Calendar sync, text reminders, and client intake packs: what you need to know

When practice software syncs seamlessly with Google, sends automatic text reminders to a phone, or fires off a client intake pack at the click of a button, it can feel like magic.

Behind the scenes, however, that convenience works by opening doorways. Every time an app connects to an outside service, sensitive client information is handed through that door to another company, operating under that provider's commercial terms, running on servers that may be outside of the EU and GDPR protection, and subject to their data practices.

Under UK GDPR, you as the therapist remain the Data Controller. You carry the legal responsibility for where that information travels, where copies are created, and who has access to it.

TherapyLock takes a deliberately different approach:

• No outside calendar sync (Google, Apple, or Outlook).
• No automated SMS reminders.
• No emailing intake forms or client packs.

These features are not against the law, but each one forces sensitive personal data outside your secure clinical environment into consumer cloud accounts, telecommunications networks, and shared household devices that you cannot control.

TherapyLock is designed as a secure vault around two core UK GDPR principles: privacy by design and data minimisation. By keeping your records entirely inside one encrypted, audited space, no client data leaves the vault—protecting your clients' confidentiality and keeping your practice legally defensible.

1. Outside Calendar Synchronisation (Google, Apple, Microsoft Outlook)

Many therapists ask: "Can I sync my TherapyLock appointments with my Google Calendar, Apple iCloud, or Outlook so everything is on my phone?"

While synchronising sounds convenient, connecting a clinical diary to an external calendar creates serious privacy and data-protection vulnerabilities:

• Inference of mental health treatment (Special-Category Data): Under UK GDPR (Article 9), data concerning health is classed as "special-category data" and requires the highest level of protection. Even if an appointment entry is deliberately minimised (for example, showing only "Session: CL-104"), a recurring weekly or fortnightly pattern with a known counsellor or psychotherapy practice allows outside systems, algorithms, and anyone viewing the calendar to reasonably infer that an individual is receiving mental health treatment.
• Apple iCloud Calendar is not end-to-end encrypted: Apple's own security documentation confirms that iCloud Calendars are not end-to-end encrypted. Apple explicitly excludes calendars from end-to-end encryption so that they can interoperate with global calendar protocols (CalDAV). Information placed in iCloud Calendar is accessible on Apple's servers.
• Notifications on shared devices and smart screens: External calendars push notifications across linked ecosystems. An appointment written to a calendar can pop up on an Apple Watch, a shared family iPad on the kitchen counter, an in-car dashboard via Apple CarPlay or Android Auto, or be read out aloud by a home smart speaker (such as Amazon Alexa or Google Home).
• Workplace accounts and employer monitoring: If a client or therapist accesses their calendar through a workplace Google Workspace or Microsoft 365 account, company IT administrators, automated compliance scanners, and backup systems have lawful access to inspect that calendar data.
• Third-party processors and international transfers: Connecting to consumer calendar providers means passing data to commercial third parties operating under consumer terms of service, rather than a negotiated clinical Data Processing Addendum (Article 28).

The safe workflow in TherapyLock:

TherapyLock includes its own built-in calendar for scheduling sessions, tracking attendance, and calculating practice hours.

If you need to keep your personal or family calendar up to date to prevent double-booking, simply create a manual entry in your personal diary titled "Busy"or "Private Practice" covering the time block. Never include a client's identifier, initials, contact details, or notes in an outside calendar.

2. SMS and Text Message Reminders

Practitioners often ask whether TherapyLock can send automated text reminders to clients before their sessions.

