How I handle your information

Last updated: 28 August 2026

Who I am

I am Cordelia Boardman, a psychodynamic psychotherapist and counsellor in private practice in Kentish Town and at The Practice, Oxford Circus. I am the data controller for the information described here, which means I decide what is collected and why.

I am registered with the Information Commissioner’s Office.

You can reach me at cordelia.boardman@gmail.com.

What I collect

When you first make contact, usually by email, I receive your name, your email address and whatever you choose to tell me about why you are getting in touch.

If we go on to work together, I keep:

• your contact details, and those of your GP or an emergency contact where you have given them
• handwritten session notes
• a record of appointments, and of payments and invoices
• our email correspondence
• your insurer and policy details, if you are claiming through private healthcare cover

Session notes and anything you tell me about your health or state of mind are special category data under UK data protection law, which is the most carefully protected kind. I collect it only because I cannot do this work safely without it.

Why I hold it, and on what basis

Under UK GDPR I rely on:

• Contract. To arrange and deliver the sessions you have asked for, and to invoice you.
• Legal obligation. To keep financial records, and to meet safeguarding duties where they apply.
• Legitimate interests. To keep clinical notes to the standard my professional bodies require, and to hold records in case of a complaint or an insurance claim.
• Vital interests. In rare situations, where there is a serious risk to your life or someone else’s.

For health information specifically, I rely on Article 9(2)(h) of UK GDPR, which permits processing for the provision of health and social care by a professional bound by a duty of confidentiality.

Who else sees it

What you tell me in a session is confidential. It leaves this practice only in these circumstances:

• Clinical supervision. I discuss my work in regular supervision, as my professional bodies require. Identifying details are removed wherever possible, and my supervisor is bound by the same duty of confidentiality.
• Your insurer, if you are claiming through private healthcare cover. They receive only what they require to authorise and settle a claim, typically your name, policy number, dates of sessions and a diagnostic code.
• My accountant, who sees invoices for the purpose of financial records.
• My professional indemnity insurer, if a claim were ever made.
• Where the law requires it, or where I believe there is a serious risk of harm to you or to someone else. I would tell you if this happened, unless doing so would increase that risk.

I do not sell or share your information for marketing, and I never will.

How it is kept

Session notes are handwritten and kept in locked storage, separately from anything that identifies you where that is practical.

Email and appointment records are held on a password-protected device with encrypted storage. No system is completely secure, and email in particular is not a confidential medium, which is worth bearing in mind when you write to me.

How long I keep it

I keep clinical records for seven years after our work together ends, so that I can respond to a query, a complaint or a claim. My professional bodies do not set a fixed period, so this is my own policy, set with my indemnity insurer’s requirements in mind.

Where the client was under 18, I keep the records until their twenty-fifth birthday instead. This is because the time limit for bringing a claim does not start to run until a young person turns 18.

Enquiries that do not lead to us working together are deleted within twelve months. Financial records are kept for six years, which is what HMRC requires.

After those periods, records are securely destroyed.

If you are under 18

I work with adolescents as well as adults. Where the client is under 18:

• I ask a parent or guardian to agree to the work before we begin, and they usually give me the contact and background details I need.
• What you tell me in a session is confidential in the same way it would be for an adult. I do not report the content of sessions back to your parents. What I will tell them is whether you are attending, and anything I judge necessary to keep you safe.
• If I become seriously worried about your safety, or someone else’s, I will act on that. Wherever possible I will tell you first.
• A young person who understands what is involved can exercise the rights below themselves. Otherwise a parent or guardian exercises them on their behalf.

Your rights

You can ask me to:

• give you a copy of the information I hold about you
• correct anything that is wrong
• delete it, though I may be required to keep clinical and financial records for the periods above
• restrict what I do with it, or object to my holding it on the basis of legitimate interests
• provide it in a portable format

Ask me at cordelia.boardman@gmail.com and I will respond within one month.

Clinical notes are written for my own use in the work rather than as a report, and you may find them terser than you expect. I am glad to talk through anything in them.

If you are unhappy

Please tell me first, at cordelia.boardman@gmail.com, so that I can try to put it right.

You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, and you can raise a concern about my practice with the UKCP, the BACP or the FPC.

Changes

If I change how I handle information I will update this page and the date at the top.