Data Protection Policy

​

Practice: Tranquility Therapy

Business structure: Sole Trader

Data Controller: Sarah Michelle Butler

Policy effective from: 10th September 2026

Review date: 10th September 2027

​

 

Purpose of this policy

 

Tranquility Therapy is committed to protecting the personal information of its clients and handling that information securely, confidentially and responsibly.

 

As a sole-trader counselling practice, Tranquility Therapy holds personal information in order to provide counselling safely and effectively.

 

This policy explains:

 

* what information is collected;

* why it is collected;

* how it is stored and protected;

* when it may be shared;

* how long it is retained;

* how clients may request access to their information; and

* what clients can do if they are concerned about the way their information has been handled.

 

The proprietor of Tranquility Therapy is the Data Controller for information held by the practice.

 

Information collected

 

Tranquility Therapy may collect and retain the following information about clients:

 

* name;

* telephone number;

* email address;

* home address;

* GP surgery details;

* next-of-kin or emergency-contact details;

* information relating to appointments and contact with Tranquility Therapy;

* counselling or session notes; and

* relevant emails or messages exchanged as part of the counselling relationship.

 

Only information that is relevant to the provision of counselling and the safe management of the therapeutic relationship will be collected.

​

Why this information is collected

 

Personal information is collected so that Tranquility Therapy can provide counselling safely and maintain appropriate records of the therapeutic work.

 

Contact details are required so that clients can be contacted about their appointments and counselling arrangements.

 

A client’s home address, GP surgery and next-of-kin or emergency-contact details are collected so that appropriate action can be taken if an emergency or serious concern arises during counselling.

 

These details help ensure that Tranquility Therapy has the information reasonably necessary to support and protect the client if an unexpected situation occurs.

 

Counselling notes and relevant communications are retained as part of the professional record of the therapeutic relationship.

 

Confidentiality and sharing information

 

Client information is treated as confidential.

 

Tranquility Therapy does not routinely share identifiable client information with other people or organisations.

 

There may, however, be exceptional circumstances in which information needs to be disclosed, for example where there is a serious concern about the safety of the client or another person, where safeguarding action is required, or where disclosure is required by law.

 

The circumstances in which confidentiality may need to be broken, and the process followed if this becomes necessary, are set out in the Tranquility Therapy Confidentiality Policy and Safeguarding Policy.

 

Wherever possible and appropriate, a client will be informed before identifiable information is disclosed.

 

Storage and security of information

 

Client records are stored electronically using a secure, password-protected Microsoft OneDrive account.

 

Access to the account is protected by two-factor authentication.

 

During the normal operation of Tranquility Therapy, only the proprietor of the practice has access to client records.

 

Reasonable precautions will be taken to protect client information from:

 

* unauthorised access;

* accidental disclosure;

* loss;

* alteration; or

* destruction.

 

Devices used to access client records will also be protected by appropriate passwords or passcodes.

 

Protecting against data breaches

 

Tranquility Therapy will take reasonable steps to minimise the risk of personal information being accessed, disclosed, lost or altered without authorisation.

 

These measures include:

 

* restricting access to client records to the proprietor of Tranquility Therapy;

* password protection;

* two-factor authentication;

* secure electronic storage; and

* appropriate security on devices used to access client information.

 

If a possible data breach occurs, the circumstances will be reviewed promptly and appropriate steps will be taken to protect the individuals affected and respond to the incident.

 

Retention and destruction of information

 

Client records will normally be retained for seven years following the end of the counselling relationship.

 

After the relevant retention period has expired, the client’s electronic file will be securely deleted.

 

Information will not be retained longer than necessary unless there is a specific reason why it needs to continue to be held.

 

Subject Access Requests

 

Clients have the right to ask to see personal information that Tranquility Therapy holds about them.

 

This is known as a Subject Access Request (SAR).

 

A request may include information such as:

 

* contact details;

* counselling or session notes;

* emails; and

* messages.

 

A client wishing to request access to their information should contact Tranquility Therapy using:

 

Email: sarahcounsellor06@gmail.com

 

When a Subject Access Request is received, Tranquility Therapy will:

 

* establish what information the client is requesting;

* review the relevant records;

* consider whether any information relating to another person needs to be removed or redacted;

* provide the information securely; and

* respond within the applicable timescale.

 

Where appropriate, the client may also be offered the opportunity to go through counselling notes with the counsellor so that the information can be considered in context.

 

Concerns about the handling of personal information

 

If a client believes that Tranquility Therapy has not handled their personal information appropriately, they should raise the matter with Tranquility Therapy in the first instance.

 

Examples might include concerns that:

 

* information has not been stored securely;

* information has been disclosed inappropriately;

* inaccurate information is being held;

* information has been retained unnecessarily; or

* a request to access personal information has not been handled appropriately.

 

Concerns should initially be sent by email

 

The concern will be considered in accordance with the Tranquility Therapy Complaints Policy.

 

Tranquility Therapy will seek, wherever reasonably possible, to resolve concerns directly with the client. This may include discussing what has happened, explaining the action taken, apologising where appropriate and taking reasonable steps to put matters right.

 

If a client remains dissatisfied with the way a concern specifically relating to their personal information has been handled, they may raise the matter with the Information Commissioner’s Office (ICO).

​

Relationship with the Complaints Policy

 

This Data Protection Policy should be read alongside the Tranquility Therapy Complaints Policy.

 

The Complaints Policy explains:

 

* what Tranquility Therapy considers to be a complaint;

* how a client can make a complaint;

* how complaints will be acknowledged and considered;

* how Tranquility Therapy will seek to resolve complaints; and

* what further options are available if a client remains dissatisfied.

 

Where a complaint relates specifically to the handling of personal information, the requirements of this Data Protection Policy will also apply.

 

Review of this policy

 

This policy will be reviewed periodically and updated where necessary to reflect changes in the way Tranquility Therapy operates or stores client information.