Privacy Notice

Last updated: 12 September 2026

This Privacy Notice explains how I collect, use, store and protect personal information in connection with my psychotherapy, coaching and supervision services and through this website.

Who I am

I am Naoum Liotas, a sole trader providing services under the name Naoum Liotas – Psychotherapy, Coaching and Supervision Services. I am the data controller responsible for the personal information described in this notice.

Address: Studio 1, 9 Great Russell Street, London WC1B 3NH
Email: contact@naoumliotas.com
Telephone: 020 4538 7798
ICO registration number: ZB913464

My services are for adults aged 18 and over.

Whose information this notice covers

This notice applies to:

  • people who visit or contact me through this website;
  • prospective, current and former psychotherapy or coaching clients;
  • coaching and clinical supervisees;
  • people whose details are provided by a client as an emergency contact;
  • people whose information is shared appropriately in supervision; and
  • people referred through a professional directory, insurer or other referral organisation.

Information I may collect

Depending on how you contact me and the service you request, I may collect:

  • your name, email address, telephone number, home address and date of birth;
  • the service you are interested in and your availability;
  • appointment dates, locations and attendance information;
  • a brief outline of what you would like support with;
  • information you provide in emails, SMS messages or WhatsApp messages;
  • your signed intake form, agreement and electronic-signature information;
  • GP and emergency-contact details;
  • session, consultation or supervision notes;
  • information about your physical or mental health, personal history, relationships, sexuality, beliefs, identity or other sensitive experiences where relevant;
  • payment, invoice, insurance and accounting information;
  • information provided by an insurer, professional directory or referral organisation;
  • limited technical information generated when you use the website, such as your IP address, browser information, cookie preferences and the date and time of your enquiry; and
  • information about another person that is appropriately discussed in clinical or coaching supervision.

I do not receive or store your complete payment-card details when Stripe processes a payment.

How I receive information

Most information is provided directly by you through:

  • the website contact form;
  • the Amelia appointment-booking form;
  • email, telephone, SMS or WhatsApp;
  • an intake form completed and signed using Dropbox or Dropbox Sign;
  • sessions and other professional communications; and
  • payment or invoice arrangements.

I may also receive limited information from a directory or referral source, such as Psychology Today, HarleyTherapy.com, Healthcode or an insurer. When appropriate, I will make you aware of this notice when we first communicate.

If you give me somebody else’s details as an emergency contact, please tell them that you have done so and direct them to this Privacy Notice.

Why I use personal information

I use personal information to:

  • respond to enquiries and decide whether my services may be appropriate;
  • arrange, confirm and manage appointments;
  • provide psychotherapy, coaching or supervision;
  • maintain accurate professional consultation records;
  • communicate with you about our work;
  • manage payments, invoices, insurance authorisations and claims;
  • fulfil professional, ethical, insurance, accounting and legal responsibilities;
  • obtain professional supervision while protecting your identity as far as reasonably possible;
  • protect the safety and vital interests of you or another person;
  • respond to complaints, legal claims, regulatory enquiries or lawful requests;
  • maintain continuity of care if I become seriously incapacitated or die;
  • secure, administer and improve the website and booking process; and
  • prevent abusive, threatening or repeated unwanted contact and maintain appropriate professional boundaries.

I do not sell personal information or use client information for unrelated advertising.

My lawful bases

Under the UK GDPR, I ordinarily rely on one or more of the following lawful bases:

  • Contract: where using your information is necessary to take steps at your request before working together or to provide an agreed service.
  • Legitimate interests: where it is necessary to manage and protect my practice, maintain appropriate records, obtain supervision, secure my systems, manage professional boundaries or establish and defend my professional position.
  • Legal obligation: where information must be retained or disclosed to comply with applicable law, taxation requirements or a lawful order.
  • Vital interests: in the exceptional situation where using or sharing information is necessary to protect someone’s life.
  • Consent: where I ask for a genuine, specific choice, including for optional communications or particular uses of sensitive information where another condition does not apply.

Information concerning health, sexuality, racial or ethnic origin, religious or philosophical beliefs, political opinions or certain other matters is considered special-category information.

Where this information is necessary to assess whether psychotherapy or another form of support is appropriate, or to provide psychotherapy or related health or social care, I rely on Article 9(2)(h) of the UK GDPR and the relevant condition in Schedule 1 of the Data Protection Act 2018. I process this information under professional and common-law duties of confidentiality.

If I wish to process sensitive information for a separate purpose outside this health or social-care context, including a particular purpose arising solely within coaching, I will identify an appropriate legal condition and, where necessary, ask for your explicit consent beforehand. I may also rely on the legal-claims condition where information is necessary to establish, exercise or defend a legal claim.

In exceptional safeguarding or emergency circumstances, another condition permitted by data-protection law may apply.

Information needed to provide services

Certain information is necessary for me to respond to an enquiry, identify you accurately, assess whether I can provide the requested service and manage appointments. This includes your name, email address, date of birth and booking information.

A telephone number is optional at the initial booking stage. If we agree to work together, I may also need your address, telephone number, GP details and an emergency contact—particularly when providing services online.

If necessary information is not provided, I may be unable to accept or continue a booking. You do not need to provide more personal detail through the initial booking form than is reasonably necessary to describe the support you are seeking.

Confidentiality and sharing

Your information is treated confidentially. I share it only where necessary and proportionate.

