Privacy Notice
I take the privacy and confidentiality of people who contact or use Aaron Shaw Psychology seriously.
This Privacy Notice explains what personal information I collect, why I use it, how it is stored, when it may be shared, how long it is retained and your rights under UK data-protection law.
Aaron Shaw Psychology is an independent private practice operated by me, Dr Aaron Shaw, HCPC-registered Clinical Psychologist.
For the purposes of UK data-protection legislation, I am the data controller for personal information processed through Aaron Shaw Psychology.
Last updated: August 2026
Contact details
If you have any questions about how your personal information is used, or wish to exercise your data-protection rights, you can contact me at:
Dr Aaron Shaw
Aaron Shaw Psychology
Email: info@aaronshawpsychology.com
Telephone: 07594 415397
Website: www.aaronshawpsychology.com
What information I collect
The information I collect depends upon how you contact me and the service you use.
Website and initial enquiries
When you contact me through the Aaron Shaw Psychology website, I may collect:
-
your name;
-
email address;
-
telephone number, if you choose to provide it;
-
your general geographical location;
-
the information you provide in your enquiry;
-
information necessary to arrange an enquiry call or appointment.
You do not need to provide detailed clinical information through the website enquiry form. I recommend avoiding highly sensitive information at this stage unless it is necessary for me to understand your enquiry.
My website is hosted using Wix. Information submitted through website forms may therefore be processed and stored within the systems used to operate the website as well as being communicated to the Aaron Shaw Psychology email account.
Email and telephone communication
If you contact me by email or telephone, I may retain information reasonably necessary to:
-
respond to your enquiry;
-
arrange appointments;
-
determine whether my service is likely to be appropriate;
-
maintain an appropriate record of significant communications.
Email should not be regarded as completely risk-free for highly sensitive information.
Where appropriate, more secure methods of communication may be used for particularly sensitive clinical information.
Initial enquiry calls
I offer a brief initial enquiry call before therapy where appropriate.
During this conversation, I may make brief notes about:
-
the reason you are seeking psychological support;
-
the main difficulties you describe;
-
relevant background information;
-
whether the service I provide appears suitable;
-
any significant risk or safeguarding concerns;
-
arrangements for subsequent appointments.
If you subsequently become a client, relevant information from the enquiry may form part of your clinical record.
Information collected when you become a clinical client
If you begin psychological therapy or assessment with me, I may collect information including:
-
your full name;
-
date of birth;
-
home address;
-
email address;
-
telephone number;
-
GP and GP practice details;
-
emergency-contact details;
-
presenting psychological difficulties;
-
physical and mental-health information;
-
medication and relevant medical history;
-
previous psychological or psychiatric care;
-
family and relationship information where clinically relevant;
-
developmental, educational, occupational and social information where relevant;
-
information about significant life experiences;
-
risk and safeguarding information;
-
psychological assessment information;
-
questionnaire and outcome-measure responses;
-
psychological formulations;
-
treatment plans;
-
clinical observations;
-
session notes;
-
correspondence relating to your care;
-
information relating to appointments, fees and payments.
I aim to collect only information that is reasonably necessary to provide safe, effective and appropriate psychological services.
Health and other sensitive information
Information relating to your physical or mental health is considered special-category personal data under UK data-protection legislation and receives additional legal protection.
Psychological therapy may also involve discussion of other particularly sensitive information, including relationships, sexuality, family circumstances, traumatic experiences or other aspects of your personal life.
I treat this information as confidential and process it only where it is reasonably necessary for the provision of psychological care, associated clinical administration or another legitimate professional or legal purpose.
My handling of clinical information is also governed by my professional responsibilities as an HCPC-registered Clinical Psychologist.
Why I use your information
I may process personal information in order to:
-
respond to enquiries;
-
determine whether the service I provide is appropriate;
-
arrange and administer appointments;
-
provide psychological assessment and therapy;
-
formulate psychological difficulties;
-
plan and review treatment;
-
monitor therapeutic progress and outcomes;
-
maintain appropriate clinical records;
-
manage risk and safeguarding concerns;
-
communicate with other healthcare professionals where appropriate;
-
maintain appropriate professional supervision and consultation;
-
administer payments and invoices;
-
submit authorised private-health-insurance claims;
-
meet professional, regulatory, insurance, accounting and legal requirements;
-
respond appropriately to complaints or legal claims relating to the services I have provided.
I do not sell client information.
My lawful basis for processing your information
UK data-protection law requires a lawful basis for processing personal information.
The lawful basis will depend upon why particular information is being used.
Relevant lawful bases may include:
Contract
Where processing is necessary in order to take steps at your request before providing a service, or to provide psychological or professional services you have agreed to receive.
Legitimate interests
Where processing is reasonably necessary for the safe, effective and appropriate operation of my professional practice and those interests do not override your rights and interests.
Legal obligation
Where I need to process or retain information because of a legal requirement.
Vital interests
In exceptional circumstances where processing information is necessary to protect someone's life.
Special-category health information
Because psychological services involve information about physical and mental health, I also need an additional legal condition for processing special-category data.
