Contract, informed consent and client data: the paperwork of private practice

Contract and informed consent: not bureaucracy

Search demand for "informed consent form" and "therapist–client contract" runs into the thousands every month, and nearly always with "template" or "download" attached. The logic is obvious: you need a file. But a document downloaded without understanding what it does protects you only as far as you can explain each clause to a client in your own words.

These four documents — contract, informed consent, data-processing consent and intake form — are usually seen as protection against the client. They do something else. They turn the implicit rules of the work into explicit ones: what happens when a session is cancelled, who may see the notes and under what conditions, what counts as an outcome. Unspoken rules break silently — and almost always at the point where the relationship has already become meaningful.

A survey of 530 psychotherapists in Germany (Gerke et al., 2022) shows where the structure falls apart. Informed consent is obtained routinely by 84%, yet 63% are unsure they meet its legal requirements, and one in five does not inform clients about risks and side effects. Terms and procedures are explained by 96%; the mechanisms of therapy itself, by 33%. This is a convenience sample, self-reported, in a different jurisdiction — the percentages cannot be transferred to Russian practice. But the direction is telling: almost everyone has the document, and the conversation it exists for often does not happen.

The contract: what it fixes

Work with a client is formalised as a paid-services agreement (Russian Civil Code, Chapter 39). Of everything usually listed as "essential terms", only the subject matter is beyond dispute — what exactly is provided and in what scope. Price and timelines belong in the contract, but their absence does not by itself make it void: the law here is softer than templates assume.

The second question specialists ask search engines even more often than the contract itself is tax status. Psychological services are not named in the closed lists of restrictions in the Russian self-employment tax law (422-FZ, art. 4(2) and art. 6(2)), which do name mediators, appraisers, notaries and advocates. The correct phrasing is that the law does not prohibit it — not that it "permits psychologists" anything. The limits are firm: no employees under employment contracts, an annual income cap of 2.4 million roubles, and no payments from your own employer or one you left less than two years ago. The regime itself is an experiment declared through 31 December 2028.

• Subject matter: psychological counselling — not treatment, not medical care
• Fees and payment procedure
• Rescheduling and cancellation rules, including notice periods
• How either party may terminate the agreement
• The practitioner's tax status and how receipts are issued

The receipt is neither a formality nor optional: the law requires you to generate it, hand it to the client, and include the name of the service provided (422-FZ, art. 14). This is where a tax obligation meets confidentiality: how the service is named is a deliberate choice. "Psychological consultation" and a wording that reveals the presenting problem are legally equivalent — and, to the client, are not.

Informed consent and its limits

Contract and informed consent are often merged into one file, and that is the first structural mistake. The contract answers questions about the service and the money. Consent answers different ones: what method you work in, what is known about its effectiveness and risks, what happens in sessions, and where confidentiality ends. The first can be downloaded almost unedited. The second cannot, because it describes your practice, not a generic one.

The line "a psychologist must disclose when life is at risk" circulates through templates as if it were statute. In Russian law no norm imposing that on a private practitioner can be found. The criminal duty to report exists only for terrorism-related offences (Criminal Code, art. 205.6); article 316 punishes actively concealing a grave crime, not staying silent about what was confided; and data-protection law grants a right to process information to protect vital interests when consent cannot be obtained (152-FZ, art. 10(2)(3)) — a permission to process, not a duty to disclose. The "duty to warn" itself is an American doctrine growing out of the 1976 Tarasoff case, and it carries no force in Russian law. The nearest reporting duty that can genuinely touch private practice sits in a different area: the Family Code (art. 122) obliges citizens who have information about children left without parental care to report it to the guardianship authorities. It is not about risk to life or suicidal risk, but it is an adjacent norm worth knowing in advance.

Something else matters more in practice, and templates almost never mention it: a psychologist has no testimonial privilege. The list of persons who may not be questioned as witnesses is closed — judges, advocates, clergy regarding confession, senators and deputies, tax officials, arbitrators, the Human Rights Commissioner (Criminal Procedure Code, art. 56(3)). Psychologists are not on it. A compelled route of disclosure therefore exists, and the client is entitled to know about it before they start talking.

"Information obtained by the Psychologist in the course of work with the Client on the basis of a trusting relationship shall not be disclosed, intentionally or accidentally, outside the agreed conditions."Code of Ethics of the Russian Psychological Society, "Confidentiality"

The operative words are "outside the agreed conditions". The code sets no automatic exception for risk to life; it points back to what you agreed with the client. The limits of confidentiality exist exactly to the extent that you described them in the consent — and what you left out is not supplied for you by law. The only randomised study we could find on this (Ford et al., 1997, JAMA, N = 562) shows the wording carries a measurable price: an explicit confidentiality assurance raised willingness to seek care from 53% to 67%, while a conditional assurance rather than an unconditional one cost 10 percentage points in willingness to return. These were adolescents seeing physicians in the US in 1997, in an analogue design — the magnitudes do not transfer to adult clients of a psychologist. One conclusion does: the wording of a limit is not neutral, so it should be written deliberately, not copied.

