I've developed a GPT-3 enabled robot therapist that aims to provide empathetic and informed conversations for individuals seeking mental health support. The project leverages the power of GPT-3 to offer a non-judgmental space, evidence-based coping strategies, and encouragement to seek professional help when necessary.
While I think there's definitely room for AI therapy as it can give people better results than many humans, if you don't have safety infrastructure in place (both psychological and patient data) you're walking off a liability cliff. Nobody with a clue would trust a startup with confidential mental health info, which means your customer pool is going to be made up of unstable people. Tell us about yourself First Name…
Personal faith and religion, criminal history, and health related questions such as medication, drug and alcohol use, are all considered as highly sensitive personal data, which is protected under the regulation. Collecting and processing such data is subject to strict requirements and conditions under the GDPR, and requires a legal basis for processing sensitive personal data.
The other questions on the list may not necessarily conflict with GDPR on their own, though that depends on how they are collected, processed, and used. Specifically, since the questions are so broad, most if not all of those questions can be used to fish for secondary information, which can then be used for either illegal marketing, down right scams, or even provide third parties with means of discrimination, which are of course all completely illegal. As such, even otherwise "innocent" questions may also be regulated by the GDRP depending on how you handle them.
As a minimum, sensitive data should be securely encrypted in compliance with the regulation, and then stored only for the minimum required time for processing it. Excess personal data should not be stored at all, and even asking some questions — such as asking whether you're religious — might get you into a heap of trouble depending on how you handle or store that information, if at all.
I think you probably meant well, but as it looks now, I think you should look into the GDPR regulation and carefully consider how your implementation stacks up against it, and also carefully consider how you can build trust in the way you set up your site.
As of now, I wouldn't type anything into your site. But that's me. There might be people who do type stuff into your system, and then is made aware that it's something they should never have done. And that's where most serious legal problems may arise. It is thus in your best interest to carefully consider how such regulations might affects your site, and even if it might be considered to be outside of your jurisdiction.
There are also implications to consider when you send data to a third party's API that probably wasn't meant to handle such data, and that you yourself have no control over outside of the data you get back. You might thus be handing over sensitive data to a third party, where either you, or they, might be considered to handle or store it illegally. To me this represents a rabbit hole of legal problems, of which there are a ton of footguns for us small-time devs. So just make sure you thread carefully.