specific to sessions where video is not used.
Publisher perspective: how MySafeTherapy implements these checks
Safety checks only matter if they are followed consistently, not treated as a box-ticking exercise. MySafeTherapy connects clients with therapists registered with BACP, UKCP or NCPS, and treats identity verification, emergency-contact collection and written consent as a standard part of starting therapy, not an optional extra. Our confidentiality page sets out how we handle privacy in detail.
— MySafeTherapy
If you're ready: how to start with MySafeTherapy
Some online therapy providers verify therapist identity and registration, record an emergency contact before your first session, and provide written consent and privacy information in line with ICO expectations, so the checks described above are part of their standard procedures.
You can review therapist credentials and our privacy policy, then start therapy when you are ready, or check current pricing for session formats including video, chat and avatar-based options.
This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.
FAQ
Is online counselling as safe as in-person therapy?
Online counselling can meet comparable safety standards when a provider follows structured checks such as identity verification, emergency-contact collection and a clear crisis plan, as set out in BACP's guidance on telephone and online counselling. The main difference is practical rather than clinical: a therapist has less direct ability to intervene physically if something goes wrong, which is why location checks and emergency contacts matter more online.
What happens if my therapist breaks confidentiality?
A therapist will usually try to tell you before or as soon as possible after disclosing information, explaining what was shared and why. BACP's ethical framework permits this only where there is a risk of serious harm, a safeguarding concern, or a legal requirement, not as a routine decision.
How long does an initial online therapy assessment take?
An initial assessment for online therapy commonly lasts around 40 to 50 minutes, based on NHS talking therapies guidance. It typically covers your history, current concerns and a structured check of any immediate risk.
What should a provider's privacy notice tell me?
It should explain what data is collected, the legal basis for processing it, how long it is kept, and whether any third parties can access it, following ICO guidance for health and social care services. A concise summary with a link to the full notice is a good sign; a notice you cannot find easily is not.
What does MySafeTherapy charge for a session?
MySafeTherapy's session fees range from £50 to £200 one-off per session depending on the plan, as listed on the pricing page, with a separate Self-Help subscription available at £14.99 per month.
Sources
- BACP guidance on telephone and online counselling
- Supporting technology-enabled care: digital delivery guidance
- ICO: privacy notice generator and guidance for health and social care
- Croydon talking therapies — first assessment guidance