A psychiatric consultation over video can feel ordinary: two people, two screens, a conversation. What passes through that connection is far from ordinary: symptoms, histories, medication, crises and things many patients have never told anyone else. For European clinics and the health-tech teams who build for them, that changes the platform decision. The question is no longer which tool has the cleanest interface, but where those conversations travel, where any trace of them is stored and who could gain access to them.
Telepsychiatry has moved from pilot projects to everyday practice, and the choice of video layer now sits alongside clinical governance as a decision with lasting consequences. In this guide, we set out a selection framework built around EU data protection, so that care providers, operations and IT leads, data protection officers and product teams can evaluate telepsychiatry software with the right questions in the right order.
Table of contents
The American Psychiatric Association describes telepsychiatry as a subset of telemedicine that can include psychiatric evaluations, therapy (individual, group and family), patient education and medication management, delivered through live video, audio or securely transmitted recordings (American Psychiatric Association, n.d.). It can involve direct contact between a psychiatrist and a patient, or psychiatrists supporting other clinicians, such as primary care teams, with specialist consultation.
The benefits of telepsychiatry are widely reported, from wider access to specialist care to fewer missed appointments, but every one of them depends on patients trusting the channel enough to speak openly.
Under the GDPR, data concerning health is one of the special categories of personal data in Article 9, alongside genetic and biometric data. Processing it is prohibited unless a specific condition applies, such as the provision of health or social care under Article 9(2)(h), and then only under the safeguards of professional secrecy set out in Article 9(3) (Regulation (EU) 2016/679). Mental-health data sits within this category, and it is arguably the most sensitive part of it. A diagnosis of depression, a record of a crisis session or an observation about substance use can affect employment, insurance and relationships for years if it leaks.
The GDPR sets the baseline, but national law adds its own requirements for health data. Professional-secrecy rules are one example: section 203 of the German Criminal Code makes it a criminal offence for doctors and psychologists to disclose patient secrets. Health-data hosting certification is another, such as France's HDS (hébergeur de données de santé) scheme, and medical councils set their own rules on telemedicine. The European Health Data Space Regulation (Regulation (EU) 2025/327) adds further obligations from 2027, so check the rules in each country where you practise.
That higher bar has practical consequences. Large-scale processing of special-category data generally requires a data protection impact assessment under Article 35(3)(b), and organisations whose core activities involve such processing must appoint a data protection officer under Article 37(1)(c). Article 32 requires security measures appropriate to the risk, and with psychiatric data the risk is high by definition. Breaches involving health data also tend to meet the threshold for notifying supervisory authorities and, often, the patients themselves.
Patients who doubt the privacy of a session self-censor, and in psychiatry, what goes unsaid can matter as much as what is said. Choosing a platform built around data protection is therefore part of creating the conditions for good care.
When comparing telepsychiatry platforms, we put the criteria below in a deliberate order. The first questions concern where data lives and under whose rules, because no feature further down the list can compensate for a weak answer there.
Start with data residency: in which countries are session data, recordings, chat messages, metadata and logs stored and processed? For EU providers, the strongest position is that all of this stays inside the EU. Residency alone is not the whole picture, however. Data sovereignty asks a further question: which legal systems could compel the vendor to hand data over? A service hosted in Frankfurt but owned by a company headquartered outside the EU may still be subject to foreign disclosure laws. Ask vendors about their ownership structure and their infrastructure providers, not just the location of their data centres.
When a clinic uses a video vendor, the clinic is normally the controller and the vendor a processor. Article 28 requires a written contract that obliges the processor to act only on documented instructions, keep data confidential, implement appropriate security, assist with data subject requests and delete or return data at the end of the service. A credible vendor offers a DPA without hesitation and publishes or shares its list of sub-processors. Check that list carefully, including where each sub-processor is located and what it handles.
All traffic should be encrypted in transit as a baseline. For the most sensitive sessions, look for end-to-end encryption (E2EE), which ensures that only participants can decrypt audio and video, not the platform operator. Bear in mind that there is a trade-off: server-side recording, transcription and similar features generally require the server to access the media, so they cannot run on a session that stays end-to-end encrypted. A good platform lets you choose per session or per room, rather than forcing one model on every appointment. Where recordings are kept, they should be encrypted at rest.
Ask who can join a session, who can start a recording and who can view notes, recordings or transcripts afterwards. Look for unique, expiring links or token-based room access (your own system issues each participant a credential for one specific room), waiting rooms that let the clinician admit each patient, role-based permissions and audit logs showing who accessed what and when. Clinical staff should have exactly the access their role requires, and no more.
Many platforms now offer AI transcription, summaries or captions. These features can save clinicians time, but they create new data flows and, in some cases, new obligations. The transparency duties in Article 50 of the EU AI Act (Regulation (EU) 2024/1689) have applied since 2 August 2026, and the Digital Omnibus on AI, the amending regulation adopted in July 2026, has postponed the high-risk obligations to 2 December 2027, or 2 August 2028 for AI embedded in products such as medical devices (Regulation (EU) 2026/1744).
A tool that simply transcribes a session is unlikely to be high-risk on its own. Software intended to support diagnosis or treatment decisions may count as a medical device. That is decided under the Medical Devices Regulation (Regulation (EU) 2017/745), by the software's intended purpose, and it is a separate question from the AI Act. If a platform offers emotion recognition, that feature carries its own transparency duties and can count as high-risk. Before enabling any AI feature, read our guide on how to build AI into video without breaking EU law, and ask vendors where AI processing happens, whether any third-party model provider receives session data, whether data is used for training and whether AI features can be switched off entirely.
Every extra step between a patient and their appointment is a reason to miss it. Browser-based sessions that require no app download and no account are much easier for patients who are anxious, older or simply unfamiliar with technology. Older models relied on dedicated hardware in clinic rooms, but most sessions today take place on whatever laptop or phone the patient already owns, so the platform has to work reliably across browsers and devices.