For clinical psychological services, I principally process health information because it is necessary for the provision of healthcare or treatment by a health professional who is subject to professional confidentiality obligations.
Consent to psychological treatment and consent to sharing information are important aspects of clinical practice, but they are separate from the lawful bases relied upon for routine processing of clinical information under data-protection legislation.
Clinical records
As a Clinical Psychologist, I am professionally required to maintain appropriate records of the services I provide.
Clinical records may include:
-
assessment information;
-
session notes;
-
psychological formulations;
-
risk and safeguarding assessments;
-
outcome measures;
-
treatment plans;
-
significant clinical decisions;
-
correspondence;
-
information relevant to the continuity and safety of your care.
Clinical records are intended to provide an appropriate professional record of the psychological work undertaken. They are not verbatim transcripts of therapy sessions.
I write and maintain my own clinical records.
Private-practice records are kept entirely separately from my NHS or other professional employment records.
I do not use NHS clinical records, NHS patient databases or NHS information systems to maintain records for Aaron Shaw Psychology.
Audio and video recording
I do not routinely audio- or video-record psychological therapy sessions.
In some circumstances, a recording may be considered for a specific:
-
therapeutic purpose;
-
clinical purpose;
-
professional supervision purpose; or
-
professional training purpose.
For example, recording may occasionally be appropriate as part of supervised training in a particular therapeutic approach.
If recording is proposed, this will be discussed with you before any recording takes place.
I will explain:
-
why the recording is being proposed;
-
how it will be used;
-
how it will be stored;
-
who may have access to it;
-
whether anyone outside Aaron Shaw Psychology will view or listen to it;
-
how long it will be retained;
-
when and how it will be securely deleted.
Appropriate informed agreement will be obtained separately before recording takes place.
A recording made for a specific training, therapeutic or supervision purpose will not automatically become part of your permanent clinical record.
Where a recording is no longer required for the purpose for which it was made, it will be securely deleted in accordance with the arrangements agreed with you.
Storage and security
Clinical records are stored electronically using secure systems.
My principal private-practice clinical records are stored within a password-protected Microsoft OneDrive account that is protected by multi-factor authentication.
Access to this account is restricted to me.
The devices used to access clinical information are protected using appropriate security measures.
Aaron Shaw Psychology records, accounts and systems are maintained separately from NHS systems, NHS equipment and other employment records.
I take reasonable technical and organisational measures to protect personal information against unauthorised access, accidental disclosure, loss, alteration or destruction.
Website enquiries and technology providers
My website is operated using Wix.
When you submit an enquiry through the website, the information you provide is processed through Wix, creates a contact record within the website administration system and is also sent to the Aaron Shaw Psychology email account.
I use Wix as an initial enquiry and communication system rather than as a clinical-record system.
The website enquiry form intentionally asks for only limited information, including your name, email address, optional telephone number, general geographical location and a brief description of what you are looking for.
I recommend that you do not provide detailed or highly sensitive clinical information through the initial website enquiry form.
If you subsequently become a client, relevant information is transferred to my separate secure clinical-record system.
Website enquiry information is retained within Wix only for as long as reasonably necessary to manage the enquiry. Where someone becomes a client, the Wix enquiry record will normally be deleted once the relevant information has been incorporated into the appropriate clinical record. Where an enquiry does not proceed, enquiry information will normally be deleted within three months unless there is a legitimate reason to retain it for longer.
Spam and test submissions are deleted when identified.
Private health insurance
Where psychological treatment is funded through private health insurance, I may need to process information including:
-
your name;
-
insurer;
-
membership or policy number;
-
treatment-authorisation information;
-
dates of treatment;
-
treatment information required for claims administration;
-
fees;
-
invoice or claim information.
Claims may be submitted electronically using Healthcode, an independent healthcare billing and claims-processing service.
Information will only be provided to insurers where reasonably necessary to administer treatment that has been authorised under your policy.
Your health insurer and Healthcode have their own responsibilities in relation to information they process and their own privacy arrangements.
Payments and financial information
Payment for private services is normally made by bank transfer.
I may retain financial information necessary to:
-
identify payments;
-
reconcile payments with appointments;
-
provide invoices or receipts;
-
maintain accounting records;
-
meet taxation and other legal requirements.
I do not require clients to provide bank-card details through the Aaron Shaw Psychology website.
Financial records may be subject to different legal retention requirements from clinical records.
Communication with your GP or other professionals
I do not routinely inform your GP that you are receiving private psychological therapy simply because you have contacted Aaron Shaw Psychology.
There may, however, be circumstances in which communication with your GP, psychiatrist or another healthcare professional would support your care.
Where information-sharing would be clinically helpful, I would normally discuss this with you first and seek your agreement.
Where appropriate, clinical correspondence will be transmitted using suitably secure methods.
There are exceptional circumstances in which information may need to be shared without your prior agreement. These can include:
-
a serious or immediate risk to your life;
-
serious risk to another person;
-
safeguarding concerns involving a child or adult at risk;
-
a legal obligation;
-
a valid court order;
-
another circumstance in which disclosure is professionally or legally required.