Health data initial documents

Information about a client's mental state is health data — a special category of personal data. Its default status is prohibition: processing is not allowed except in the cases listed (152-FZ, art. 10(1) and 10(2)). For a private practitioner exactly one exception works: the client's written consent. The medical exception in the same list requires that processing be carried out by someone professionally engaged in medical activity and bound by medical confidentiality; a psychologist without medical status does not fall under it, and it is not a fallback.

"Consent to the processing of personal data must be specific, substantively defined, informed, conscious and unambiguous… Consent to the processing of personal data must be executed separately from other information and/or documents that the data subject confirms and/or signs."152-FZ, art. 9(1), as amended in 2022 and 2025

The requirement to execute consent as a separate document is recent: it was introduced by 2025 amendments and has applied since 1 September 2025. Before that there was no explicit prohibition on embedding consent in the contract, and templates written earlier still carry that structure. Two practical conclusions follow. First, consent cannot be buried as a clause in the contract — it is a separate document. Second, blanket consent does not work, because the law demands specificity.

And a third, the one people trip over most: written consent is not just any text. The law requires the client's full name, address and identity-document details, the purpose, the list of data, the term, the withdrawal procedure and their signature (152-FZ, art. 9(4)). An electronic form counts as written only if signed with an electronic signature under federal law — a checkbox in a web form, a scan or a confirmation in chat do not qualify. And if you keep records in a third-party service, it processes data on your instruction: it must be named in the consent, and the instruction itself must be formalised — a contract listing the actions, the purposes and the duty of confidentiality (art. 6(3)).

One rule is almost universally forgotten: the duty to notify the data-protection authority before processing begins. Until 1 September 2022 an exemption covered processing connected to a contract with the data subject, which fit nearly every private practitioner — it has been repealed. Of the relevant exemptions one remains: processing carried out exclusively without automated means, i.e. a paper file and nothing else. The law defines non-automated processing through direct human involvement, and the mere fact that data sits in an information system does not by itself make processing automated. In practice, though, keeping records on a computer, in the cloud or in a messenger does not fit this exemption, and it is not a safe basis for skipping notification.

Intake: how much data is enough

The intake form differs from the other three in kind: it does not formalise a relationship, it creates data. Every superfluous field is something you will have to store, protect, produce on request and delete when consent is withdrawn. The law states this as a principle (152-FZ, art. 5(5)): the content and volume of data processed must match the declared purposes, and excess is not permitted.

• Usually needed: presenting concern, prior therapy experience, current state, current medication, contact method
• Almost always excessive in the intake form: passport details and registered address — even though in the data-processing consent itself they are, conversely, mandatory
• Almost always excessive: employer and job title
• Risky: health information about third parties the client mentions in the form
• Needs a separate decision: diagnoses given by other professionals

If you use screening scales at intake, their results are the same health data and live under the same rules as session notes. It is worth holding separately in mind, because a questionnaire feels like "a test" rather than medical information, and ends up in email, a messenger or a spreadsheet far more easily than clinical notes do.

All four documents — informed consent, personal-data consent, the paid-services agreement and the intake form — are available as ready `.docx` files in the Soveria library, in Russian and English. A free practitioner account is required; the library has no plan restriction. They are starting points, not a legal guarantee: they will still need adapting to your practice, ideally with a lawyer.

Three mistakes in practice

The mistakes below are not legal subtleties. They are made precisely by practitioners who already have the paperwork: the set is assembled, signed, filed — and not doing its job.

• Data-processing consent is buried as a clause in the contract. The law requires a separate document, and blanket consent fails the specificity requirement
• The limits of confidentiality are described as "in cases provided for by law". The client learns nothing from this — and neither does the practitioner: filling that formula with actual norms usually turns out to be impossible
• Client data lives in messengers, email and personal notes. That is processing by automated means, with every duty that follows, and it does not become something else because it happens on a phone

Documents do not make a practice safe. What makes it safe is that the practitioner can explain every clause in their own words — and, more importantly, knows what those clauses do not contain. The absence of testimonial privilege, the default prohibition on processing health data, the notification exemption repealed in 2022 — all of it exists whether or not a template was downloaded. The only difference is whether you learn it in advance or at the moment someone asks.

*This material is informational and does not constitute legal advice. The provisions cited are current as of August 2026; wording for a specific practice should be reviewed with a lawyer.*