Therapy by Carole

Privacy policy

Last updated: 21 June 2026

Who is responsible for your data?

The data controller for this website is:

Carole Andrews
Therapy by Carole
Peebles, Scottish Borders
Email: info@therapybycarole.co.uk

Therapy by Carole is registered with the Information Commissioner's Office (ICO) as a data controller. ICO registration number: C1909172.

What data this website collects

This website collects personal data through two routes:

Online booking (via Cliniko)

When you book an appointment, you are directed to a booking system operated by Cliniko. The information collected includes your name, email address, phone number, and relevant health information required to provide treatment. Cliniko acts as a data processor on behalf of Therapy by Carole. You can review Cliniko's own privacy policy at cliniko.com/policies/privacy.

Mailing list sign-up

If you choose to subscribe to the Therapy by Carole newsletter or email updates, your name and email address are collected for that purpose only. Sign-up is entirely optional and requires your active consent.

Why your data is used and the legal basis

  • Booking and treatment: Processing is necessary to perform the contract for massage therapy services you have requested (UK GDPR Article 6(1)(b)), and where health information is involved, for the provision of health care (Article 9(2)(h)).
  • Mailing list: Processing is based on your consent (UK GDPR Article 6(1)(a)). You can withdraw consent at any time by clicking the unsubscribe link in any email or by contacting info@therapybycarole.co.uk.
  • Existing clients: Where you are an existing client and have had the opportunity to opt out, Therapy by Carole may contact you about similar services under the soft opt-in provisions of the Privacy and Electronic Communications Regulations (PECR).

How long your data is kept

  • Clinical records: Retained for a minimum of 8 years from the date of last treatment, in line with professional guidance. For clients who were under 18 at the time of treatment, records are retained until their 26th birthday.
  • Mailing list: Retained for as long as you remain subscribed. On unsubscribing, your data is deleted or suppressed within 30 days.

Who your data may be shared with

Your personal data is not sold or shared with third parties for marketing purposes. Data may be shared with:

  • Cliniko (booking and practice management system, acting as data processor)
  • Mailchimp (mailing list platform used to send email communications, acting as data processor)
  • Other healthcare professionals, but only with your explicit consent or where required by law

All third-party processors are required to handle your data in accordance with UK GDPR.

Your rights

Under UK GDPR you have the right to:

  • Access the personal data held about you
  • Request correction of inaccurate data
  • Request deletion of your data (subject to legal and professional retention requirements)
  • Withdraw consent at any time where consent is the legal basis for processing
  • Object to processing for direct marketing purposes
  • Request restriction of processing in certain circumstances
  • Complain about how your data is handled: to Therapy by Carole directly, and to the ICO (see Making a complaint below)

To exercise any of these rights, contact info@therapybycarole.co.uk. Requests will be responded to within one calendar month.

Making a complaint

If you have a concern about how your personal data has been handled, you can complain to Therapy by Carole directly by emailing info@therapybycarole.co.uk. Your complaint will be acknowledged within 30 days, investigated without undue delay, and you'll be kept informed of progress and the outcome.

You can also complain to the Information Commissioner's Office (ICO) at any time, at ico.org.uk or by calling 0303 123 1113. You're not required to complain to Therapy by Carole first.

Cookies and website analytics

This website may use cookies or analytics tools to understand how visitors use the site. No cookies that identify you personally are set without your consent. If analytics are in use, data is anonymised and aggregated.

Changes to this policy

This policy will be updated when the services or data practices of Therapy by Carole change in a material way. The date at the top of this page reflects the most recent revision. Continued use of the website after any update constitutes acceptance of the revised policy.