In this guide · 7 sections
Short answer
Collect as little as possible online: name, contact and preferred time, not a full history. Keep ad pixels off booking and intake pages, use a booking tool with MFA, store notes in an encrypted system, and get explicit consent before any AI note-taker joins a session.
Qualifications and registration: what to show
The Singapore Psychological Society (SPS) states that the practice of psychology is not regulated by the government in Singapore, and that registration on its Singapore Register of Psychologists (SRP) is voluntary. Registered members may use the title Registered Psychologist (Singapore).
That is changing. In a parliamentary reply on 7 May 2026, MOH said that once registration is implemented, the Allied Health Professions Act will protect job titles for five subdisciplines (clinical, clinical neuropsychology, counselling, educational and forensic psychology), and unregistered practitioners will not be allowed to use those titles, including in advertisements. The Straits Times reported that detailed requirements are due by early 2027.
Practitioner page checklist
Why counselling data needs extra care
The PDPA does not create a separate legal category of sensitive data, but the PDPC's advisory guidelines on key concepts expect security arrangements that suit personal data of varying levels of sensitivity. Mental health information sits at the top of that scale: a leak can cause real harm and distress.
For a small practice, the risks are usually ordinary IT gaps rather than sophisticated attacks: intake forms emailed to a shared Gmail, notes in an unencrypted Word file on a laptop, a staff member's password reused elsewhere, or a marketing tag quietly reporting page visits to an ad network.
Intake forms: collect less online
The website's job is to start the relationship, not to complete the assessment. Most of the history can be taken in the first session, in a setting you control.
| Ask on the website | Leave for the first session |
|---|---|
| Name and preferred name | Detailed history and presenting problem |
| Phone or email, and whether you may leave messages | Diagnoses, medication, past treatment |
| Preferred times and in-person or online | Family, relationship and work details |
| Brief reason, as a short optional choice | Risk assessment |
| Who referred them, if anyone | Full NRIC or identity documents |
Two small details matter more than they seem. Ask whether you may leave voicemails or send messages, because a family member may see them. And make the 'reason for contact' field optional and broad (for example individual, couple, family, child), so people do not have to write their story into a web form.
Tracking pixels, analytics and booking pages
Advertising pixels from social networks and ad platforms, and some analytics tools, record which pages a visitor opens and which buttons they click. On a counselling site, a page address like /book/grief-counselling or a form event called 'anxiety-intake-submitted' is itself sensitive.
List every tag on the site
Check your website builder's integrations, Google Tag Manager and any code snippets in the header.
Remove ad pixels from booking and intake pages
If you advertise, keep pixels on general pages only, never on forms or confirmation pages.
Use neutral page and event names
Name pages /book and events 'booking-complete', not the type of therapy.
Get consent for non-essential cookies
Show a cookie notice and load marketing tags only after the visitor agrees.
Update your privacy policy
Say which tools you use, what they collect and how clients can ask questions.
Our website privacy policy and cookie consent guide covers the policy wording and consent banner.
Session notes, telehealth and AI note-takers
Where you keep notes matters as much as the website. A sensible baseline for a small practice:
- notes in a practice management system or encrypted storage with individual logins and MFA, not loose files on a laptop;
- full-disk encryption on every device that can open client records, with remote wipe for lost laptops;
- a business email account, not personal Gmail, for anything client-related;
- a written rule on how long records are kept and how they are destroyed.
For online sessions, use a business account on a video platform with waiting rooms and meeting passcodes, and switch off cloud recording by default. Our Zoom vs Teams vs Google Meet comparison covers the security settings.
AI note-takers are a special case. A tool that joins a session, records audio and produces a summary is processing intimate personal data, sometimes on overseas servers. Use one only with explicit, informed consent from the client for that session, check where the data is stored and whether it is used to train models, and never let a bot join automatically from a calendar invite. Our guide to AI meeting note tools and the PDPA explains the checks.
Do it yourself or get help?
Many solo practitioners build their own site on a template, and that is fine if you keep forms minimal, leave out ad pixels and use a proper booking tool. The harder part is connecting booking, email and notes securely, and writing the privacy documents. This page is general information, not legal advice.
Our Business Website package (S$1,490) builds a practice site of up to six pages with a booking button and contact form. Online Booking System (S$390) sets up appointment types, reminders and deposits in your name, and the PDPA Compliance Pack (S$690) covers your privacy policy, data inventory, staff policy and breach response plan.
Frequently asked questions
Not yet. The Singapore Psychological Society states that psychology is not regulated by the government and that its Singapore Register of Psychologists is voluntary. MOH has said it will introduce registration for five subdisciplines under the Allied Health Professions Act, with detailed requirements expected by early 2027. Once in force, those job titles will be reserved for registered psychologists.
Only what you need to arrange the first session: name, contact details, whether you may leave messages, preferred times, in-person or online, and a broad optional reason such as individual or couple counselling. Leave detailed history, diagnoses, medication and risk assessment for the session itself, where you control how the information is recorded.
You can advertise, but keep ad pixels and conversion tags off booking, intake and confirmation pages, because they can tell ad platforms which service a person looked at. Use neutral page names, load marketing tags only after cookie consent, and explain the tools you use in your privacy policy.
Only with explicit, informed consent from the client for that session, and after checking where the recordings and summaries are stored, how long they are kept and whether they are used to train models. Never let a note-taking bot join automatically from a calendar invite. Many practitioners choose not to use them for therapy sessions at all.
Any major platform on a business account can work if set up properly: waiting rooms, unique meeting links or passcodes, cloud recording off by default and MFA on the account. What matters more than the brand is that you control the account and settings, and that sessions are not recorded or transcribed without the client's agreement.