Compassionate Therapy Practice

​

This privacy policy explains how I collect, use and look after personal information at Compassionate Therapy Practice, including when I provide therapy in schools.

Your privacy matters to me. I aim to collect only the information needed to provide therapy safely and thoughtfully, and to be clear about how it is used.

Who is responsible for your information?

I am Chenelle Owen, trading as Compassionate Therapy Practice. I am the data controller for the personal information I hold in running my practice and providing therapy.

You can contact me at chenelle@compassionatetherapypractice.com with any questions about this policy or how your information is handled.

What information I collect

Depending on the work we do together, I may collect:

- Your name, preferred name, date of birth and contact details.
- Parent/carer details and information about parental responsibility, where relevant.
- Emergency contact and GP details.
- Information about your difficulties, health, relevant experiences and current support.
- Communication, learning or sensory needs and helpful adjustments.
- Assessment information, therapy goals and clinical notes.
- Relevant safeguarding information and safety plans.
- Appointment, payment, invoicing and insurance details.
- Emails and other correspondence relating to our work.

Some of this is sensitive information, known as special category data, including information about health, sexuality or other aspects of your personal life.

There is no expectation that you share your full history before we meet. We can discuss what feels relevant as we work together.

Where information comes from

Most information comes directly from you.

When appropriate, I may also receive information from parents or carers, school staff, a referrer, healthcare professionals, social care services or an insurer.

For school-based therapy, this may include a referral, completed information forms, observations about difficulties at school and details of existing support.

Where appropriate, I will discuss information received from others with you. Receiving information does not mean I will automatically share your therapy conversations with the person who provided it.

Why I use your information

I use personal information to:
- Respond to enquiries and arrange appointments.
- Understand your needs and provide assessment and therapy.
- Agree goals and review our work.
- Keep clinical records.
- Coordinate relevant support where appropriate.
- Respond to safeguarding or serious safety concerns.
- Manage payments, invoices and insurance claims.
- Meet applicable legal and professional obligations.
- Respond to requests about your information or concerns about my service.

You can choose what to share, although some information is necessary for me to offer therapy safely.

The legal bases for using information

Depending on the purpose, I rely on:
- Contract, where information is needed to arrange or provide an agreed service.
- Legitimate interests, such as responding to enquiries, maintaining appropriate records and running my practice, where these interests do not override your rights.
- Legal obligation, where a specific legal requirement applies.
- Consent, where this is the appropriate basis for a particular use.

For health information used in assessment and therapy, I also rely on the special category condition for the provision of health or social care, subject to the applicable confidentiality requirements.

Different legal bases or conditions may apply to safeguarding and other specific circumstances. Consent to therapy is separate from the legal basis for handling personal information.

Confidentiality and sharing information

Therapy conversations and clinical records are treated as confidential.

Where sharing information would help your care, we will discuss what can be shared, with whom and for what purpose. This might include an agreed update to a parent/carer, school, GP or another professional.

I may also share relevant information where necessary to address safeguarding or serious safety concerns, or where disclosure is required by law. Wherever possible and appropriate, I will explain this beforehand.

I discuss my clinical work in professional supervision to support safe practice. I minimise identifying information, and supervisors are bound by confidentiality.

Service providers may process information on my behalf to support practice management, communications, storage and payments. This is subject to appropriate contractual and security arrangements.

Therapy in schools

My clinical records are held separately from the school’s records. Arranging or funding therapy does not give the school automatic access to therapy notes or the details of our conversations.

We will agree appropriate communication with school and home, involving the young person wherever possible. This may include attendance, broad goals and helpful support or adjustments.

Invoices will contain only the information needed to identify and process the payment.

The school is responsible for the information it holds and uses for its own purposes. Its privacy notice explains those arrangements.

Children and young people

Young people have their own privacy and data-protection rights.

I explain confidentiality and information sharing in a way that takes account of their age and understanding. We agree appropriate involvement from parents/carers and other people supporting them.

A parent/carer’s request for records will be considered in light of the young person’s rights, understanding, confidentiality and the circumstances. Parental responsibility does not automatically give access to all therapy information.
 

How information is stored

I use secure practice-management systems, including Zanda, for clinical records and administration, alongside appropriate digital storage and communication services.

Security measures include password-protected devices, access controls and two-factor authentication where available. Access is limited to those who need it for an agreed purpose.

Information sent through email or messaging services may also be held in those systems. We will agree an appropriate way to exchange sensitive forms or documents.

If a provider processes information outside the UK, I am responsible for checking that appropriate safeguards are in place.
 

Online sessions

I use Zoom through Zanda for online appointments. 

Please attend from a private space where you are unlikely to be overheard.

 

Sessions are not routinely recorded. Any proposed recording would be discussed and agreed separately beforehand.
 

How long information is kept

My current retention policy is to keep clinical records for seven years after therapy ends. For someone under 18, records are kept until seven years after their 18th birthday, or seven years after therapy ends, whichever is later.

Financial records are retained for seven years, subject to applicable accounting requirements.

Information may be retained longer where there is a documented reason, such as an ongoing complaint, legal claim or legal requirement. Unnecessary enquiry information and correspondence are reviewed and deleted when no longer needed.
Records are securely deleted or destroyed when their retention period ends.

If I am unexpectedly unable to continue working

I have arrangements for a trusted professional colleague to help if I become unexpectedly unable to continue practising.
 

They may access the minimum information needed to contact clients and help arrange appropriate next steps. They are required to respect confidentiality and protect the information they access.

Your rights

Depending on the circumstances, you can:
- Ask for access to your personal information.
- Ask for inaccurate information to be corrected.
- Request deletion or restriction of its use.
- Object to processing based on legitimate interests.
- Request data portability where this right applies.
- Withdraw consent where processing relies on consent.

These rights are not absolute. For example, there may be valid reasons to retain clinical records.

Please email me to make a request. I will usually respond within one calendar month, subject to any lawful extension, and may need to confirm your identity.

If information is lost or disclosed incorrectly

I will assess what happened, take steps to contain it and consider the risks to those affected.

Where a breach meets the reporting threshold, I will notify the Information Commissioner’s Office without undue delay and within 72 hours of becoming aware. I will also inform affected individuals where required.

Website cookies

The website uses cookies and similar technologies. Where consent is required for optional cookies, you can accept or decline them through the website’s cookie controls.

Questions and concerns

If you have questions or concerns about your information, please contact chenelle@compassionatetherapypractice.com.
 

You can also raise a data-protection concern with the Information Commissioner’s Office at www.ico.org.uk.
 

Updates to this policy

I may update this policy when my practice or relevant requirements change. Significant changes affecting current clients will be communicated where appropriate.

Last updated: 7 October 2026