How to do online therapy: a complete guide for therapists

What the evidence says: the format is not the limiting factor

It is worth starting here, because many doubts about online therapy are really doubts about whether it works.

On the most repeated worry — "you cannot build a bond through a screen" — the meta-analysis by Seuling and colleagues (2023), covering 18 publications, found no significant difference in therapeutic alliance between videoconference and in-person work, neither as rated by clients (SMD = -0.09) nor by therapists (SMD = 0.04).

The practical reading is not "the format does not matter". It is more interesting than that: when the implementation is looked after, the format stops being the relevant variable. What makes the difference is everything that follows.

The four foundations, before the first session

The Guía para la Intervención Telepsicológica, published by the Official College of Psychology of Madrid (de la Torre Martí and Pardo Cebrián), is the most concrete Spanish-language reference on therapy at a distance. It is written from within psychology, but its criteria work as a frame for any professional running therapeutic processes over video. Four points come out of it that are worth having settled before you open the first session.

1. Specific competence, not just clinical competence

Being a good in-person therapist does not automatically make you a good online one. The guide is explicit: specific training and experience in the remote format are required, and that competence spans four planes — online therapeutic intervention, handling the technology, adapting your communication, and knowing the ethical and regulatory framework.

In practice this means: specific training, supervision through the first cases, and practice with the technology before using it with a real person. Trying the platform for the first time on the day of the first session is a failure of framing, not a technical problem.

2. An informed consent adapted to the online format

The consent form from your in-person practice does not transfer as it is. A consent form for online therapy has to cover, at a minimum:

• The specific technology to be used and its alternative channels.
• What happens if the connection drops: a fallback channel agreed in writing.
• The characteristics of a therapeutic process in the online format, and its limits.
• The processing of personal data: purpose, legal basis, retention period and the processors involved.
• How to exercise the rights of access, rectification, erasure, objection, restriction and portability.
• The policy on recordings: whether sessions are recorded, for what purpose, where they are stored and for how long.

Spanish Law 41/2002 establishes that consent shall be verbal as a general rule and written in specific cases (surgery, invasive procedures or procedures of notorious risk). Psychotherapy does not fall under those cases, but that is no argument for leaving it undocumented: written consent in online therapy is a professional recommendation and, in data protection terms, your main proof of diligence.

3. Verifying identity and location

This is the point most often skipped and the one most likely to cause trouble. The guide recommends establishing — in person or over video — that the person is who they say they are, by asking for identification. With minors, parental responsibility or guardianship has to be verified as well.

And it is worth recording where the person is during sessions. That is not bureaucracy: it is what makes the next point workable.

4. A written crisis plan, before you start

The COP Madrid guide frames this as a prerequisite: the therapist must have a plan of action that guarantees the person's safety in an emergency before the process begins.

A minimum plan includes:

• The physical address the sessions are held from.
• An emergency contact, agreed and consented to in writing.
• The emergency resources of their area, not yours: emergency services, the reference mental health unit, crisis lines.
• An explicit, written criterion for when the online format is interrupted and the person is referred to in-person care.

This is the structural difference between the physical practice and the online one: in your consulting room the safety frame is supplied by the space itself. Online, the safety frame has to be built in advance and in writing.

The legal framework: GDPR, LOPDGDD and Law 41/2002

The data you handle is health data: a special category under Article 9 of the GDPR. This should not paralyse you, but it does order a set of concrete obligations.

Legal basis

Where the activity is practised as a healthcare profession, the processing usually relies on Article 9(2)(h) of the GDPR — preventive medicine or healthcare purposes by a professional bound by professional secrecy — not on generic consent. That distinction matters: it means a person cannot demand the immediate erasure of their record by withdrawing consent. If your activity is not framed as a healthcare profession, the legal basis and the documentary obligations change, so it is worth checking with your professional college or association.

Record of processing activities

Mandatory: controller, purposes, categories of data and data subjects, recipients, security measures and planned retention periods.

Data protection impact assessment

Large-scale processing of health data requires one; for small practices the criterion is more nuanced, but documenting a risk analysis is always defensible.

Data processing agreements

Here is the most common blind spot. Every provider that touches the data of the people you see — video platform, practice management software, email service, transcription tool, cloud storage — is a processor and needs a signed agreement with you. Without that agreement, the responsibility falls entirely on you.

Retention and breaches

Article 17 of Law 41/2002 sets a minimum of five years from the discharge date of each episode of care for clinical documentation. Several autonomous communities extend that period, so it is worth checking the rules that apply to you. In the event of a security breach, notification to the Spanish data protection authority is due within 72 hours of becoming aware of it.

