Session note de-identification is the removal of identifying data from a therapist’s free text. The common-law duty of confidence and UK GDPR Art. 9 protect substance misuse detail tightly. anonym.plus does this on your own device, and the prose stays readable. Where the note sits inside a care team’s own health-record system, the more permissive condition for processing special-category data under DPA 2018 Schedule 1 Part 1 para 2 (health or social care purposes) applies only within that care relationship — sharing it outside for supervision or teaching still needs identifiers removed first.
When this applies
A community mental health team (CMHT) clinician wants to present the case at clinical supervision. The file names the client, a spouse, and an employer — each must be hidden before it leaves the trust’s own systems.
How anonym.plus handles it
- Open the file in anonym.plus on your own computer.
- Local OCR reads any scanned page, so typed text is caught too.
- It flags client names, dates, and any third party mentioned.
- Review each match and clear a clinical term caught in error.
- Replace each tag with a safe label, or black it out.
- Save the clean copy. The first version never leaves your machine.
What you need to provide
- The file (PDF, DOCX, TXT, or image scan).
- An operator: Replace (swap), Redact (remove), or Mask (partial).
- Optional: a key map if you must re-link cases later.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Client name | PERSON | Daniel Okafor → [CLIENT_1] |
| Session date | DATE_TIME | Seen 04/02/2026 → [DATE] |
| Spouse named | PERSON | wife Karen → [FAMILY_1] |
| Employer | ORGANIZATION | Atlas Logistics → [EMPLOYER] |
| Phone | PHONE_NUMBER | +44 7911 123456 → [PHONE] |
| NHS number | NHS_NUMBER | NHS 485 777 3456 → [NHS_NO] |
Compliance achieved
- Strips identifiers in substance misuse text under the common-law duty of confidence & UK GDPR Art. 9.
- The health/social care condition in DPA 2018 Schedule 1 Part 1 para 2 covers processing inside the care team only — sharing the note for supervision or teaching needs identifiers removed first.
- Runs offline, so no cloud processor contract is needed.
- Working files are sealed with AES-256-GCM.
- Anonymisation assessed against the ICO motivated-intruder test (UK GDPR Recital 26).
Anonymise therapy session notes offline — see plans & start free →
Limitations & cautions
The common-law duty of confidence limits who may see the data and how it may be re-shared. The tool removes named identifiers from the text. You still judge rare free-text clues that could point back to one person.
Frequently asked questions
Why is substance misuse data treated with extra care?
UK law and NHS policy treat substance misuse records as highly sensitive, because a leak can affect relapse, employment, or family relationships in ways an ordinary health record does not. The common-law duty of confidence restricts re-disclosure beyond the care team, and UK GDPR Art. 9 requires an explicit condition before the data is processed at all — a combination that sets the bar above routine physical-health records.
Do I need a data processor contract for clinical supervision?
No, provided the de-identified copy never leaves your own device. The app has no cloud step, so no outside processor touches the data, and DPA 2018 Schedule 1 Part 1 para 2's care-team condition is never being extended to a third party in the first place.
Are family members hidden too?
Yes. A named spouse, parent, or employer is as much an identifier as the client's own name. The tool flags each one so a supervisor or trainee cannot trace the client through a relative or workplace mentioned in passing.