Where reasonably possible, I will discuss such concerns with you before information is shared.
I will seek to limit any information disclosed to what is reasonably necessary for the purpose.
Emergency contacts
I may ask you to provide the name and contact details of someone who can be contacted in an emergency.
Providing an emergency contact does not mean that person will routinely receive information about your psychological therapy.
I would only use these details where there is an appropriate reason to do so relating to your safety, welfare or care.
Where possible and appropriate, I will discuss use of your emergency contact with you first.
Information about other people
Psychological therapy frequently involves discussion of relationships and other people in your life.
Your clinical records may therefore contain limited information about partners, relatives, colleagues or other individuals.
I will only record information about other people where it is reasonably relevant to understanding your difficulties, providing psychological care or maintaining an appropriate clinical record.
Professional supervision and consultation
Clinical Psychologists use professional supervision and consultation to support safe, ethical and effective practice.
I may discuss aspects of my clinical work with an appropriately qualified professional supervisor or colleague.
Where clinical material is discussed for supervision or consultation, I will seek to minimise unnecessary identifying information and maintain confidentiality.
Professionals involved in supervision or consultation are expected to maintain appropriate professional confidentiality.
How long I keep clinical records
For adult psychological therapy, I normally retain clinical records securely for seven years following the end of therapy.
This is intended to support appropriate professional record keeping and to enable records to be available if a legitimate clinical, regulatory, insurance or legal issue subsequently arises.
Records will then be securely deleted unless there is a professional or legal reason for retaining them for longer.
Different retention arrangements may apply to:
-
financial and taxation records;
-
safeguarding records;
-
complaints;
-
legal proceedings or potential claims;
-
work involving children or young people;
-
other circumstances in which professional or legal requirements justify a different period.
I review retention arrangements periodically and do not intend to retain personal information indefinitely without a legitimate reason.
Who I may share information with
Depending upon your circumstances, information may sometimes need to be shared with:
-
healthcare professionals involved in your care;
-
your GP;
-
emergency services;
-
safeguarding services;
-
private health insurers;
-
Healthcode;
-
appropriately qualified professional supervisors or consultants;
-
professional advisers where there is a legitimate need;
-
organisations providing secure technology or administrative services to Aaron Shaw Psychology;
-
courts, regulators or other bodies where disclosure is legally required.
Information will only be shared where there is an appropriate reason for doing so.
I do not provide private-client information to my NHS employer for the purposes of operating Aaron Shaw Psychology.
I do not use NHS patient information to generate or promote private work.
International processing
Some technology providers used to operate modern online services may process or store information outside the United Kingdom.
Where personal information is processed internationally, I take reasonable steps to ensure that appropriate data-protection safeguards are in place as required by UK data-protection legislation.
You can contact me if you would like further information about the arrangements applying to a particular provider.
Your data-protection rights
Depending upon the circumstances and the lawful basis being relied upon, you may have rights including:
Right of access
You can ask for a copy of personal information I hold about you.
Right to rectification
You can ask for inaccurate personal information to be corrected.
Right to erasure
In some circumstances, you can ask for personal information to be deleted.
This right is not absolute and may not apply where I have a professional or legal reason to retain a clinical record.
Right to restriction
In certain circumstances, you can ask for the use of your information to be restricted.
Right to object
You may have the right to object to particular types of processing depending upon the lawful basis being used.
Right to data portability
In some circumstances, you may have a right to receive information you have provided in a portable electronic format.
Data-protection rights vary according to the circumstances and are not all absolute.
If you wish to exercise any of these rights, please contact:
I will respond in accordance with applicable UK data-protection requirements.
Concerns about how your information has been handled
If you have concerns about the way Aaron Shaw Psychology has handled your personal information, I would encourage you to contact me in the first instance.
Dr Aaron Shaw
Aaron Shaw Psychology
Email: info@aaronshawpsychology.com
I will seek to understand the concern and respond appropriately.
You also have the right to raise concerns about the handling of your personal information with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
Further information is available from the Information Commissioner's Office at:
Relationship with other organisations
Aaron Shaw Psychology is an independent private practice.
Information collected through Aaron Shaw Psychology is maintained separately from information processed through any NHS, university or other professional role I may hold.
My NHS employer, universities and other organisations with which I have professional relationships do not have routine access to Aaron Shaw Psychology client records.
My other professional roles do not provide Aaron Shaw Psychology with access to confidential information held by those organisations.
Further information about how I maintain the separation between my private practice and other professional roles is available on my Clinical Governance & Professional Standards page.
Cookies and website analytics
My website uses technologies necessary for the website to function and may use additional analytics or other technologies depending upon your cookie preferences.
Further information about:
-
the cookies used;
-
what they do;
-
which are necessary;
-
which require a choice or consent;
-
how you can change your preferences
is provided in the separate Cookie Policy.
Changes to this Privacy Notice
I review this Privacy Notice periodically.
It may be updated if:
-
the services I provide change;
-
the way I handle information changes;
-
technology providers change;
-
professional guidance changes;
-
data-protection legislation or regulatory guidance changes.
The date at the top of this page shows when the Privacy Notice was last reviewed.