This may include:

  • discussing aspects of my work in professional supervision, normally without using your full name or unnecessary identifying details;
  • service providers supporting the secure operation of my practice, website, communications, records, appointments and accounts;
  • Stripe and, where applicable, other payment providers;
  • QuickBooks for invoicing and accounting;
  • Google services used for email, coded calendar entries, limited client registers and occasional Google Meet sessions;
  • Dropbox and Dropbox Sign for protected records, forms, backups and electronic signatures;
  • Zoom for online sessions, normally using unique meeting links;
  • WhatsApp where you choose to initiate communication through it;
  • my telephone and SMS provider;
  • website and booking services, including WordPress, Jetpack, Amelia and Complianz;
  • directories, insurers, Healthcode or referral organisations where you use those arrangements;
  • my accountant, insurer, legal adviser or professional body where disclosure is necessary;
  • your GP, emergency contact, emergency services or an appropriate safeguarding body where necessary to address a serious concern;
  • courts, regulators, law-enforcement bodies or other authorities where disclosure is legally required or otherwise lawfully justified; and
  • my nominated professional practice executor in the circumstances described below.

I will normally seek your knowledge or agreement before making a disclosure unless doing so would be inappropriate, unsafe or contrary to a legal obligation.

Professional supervision

Professional supervision is an important part of ethical psychotherapy, coaching and supervision practice. I may discuss aspects of our work with a suitably qualified supervisor. I minimise identifying information and the supervisor is also expected to maintain confidentiality.

Supervisees should avoid providing unnecessary identifying details about their own clients. They remain responsible for their own professional records, privacy information and data-protection responsibilities.

Practice continuity and professional executor

I maintain a limited continuity plan in case I die or become unable to manage my practice.

A nominated professional colleague may be given access to a restricted list of active clients solely when necessary to:

  • inform them of what has happened;
  • support appropriate endings or onward arrangements;
  • secure confidential records; and
  • close or administer the professional practice appropriately.

The colleague is expected to respect professional confidentiality and must not access the information during the ordinary operation of my practice except briefly to confirm that the access arrangement works.

A person close to me may hold the information needed to contact the professional executor but does not have routine access to client records.

Online sessions and electronic communications

Online sessions normally take place through Zoom using unique meeting links. Google Meet or WhatsApp may occasionally be used when Zoom is unavailable or where another arrangement has been agreed.

I do not routinely record sessions. Any proposed recording would be discussed separately and would require a clear purpose and appropriate agreement.

Email, SMS and WhatsApp are useful communication methods, but no ordinary electronic communication service can be guaranteed to be completely secure. Please consider this when deciding what information to include in messages.

International processing

Some technology providers I use operate internationally or may process information outside the United Kingdom. Where this occurs, I expect providers to use an applicable UK adequacy arrangement or appropriate contractual and organisational safeguards for international transfers.

Individual providers may also act as independent data controllers for some information and maintain their own privacy notices.

Cookies, maps and embedded content

This website uses a consent-management system. Optional services such as Google Maps and embedded videos are prevented from loading unless you accept the relevant cookies. If you deny optional cookies, you can continue using the principal parts of the website, although this external content will not display.

Further information is available in the separate Cookie Policy on this website.

How long I retain information

I keep personal information only for as long as it is reasonably needed for the purpose for which it was collected.

My usual retention periods are:

  • General enquiries that do not lead to a session: normally up to 12 months after the last meaningful communication.
  • Client and supervisee consultation records: for a minimum of five years after the final session, in accordance with my professional-insurance requirements. Records are reviewed when this period ends and are normally securely destroyed unless there is a documented reason to retain particular information for longer.
  • Appointment correspondence and intake documents: normally retained in line with the corresponding client or supervisee record.
  • Invoices, payment and tax records: normally retained for at least six years or for the period required by applicable taxation and accounting rules.
  • Active-client continuity information: retained while the professional relationship is active. When the work ends, unnecessary information is removed and any remaining record follows the applicable retention period.
  • Website enquiries and technical records: retained for the period necessary to administer, secure and respond to the enquiry or according to the relevant provider’s configured retention period.
  • Minimal safety or restricted-contact records: retained only where necessary to protect safety, maintain professional boundaries, manage repeated unwanted contact or establish or defend a legal claim. Such records are kept separately, limited to what is necessary and reviewed periodically.
  • Backups: information deleted from active systems may remain temporarily within protected backups until those backups are overwritten according to their normal cycle.

A legal claim, complaint, safeguarding concern, insurer instruction or lawful requirement may sometimes justify a longer retention period. If so, only the information needed for that purpose will be retained.

Professional reflection, teaching and writing

I may draw upon fully anonymised learning from my professional work for reflection, teaching or writing. I take care to remove or alter details so that no individual is reasonably identifiable.

I will not publish identifiable client material without separate, explicit and informed permission. The possibility of future writing does not, by itself, justify retaining identifiable client records beyond their appropriate retention period.

Protecting your information

I use appropriate technical and organisational safeguards, including access restrictions, protected documents, secure devices and reputable service providers. Identifying information is kept separate or coded where reasonably possible; for example, calendar entries use client codes rather than full names.

Access to practice information is limited to people who need it for a legitimate and specified purpose.

Your rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

  • request access to your personal information;
  • ask for inaccurate information to be corrected;
  • request deletion of information;
  • ask for processing to be restricted;
  • object to certain processing;
  • receive information you provided in a portable format; and
  • withdraw consent where processing relies on consent.

These rights are not absolute. For example, I may need to retain certain information to comply with legal or insurance obligations, provide health-related services, address safeguarding concerns or establish or defend legal claims.

To exercise a right or ask a question, contact me at contact@naoumliotas.com. I may need to confirm your identity before disclosing personal information.

If you are dissatisfied with my response, you may complain to the Information Commissioner’s Office.

Changes to this notice

I will review this Privacy Notice periodically and update it when my services, systems, suppliers or legal responsibilities change. The date at the top will show when it was last updated.

If I make a significant change affecting how existing client information is used, I will take reasonable steps to bring it to the attention of those affected.