We have deliberately chosen not to build SMS functionality into the platform for several reasons:

• SMS is entirely unencrypted in transit: Standard SMS messages travel across telecommunications networks in plain text. They are not encrypted, meaning mobile network operators, routing aggregators, and telecommunications equipment log and store the contents and metadata of every text sent.
• Automatic cloud backups on phones: Almost all modern smartphones back up their SMS text databases automatically to consumer cloud storage: iPhones back up to Apple iCloud, and Android devices back up to Google Drive or manufacturer clouds (such as Samsung Cloud). Once a text reminder is sent, a permanent copy is archived in the recipient's personal cloud account, where it sits outside your control and security perimeter.
• Lock-screen previews and family visibility: Text messages trigger banner alerts and lock-screen notifications by default. If a client's phone is left on a desk, or if they share their device with a partner, family member, or flatmate, the reminder notification can inadvertently disclose that they are attending therapy. The same applies to smartwatches and connected tablets (such as iMessage syncing across iPads and Macs).
• Impossible to amend or recall: Once an SMS is delivered, it cannot be edited, recalled, or deleted from the recipient's phone, carrier logs, or cloud backups. If a message is sent in error or to an outdated number, the breach cannot be undone.

The safe workflow in TherapyLock:

Confirm upcoming appointments verbally with your client at the end of each session, or use an agreed, professional communication channel established during your initial contracting. TherapyLock keeps your appointment schedule and client records secure behind your multi-factor authentication (2FA).

3. Client Intake Packs and Information Forms via Email

Another common question is: "Can TherapyLock email an intake pack or consent form to a new client so they can fill it in and send it back?"

TherapyLock does not send electronic intake packs over standard email. Here is why:

• Email is not a secure vault: Email works much like an electronic postcard. When an intake form is attached to an email, it travels through multiple internet mail servers (MTAs) before reaching the recipient's inbox.
• The data proliferation problem: Emailing an intake form causes copies of sensitive personal data to multiply instantly:

1. A copy is saved in your own "Sent" folder.
2. A copy sits on your email provider's server (and in their routine disaster-recovery backups).
3. A copy sits in your local computer or phone mail cache.
4. A copy arrives on the client's email server.
5. A copy is stored in the client's inbox and local "Downloads" folder.
6. Copies are automatically swept into any cloud backup system running on the client's or your devices (such as Apple Time Machine, OneDrive, or Google Drive).

• High-risk special-category content: An intake pack typically gathers a client's full contact details, emergency contacts, GP details, medical history, current medications, and reasons for seeking therapy. Distributing this level of sensitive special-category data across unencrypted email threads creates significant data breach liability for you as the Data Controller under UK GDPR.

The safe workflow in TherapyLock:

TherapyLock provides professionally vetted templates inside the app under Practice Documents & Templates(including the Client Information and Consent Form and accompanying Practitioner Guidance).

1. Download the template to your computer and customise it with your practice details.
2. Review the document with your client during your initial contracting session (in person, or by screen-sharing during an online session), ensuring they give genuine, informed consent.
3. Once the form is agreed and signed, upload the single completed document directly into that client's record in TherapyLock.
4. Delete any temporary working copies from your local computer's download folder.

The completed document is then stored securely inside TherapyLock, protected by AES-256 encryption at rest, accessible only by you, and included automatically if the client ever requests a formal Subject Access Request (SAR) export.

Summary: Why Keeping Everything in the Vault Protects You

Under UK GDPR (Article 5), personal data must be:

• Processed securely (integrity and confidentiality).
• Adequate, relevant, and limited to what is necessary (data minimisation).

Every integration that connects an outside system (a calendar API, an SMS gateway, or an email attachment) creates another door into your client data and another processor you have to audit and account for.

By keeping your clinical notes, client details, appointment logs, and documents strictly inside TherapyLock, no client data leaves the vault. This keeps your practice legally defensible, protects your clients' privacy, and ensures you meet the strict standards required by UK data-protection law and professional bodies such as the BACP, UKCP, COSCA and NCPS.

Related Articles

• Intake packs in detail — Why TherapyLock does not email intake packs, and what to do instead
• Booking and viewing sessions — Your appointment calendar
• Days you are away — Marking time off and avoiding clashes
• Text reminders in more detail — Why TherapyLock does not send text reminders

Still Need Help?

If you have any other questions about TherapyLock, our support team is here to help.

Email us at support@counsellingtutor.com and we will be happy to assist.