Last updated: 13 August 2026
This privacy notice explains how I collect, use, store and protect personal information in connection with my psychotherapy practice and website.
Who I am
I am Simon Boots, a Consultant Child and Adolescent Psychoanalytic Psychotherapist and a member of the Association of Child Psychotherapists.
I am the data controller for the personal information processed by my practice.
Contact details
Simon Boots Psychotherapy Services
Haddenham, Buckinghamshire
Email: sb@simonboots.co.uk
Telephone: 07768 028989
Website: www.simonboots.co.uk
I am registered with the Information Commissioner’s Office. My registration number is ZA342853.
Who this notice applies to
This notice applies to:
- prospective, current and former clients;
- children and young people receiving therapy;
- parents, carers and family members;
- people making enquiries;
- referrers, funders and other professionals;
- visitors to this website.
Information I may collect
Depending on the reason for our contact, I may collect:
- your name, date of birth and contact details;
- the contact details of parents, carers or emergency contacts;
- information supplied when an enquiry or referral is made;
- appointment and attendance information;
- information about physical health, mental health, development, family circumstances and personal history;
- clinical assessments, psychotherapy notes and treatment records;
- information relating to risk, safeguarding or child protection;
- correspondence with you and, where appropriate, with other professionals;
- reports, referral information and outcome information;
- invoices, payments and other financial records;
- information needed to provide online appointments;
- technical information generated when you use this website.
Information about health, mental health and treatment is classed as special-category personal data and receives additional protection under data-protection law.
Where information comes from
I usually receive information directly from you or, where relevant, from a parent or carer.
Information may also be received from a referrer or another person or organisation involved in your care. This could include a GP, school, social worker, NHS service, CAMHS team, local authority, solicitor or another health or care professional.
I will explain how information will be used and shared wherever reasonably possible.
Why I use personal information
I process personal information where it is necessary to:
- respond to enquiries and consider referrals;
- assess whether my services are appropriate;
- arrange and provide psychotherapy, EMDR, consultation or supervision;
- maintain appropriate clinical records;
- manage appointments and communicate with clients or families;
- communicate with referrers and other professionals where appropriate;
- issue invoices and maintain accounting records;
- meet professional, safeguarding, insurance and legal responsibilities;
- protect the vital interests of a client or another person in an emergency;
- operate and secure my website and practice.
My lawful bases under UK GDPR may include:
- taking steps at your request before entering into a therapeutic agreement;
- performing my agreement with you;
- complying with a legal obligation;
- my legitimate interests in providing and managing a safe professional practice;
- protecting someone’s vital interests;
- consent, where I specifically ask for it.
For health and other special-category information, I principally rely on the condition covering the provision and management of health or social care by a professional subject to confidentiality. Where appropriate, I may instead request explicit consent or rely on another condition permitted by law.
Consent is not the sole basis on which clinical records are processed. Withdrawing consent will not necessarily require me to delete information that I must retain for professional, legal, safeguarding or insurance reasons.
Confidentiality and sharing information
Information disclosed during psychotherapy is treated confidentially.
I will not normally share identifiable clinical information without your knowledge or agreement. However, confidentiality is not absolute. Information may be disclosed where:
- I believe that a child, young person or another person is at serious risk of harm;
- there is a safeguarding or child-protection concern;
- disclosure is necessary in an emergency;
- I am required to disclose information by law, court order or another lawful authority;
- disclosure is necessary to establish, exercise or defend a legal claim;
- it is necessary to contact my professional indemnity insurer or legal adviser.
I may discuss clinical work in professional supervision. Information used in supervision is anonymised or minimised wherever practicable, and supervisors are bound by professional confidentiality.
Where appropriate and agreed, I may communicate with parents, carers, referrers, GPs, schools, social workers, NHS services or other professionals involved in a client’s care.
I do not sell personal information or use clinical information for advertising.
Children and young people
Children and young people have privacy and data-protection rights in their own name.
The information provided to a child or young person, and the involvement of parents or carers, will depend on their age, understanding, circumstances and the arrangements for therapy.
I will discuss confidentiality and its limits at the beginning of the work. Information will not automatically be disclosed to a parent or carer merely because they arranged or funded therapy. However, information may be shared when necessary to protect the child, young person or someone else from serious harm, or where disclosure is otherwise required by law.
How information is stored
I take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure.
Clinical notes are stored on an encrypted hard drive and are access-controlled. Identifying information is separated or minimised where practicable.
Email correspondence is managed using Gmail. Please avoid including unnecessary sensitive clinical information in an initial email. Email and internet communications cannot be guaranteed to be completely secure.
Invoices and accounting information are stored using QuickBooks in encrypted cloud storage.
Online sessions are conducted using Zoom. Where a session is recorded or transcribed, this will only happen with your knowledge and, where consent is required, your explicit agreement. Recordings and transcripts are stored in encrypted cloud storage and are deleted within 30 days after the relevant clinical record has been completed, unless a different period has been agreed or retention is required for safeguarding or legal reasons.
The website and its files are hosted by my website-hosting provider.
Google, Zoom, Intuit and other technology providers may process information outside the United Kingdom. Where this happens, I rely on the provider’s contractual and legal safeguards for international data transfers.
How long information is retained
I retain information only for as long as it is reasonably needed for clinical care and to meet professional, safeguarding, legal, tax and insurance responsibilities.
My usual retention periods are:
- Adult clients: clinical records are normally retained for seven years after therapy ends.
- Children and young people: records are normally retained until the client’s 25th birthday. If therapy ended when the client was aged 17, records are normally retained until their 26th birthday.
- Initial enquiries that do not lead to therapy: normally retained for 6 months and then securely deleted.
- Invoices and accounting records: retained for the period required by HM Revenue and Customs.
- Zoom recordings and transcripts: retained only for the short period described above.
- Routine correspondence: retained only for as long as necessary. Relevant correspondence may be incorporated into the clinical record and retained with that record.
Records may be retained for longer where there is an ongoing safeguarding concern, complaint, legal claim, court order, insurance matter or another legal or professional reason.
When records are no longer required, they are securely deleted or destroyed.
Website, cookies and technical information
This website does not currently provide public user accounts or public commenting facilities, and I do not currently use advertising or behavioural-tracking cookies.
The website and hosting service may use essential technical cookies and server logs for security, administration and reliable operation. These may record information such as an IP address, browser type, date and time of access and requested pages.
If analytics, a contact form, embedded media or additional cookies are introduced in future, this notice and any cookie information will be updated.
Links on this website may take you to other organisations’ websites. Those organisations are responsible for their own privacy practices.
Your rights
Depending on the circumstances, you may have the right to:
- receive information about how your data is used;
- request access to your personal information;
- ask for inaccurate information to be corrected;
- ask for information to be erased;
- ask for processing to be restricted;
- object to certain processing;
- receive information in a portable format;
- withdraw consent where processing is based on consent.
These rights are not absolute. For example, information may need to be retained for safeguarding, clinical, legal, professional or insurance reasons.
Requests should be sent to sb@simonboots.co.uk. I will normally respond within one month.
Concerns and complaints
If you have a question or concern about how I use personal information, please contact me first:
Email: sb@simonboots.co.uk
Telephone: 07768 028989
You may also complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Telephone: 0303 123 1113
Website: www.ico.org.uk/make-a-complaint
Changes to this notice
I may update this privacy notice when my services, technology, professional guidance or legal responsibilities change.
The date at the top of this page shows when it was last updated.