Privacy notice

Who is responsible for your information

I am Esmée Rotmans, trading as The Essential Self. I am the data controller for the information described here, which means I decide what is collected and how it is used.

• Contact: helloessentialself@gmail.com
• Telephone: +44 (0) 7985 220014
• In person: Cherry Tree Therapy Centre, Buckhurst Hill, Essex
• Professional registration: UKCP-registered psychotherapist, registration number 06158323
• ICO registration: ZA450136

I am registered with the Information Commissioner's Office, as required of practitioners who hold client records electronically.

The short version

I collect only what I need. I keep it securely. I do not sell it, and I do not share it with anyone else except in the narrow circumstances set out below. You can ask me at any time what I hold about you.

If you visit this website

The website does not set cookies for tracking or advertising, and it does not run analytics. If that changes, this notice will be updated first.

Signing up for updates takes you to Substack, which operates as a separate service with its own privacy policy. If you subscribe there, Substack holds your email address, not this website. The contact form is delivered by Web3Forms, which passes your message to my email inbox and does not keep it. Links to Instagram and Substack take you to those services, which handle your information under their own terms.

If you make an enquiry

When you contact me by email, telephone, text, WhatsApp or through the website, I hold what you choose to tell me: usually your name, your contact details and a brief description of what you are looking for.

I use this only to respond to you and to arrange an initial conversation. The lawful basis is my legitimate interest in responding to people who approach my practice.

If we do not go on to work together, I delete your enquiry after six months.

Please avoid putting detailed personal or clinical information in a first email. A brief outline is enough, and we can talk properly once we are in a confidential setting.

If you become a client

I work with adults aged 18 and over. For psychotherapy, therapeutic coaching and Reiki, I hold:

• Your name, contact details and, where you give them, your GP's details and an emergency contact.
• Information relevant to the work, which may include your history, health, circumstances and what we discuss.
• Brief session notes, kept as a professional record of our work.
• Dates of sessions, fees and payments.

The lawful bases. I hold this information to provide the service you have asked for, which under UK GDPR is processing necessary for the performance of a contract. Information about your health, and anything you tell me about your beliefs, sexuality or background, is special category data. I hold it under the condition for the provision of health or social care treatment, by a professional bound by a duty of confidentiality.

This matters in practice: it means your records do not depend on your consent and will not be deleted simply because you withdraw it. I explain why under How long I keep things.

If you come for supervision or mentoring

For supervision and mentoring I hold your name, contact details, information about your professional practice, and brief notes of our sessions.

Where we discuss your clients, you should bring that material anonymised. I do not hold identifiable information about the people you work with, and it is your responsibility as their practitioner to keep it that way.

The lawful basis is the performance of our contract, and my legitimate interest in keeping a professional record.

If you join the mailing list

If you sign up for course updates, I use your email address to tell you about courses, training and new writing. The lawful basis is your consent, and you can withdraw it at any time using the unsubscribe link in any email, or by asking me.

The list is held by Substack. I do not sell or share it.

Confidentiality, and its limits

What you bring is confidential. There are a small number of circumstances in which I may need to pass information on, and I would normally discuss this with you first:

• If I believe there is a serious risk of harm to you or to someone else.
• Where a child or an adult at risk may be being harmed.
• Where the law requires disclosure, including under terrorism or money laundering legislation, or by order of a court.

Supervision. Like all registered therapists, I take my work to clinical supervision. This is a professional requirement and it protects the quality of your care. Your material is discussed without your name or identifying details, and my supervisor is bound by the same confidentiality.

I have a clinical will in place. If I were suddenly unable to work, a nominated professional colleague would contact you and look after your records confidentially, in line with this notice.

If we meet at Cherry Tree Therapy Centre

I see clients in person at Cherry Tree Therapy Centre, where I work as an independent practitioner rather than as an employee.

This means I remain responsible for my own clinical records. They are mine, not the Centre's, and the Centre does not have access to them. The Centre holds its own information about its premises and general enquiries, covered by its own privacy policy.

If you contact the Centre rather than me directly, your enquiry passes through them before reaching me.

If you come to a workshop or training

For workshops and training I hold your name, contact details, your professional role or stage of training, any access needs you tell me about, attendance and certificate records, and payment details.

I use this to run the workshop and issue your certificate. The lawful basis is the performance of our contract. If a workshop is to be recorded, I will tell you beforehand and ask for your agreement.

Messages by WhatsApp or text

If we agree to use WhatsApp or text messages, please keep them to practical arrangements such as times and changes. WhatsApp messages are end-to-end encrypted. Anything more personal is better kept for our sessions.

Who else may handle your information

• Cliniko my practice management and video session system, which holds client records securely.
• Google (Gmail) my email provider, for messages you send me.
• WhatsApp and my mobile phone, for practical messages, if we agree to use them.
• Web3Forms which delivers messages sent through the website's contact form.
• Substack email addresses of mailing-list subscribers.
• My bank for fees paid by bank transfer.
• My accountant for financial records only, never clinical notes.

Each of these handles only what it needs to.

If information is held outside the UK

Some of these services, such as Google, WhatsApp and Substack, may store or process information outside the UK, including in the United States. Where they do, the transfer is protected by safeguards recognised under UK law, such as the UK-US Data Bridge or approved contract terms.

How long I keep things

• Enquiries that do not lead to work: six months.
• Workshop records: attendance and certificate records for five years; payment records as financial records below.
• Client records: five years from the end of our work together, in line with my professional indemnity insurer's requirement. They are then securely destroyed.
• Supervision records: five years from the end of our supervisory work.
• Financial records: six years, as required by HMRC.
• Mailing list: until you unsubscribe.

How your information is kept safe

My records are kept digitally. Client records and online sessions are held on Cliniko, a secure, encrypted practice management system. Anything else, including my devices and email, is password protected. I do not keep paper notes.

Your rights

You have the right to:

• Ask what I hold about you, and receive a copy.
• Have it corrected if it is wrong.
• Ask for it to be deleted. This right is limited for clinical records, which I may need to keep for the periods above.
• Object to how it is used, or ask me to restrict it.
• Receive your information in a portable form, where this applies.
• Withdraw consent for the mailing list at any time.
• Complain, either to me or directly to the regulator.

To exercise any of these, write to me at helloessentialself@gmail.com. There is no charge. I will respond within one month, or within three months for a complex request, in which case I will tell you within the first month.

Complaints

If you are unhappy with how your information has been handled, please tell me first. I will acknowledge your complaint within 30 days, look into it without undue delay, and let you know the outcome.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113. You do not need to come to me first.

Concerns about my professional conduct can be raised with the UK Council for Psychotherapy at psychotherapy.org.uk.

Changes to this notice

This notice was last updated in November 2026. If it changes materially, I will let clients know.