Choosing a platform: five questions that filter almost everything

Do not ask "is it secure?". Ask this:

1. Where is the data hosted? Servers in the European Union avoid the international transfer problem entirely.
2. Will they sign a data processing agreement with me? If getting an answer takes insisting, the answer is no.
3. What encryption is applied, in transit and at rest? And who has technical access to the content.
4. Is my data used to train artificial intelligence models? With therapy data, the only acceptable answer is a contractual no, in writing.
5. Can I export and delete the data when I decide to stop using the tool? If you cannot leave with your data, you are not the controller: you are its hostage.

The basic and free tiers of general-purpose video platforms usually fail questions 2 and 4. For therapeutic use, look for enterprise plans or tools designed specifically for healthcare.

The online setting: what changes inside the session

With the foundations in place, what remains are the details that separate a well-run online session from a video call.

Your space communicates

Neutral background, frontal light, camera at eye level, headphones. A camera slightly above eye level creates a subtle asymmetry that is felt even when nobody can name it.

Their space is agreed

The COP Madrid guide recommends explicitly agreeing the physical place the person connects from, and asking them for a private space with no third parties present. If they connect from the car or from a shared room, that is therapeutic material, not a logistical inconvenience.

The first minutes replace the waiting room

In person, the journey and the wait prepare the person for the session. Online, they go from a spreadsheet to your face in two seconds. A minute of explicit transition at the start recovers that space.

Silences weigh differently

Latency makes pauses read as connection failures. Holding them requires naming them: "I am going to sit with what you just said for a moment."

The ending needs a ritual

Without the gesture of standing up and walking through a door, a session can end abruptly. A verbal closing that is more marked than in person makes up for that absence.

Continuity between sessions: the blind spot of online practice

Here is the problem almost nobody anticipates.

In the physical practice, context is rebuilt with help from the space: the folder on the desk, the note in the margin, the physical memory of the place. Online, that scaffolding disappears. And with calendars that fill up more easily — one of the reasons the online format is attractive — the distance between what happened in session 7 and what you remember at the start of session 8 widens.

The consequence is not dramatic, it is cumulative: questions already answered get asked again, threads the other person is still holding get dropped, and the sense of continuity — which is part of the therapeutic effect — erodes session by session.

Working on this has little to do with writing more and a lot to do with writing better:

• Record the thread, not the transcript. What opened, what was left hanging, in what exact words the person named it.
• Document the same day. Notes written 48 hours later lose precisely the nuance that matters.
• Leave an opening line. A single sentence about where to pick up turns the start of the next session into continuity rather than a cold start.
• Keep a longitudinal view. Being able to review the arc of a whole process, and not just the last note, is what lets you spot patterns that go unnoticed day to day.

This is exactly the work that motivated Alchely: reducing the administrative load and holding the longitudinal continuity of therapeutic processes, with the compliance infrastructure this data demands — EU servers, processing agreements and the commitment not to train models on the data of the people you see.

When online therapy is not the right option

An honest guide has to include its limits. COP Madrid advises against exclusively remote intervention in situations such as:

• Recurrent crises or acute risk to the person's safety.
• Psychotic presentations in an acute phase.
• Situations that may require hospitalisation or immediate in-person assessment.
• Contexts where privacy cannot be guaranteed, for example violence in the home.

That the evidence supports the general efficacy of videoconference therapy does not mean it is appropriate for every case. Professional judgement about whether the format is indicated is part of therapeutic competence, not a box to tick beforehand.

Frequently asked questions about doing online therapy

In short

Doing online therapy rigorously is not about mastering a technology. It is about rebuilding in writing what the physical practice gave you implicitly: the safety frame, the framing of the space, continuity between sessions and the traceability of the data.

The good news is that this work is done once and holds afterwards. The bad news is that it cannot be improvised in the first session.

Sources

• De la Torre Martí, M. and Pardo Cebrián, R. Guía para la Intervención Telepsicológica. Colegio Oficial de la Psicología de Madrid.
• Fernandez, E., Woldgabreal, Y., Day, A., Pham, T., Gleich, B. and Aboujaoude, E. (2021). Live psychotherapy by video versus in-person: A meta-analysis of efficacy and its relationship to types and targets of treatment. Clinical Psychology & Psychotherapy.
• Seuling, P. D., Fendel, J. C., Spille, L., Göritz, A. S. and Schmidt, S. (2023). Therapeutic alliance in videoconferencing psychotherapy compared to psychotherapy in person: A systematic review and meta-analysis. Journal of Telemedicine and Telecare.
• Spanish Law 41/2002, of 14 November, on patient autonomy and rights and obligations regarding clinical information and documentation.
• Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).