A frozen screen in the middle of a disclosure can derail the whole session. Ask about service level agreements for production deployments, how the platform performs on weak connections, whether it adapts video quality automatically and what support is available when something goes wrong during clinic hours.
Many telepsychiatry companies and digital mental-health services do not want patients to leave their own app or patient portal for a separate meeting tool. An embeddable video API or SDK lets developers place sessions directly inside an electronic health record (EHR), booking flow or care app, under their own brand and domain. This keeps the patient experience coherent and reduces the number of systems that handle personal data.
General-purpose video tools are built for meetings. They are often excellent at that job, but their defaults reflect the needs of businesses rather than clinics: account-based access, persistent meeting rooms, analytics, integrations with productivity suites and, in many cases, hosting or ownership outside the EU. None of this is inherently wrong, but each default needs to be examined, configured or contractually constrained before it is acceptable for psychiatric care.
A GDPR-first platform starts from the opposite direction. EU hosting, minimal data collection, encryption options and controlled access are the baseline rather than add-ons, and the contractual documentation is designed with special-category data in mind. For telepsychiatry providers, that difference shifts the burden. Instead of auditing a general tool to work out what must be switched off, the team can focus on clinical workflows. The best telepsychiatry setups rarely have the longest feature list. Their defaults already match the sensitivity of the conversation.
The most common mistake is assuming that any video tool will do because it is encrypted and widely used. Encryption in transit is necessary, but it says nothing about where data is stored, who can access recordings or which jurisdictions apply to the vendor.
A close second is overlooking sub-processors. A vendor may host its core service in the EU while relying on third parties outside it for transcription, analytics, email notifications or customer support. Each of these may receive personal data, and each must be covered by the DPA and, where relevant, by valid safeguards for international transfers under Chapter V of the GDPR.
Third, providers sometimes treat mental-health data like any other personal data. Special-category rules mean the legal basis, the impact assessment and the security measures all need to reflect a higher level of risk. Recording sessions by default, keeping recordings indefinitely or storing them on general cloud drives are frequent examples.
Another is switching on AI features without review. A summary feature that sends audio to an external model provider can quietly introduce a new processor, a new transfer and a new set of questions under the AI Act.
Finally, teams often evaluate telepsychiatry services on the clinician's experience alone. The patient side matters just as much. If joining requires an app download, an account or a password reset, some appointments will be lost before the session even begins.
For psychiatric care, we would not compromise on a short list of requirements:
Here is where we stand against that list. Digital Samba is a Spanish company (Digital Samba, SL) with no non-EU parent or shareholder, supervised by the Spanish data protection authority (the AEPD), so a clinic that signs with us is dealing with an EU entity under EU law. Digital Samba Embedded, our video conferencing API and SDK, is hosted entirely in the EU on European-owned infrastructure.
We sign a data processing agreement with clear controller and processor roles and publish our sub-processor list. Every sub-processor that handles session data is a European company running EU data centres, including the one that provides live captions, transcription and AI summaries when you switch them on. The only non-European entry on that list is an optional back-office system for billing and customer records, which never touches meeting media, recordings or transcripts.
All traffic is encrypted in transit as standard, and end-to-end encryption is optional per room, chosen when the room is created. With it on, you can still record, but the encryption is suspended while the recording runs, so a recorded session is not end-to-end encrypted, and live captions, transcription and AI summaries are unavailable. Clinics can therefore decide room by room which matters more for a given type of session.
Access to a room is by token (your own system sets how long each token lives), waiting room and role, and who can open a recording afterwards is limited to the roles the account owner allows, with API access tied to the developer key your own platform holds. Recordings are stored encrypted at rest. Under the data processing agreement, session content is processed only on your instructions and only for the service you have asked for, which rules out using it for our own analytics or to train models. The sub-processor that provides transcription and summaries does not train on it either.
Patients join from a modern browser with no app download, and the room can be white-labelled so that sessions run inside your own EHR or care app. Our overview of GDPR-compliant video conferencing goes deeper into hosting and recording compliance, and our guide to video conferencing for therapists compares HIPAA and GDPR requirements for therapy sessions.
Telepsychiatry is psychiatric care delivered at a distance, most often through live video.
No. Compliance depends on how the platform is hosted, contracted and configured, and on how the clinic uses it. Check where data is stored, whether the vendor signs an Article 28 data processing agreement, where its sub-processors are located and whether recordings and AI features can be controlled. The clinic, as controller, remains responsible for its own legal basis and impact assessment.
With an EU-hosted platform, session data, recordings and metadata are stored and processed in data centres inside the EU, ideally on European-owned infrastructure. Always confirm this in the DPA and the sub-processor list, since some vendors keep the core service in the EU but use providers elsewhere for supporting functions.
It can be, provided the platform encrypts all traffic in transit, offers end-to-end encryption for sensitive sessions, restricts access through unique links or tokens and waiting rooms, and stores any recordings encrypted with strict access controls. Security also depends on clinic practices, such as using private spaces and managing who can view recordings.
Not necessarily. Browser-based platforms let patients join directly from a modern web browser on a laptop or phone without installing anything or creating an account, which reduces friction and missed appointments.
A general video tool is designed for business meetings, with defaults such as persistent rooms, accounts and analytics that may not suit clinical use. Platforms built for healthcare, or GDPR-first video layers embedded into clinical software, start with EU hosting, encryption options, controlled access and contractual safeguards for special-category data, so less needs to be reconfigured or restricted before use.
If you are building video into your own care platform, our page on secure video conferencing for telehealth covers how Digital Samba Embedded handles hosting, encryption, access control and white-labelling for telepsychiatry.