Can your psychologist see what you tell an AI?

Three people, three different answers

"Can my psychologist see this?" has no single answer, because there are three separate questions inside it. Who can read your messages at the company that runs the AI? Can your psychologist read them? And who else, such as an employer, a person you invited or an advertiser, can?

A chatbot you use on your own is a service between you and its provider. Your psychologist is not a party to it. They cannot see your conversations unless you show them or the product has a sharing feature you turned on. That is the general position, and it is why the American Psychological Association's 2025 advisory asks clinicians to ask patients about their use of chatbots and wellness apps: they often do not know.

The reverse also holds. If a clinician introduces an AI tool, the clinician is not automatically the only reader. Staff at the provider, its sub-processors and sometimes advertisers can be readers too. The product's privacy policy, not the label on its box, tells you which.

What the law says about this kind of data

What you say to a mental-health AI is health data. Under Article 9 of the GDPR, data concerning health is prohibited from processing by default, with exceptions that include the person's explicit consent for specified purposes. The UK's data regulator describes health data as personal data related to physical or mental health, and says it deserves extra protection (UK guidance, which mirrors the EU text here).

Four rights follow from that, all in the regulation:

• Consent can be withdrawn. Under Article 7, withdrawing must be as easy as giving consent, and earlier processing stays lawful.
• You can ask what is held and who received it. Article 15 gives you a copy of your data and information about recipients and transfers outside the EU.
• You can ask for erasure on listed grounds, such as withdrawing consent (Article 17), subject to exceptions such as a legal obligation.
• You can complain. Sweden's IMY advises contacting the organisation first for access, erasure or rectification, and filing a complaint if you get no help.

None of this guarantees a company behaves well. In 2023 the US Federal Trade Commission proposed an order against BetterHelp, alleging it shared email addresses, IP addresses and health questionnaire answers with advertising platforms despite promises to limit disclosure. That case concerned a human-therapy marketplace, not an AI chatbot. It shows why "who else can see it" is a real question and not a formality.

What TwentyThird does, as stated today

This section states only what TwentyThird's privacy policy and safety page say. Check them for the current version.

The controller. WelloWork AB, Uppsala, Sweden, is the controller for personal data processed through TwentyThird.

Consent is split. Health information is processed on your explicit consent (Article 9(2)(a)), given separately at sign-up and withdrawable in Settings. AI processing and transfers outside the EEA have their own consent. Withdrawing consent pauses AI processing.

Who reads what:

Your data is stored in Ireland and the servers that run the site are in Stockholm.

Today, supervision is early access. Until a psychologist is supervising you, nobody at TwentyThird reads your messages or is alerted by them, and the safety page says plainly that no human is alerted today. Every message is checked by an AI safety model; if it rates a message as serious, you see crisis lines and a safety flag is recorded in your account, where you can see it. The quoted text in a flag is removed after 90 days. That safety model can miss things and can flag things that are fine; the page says so.

Your psychologist's own records. A licensed psychologist keeps their own patient records in their own systems under Swedish law. TwentyThird is not their journal system.

Deletion. You can delete your account in Settings. Data is erased 30 days after the request, and signing in before then cancels it. Paid-visit and payout records are kept for 7 years, as the Swedish Bookkeeping Act requires, with your name and notes removed. Backups roll off on a short cycle.

What to do with this

Before you tell any AI something heavy, find four things in its privacy policy: who the controller is, who can read content and why, which companies process it and where, and how deletion works. If a clinician is involved, ask them directly what they can see and what they cannot. Then decide what you are comfortable typing.

Questions to put to your psychologist

If a clinician recommends an AI tool, or you already use one, these questions settle most of the confusion.

1. Will you see my conversations, a summary, or nothing? Can I change that later?
2. Who at the provider can read my content, and for what reasons?
3. If I say something alarming, does a person at the provider or at your practice get an alert, and how fast?
4. Where do my messages go, and which companies process them?
5. What happens to my data if I stop, or if the provider closes?

A clinician who cannot answer these has not yet read the tool's policy. That is information too.

Where this stops

TwentyThird's policy describes its design and its promises; it does not prove how a system behaves, and a policy can change. If you need certainty, ask the company in writing and use your access right.

What this does not replace

A conversation with an AI is not confidential clinical care, and nothing here is legal advice. Your psychologist's duties about your records exist independently of any app. If you are in danger, contact local emergency services now. In the EU, call 112.