Privacy Statement

PRIVACY POLICY
Last updated: July 8, 2026

​

This Privacy Policy describes how and why Tulua Therapy ("we", "us", or "our") collects, stores, uses, and protects your personal information when you use our services ("Services"). This applies to both our UK-based clients and our international clients accessing our services worldwide.

​

We act as the Data Controller for your personal data. We are registered with the Information Commissioner’s Office (ICO), the UK's independent data protection authority.

​

If you have any questions or concerns regarding your privacy, please contact us at contact@tuluatherapy.com.

​

1. WHAT INFORMATION DO WE COLLECT?

Personal Information You Disclose to Us
We collect personal information that you voluntarily provide when you express an interest in our Services, book a consultation, or contact us directly. This includes:

• Names, telephone numbers, and email addresses.

• Emergency contact or primary care physician (GP) details (standard professional safety practice).

​​

Special Category (Sensitive) Data

As a therapy practice, we process health-related data, including clinical notes taken during or after your sessions. Under UK GDPR, this is classified as Special Category Data. We treat this information with the highest level of confidentiality and security.

​

Information Automatically Collected
When you visit our website at tuluatherapy.com, we automatically collect certain standard technical data, such as your Internet Protocol (IP) address, device characteristics, and browsing behaviour through cookies. This data does not reveal your specific identity and is used solely for website functionality and internal analytics.

​

2. HOW AND WHY WE PROCESS YOUR INFORMATION

We process your information for the following specific reasons:

• To provide, administer, and deliver our therapeutic Services.

• To communicate with you regarding appointments, billing, or inquiries.

• To ensure your safety or the safety of others in an emergency.

• To comply with our professional, legal, and insurance obligations.

​

3. WHAT LEGAL BASES DO WE RELY ON?

Under the UK GDPR and international data protection standards, we must have a valid legal basis to hold your data. We rely on the following:

• Performance of a Contract: Processing your standard contact details is necessary to fulfil our agreement to provide you with therapy.

• Provision of Health or Social Care (Special Category Data): We process your sensitive clinical and health records under the explicit legal condition of providing healthcare and therapeutic treatment.

• Vital Interests: In rare and exceptional circumstances, we may process or share your information without consent if it is necessary to protect your life or the safety of another individual (e.g., a medical or psychological emergency).

• Legal Obligations: We may process data if required by law, such as cooperating with a court order or regulatory body.

​

4. CONFIDENTIALITY AND DATA SHARING

All information shared during therapy sessions is strictly confidential. We do not sell, rent, or share your personal data with third parties for marketing purposes.

​

Your information will only be disclosed to third parties without your explicit written consent in the following rare scenarios:

• Risk of Harm: If there is reason to believe you or someone else is at immediate risk of serious physical or psychological harm.

• Legal Obligation: If we are legally compelled to do so by a court of law or statutory authority.

• Professional Supervision: In line with UK therapeutic regulations, cases may be discussed anonymously with a qualified clinical supervisor to ensure the highest standard of care. Your identity is always kept completely anonymous.

​​

International Clients
While Tulua Therapy is a UK-based business operating under UK GDPR, we work with clients worldwide. By using our Services from outside the UK, you acknowledge that your personal data will be transferred to, stored, and processed in the United Kingdom, where our secure servers and physical facilities are located. We ensure that international data transfers meet strict global security requirements.

​

5. DATA SECURITY AND STORAGE

We have implemented robust technical and organisational security measures designed to protect your personal and health records:

• Electronic Records: All digital notes, emails, and intake forms are stored using fully encrypted, password-protected, and GDPR-compliant platforms. Access is strictly limited to authorised personnel involved in your care.

• Online Therapy: Virtual video sessions are conducted entirely through secure, encrypted platforms designed to protect client privacy.

• Risk Acknowledgment: While we do our absolute best to protect your data, no electronic transmission over the internet can be guaranteed as 100% secure. Transmitting personal information to our website or via email is done at your own risk, and we advise accessing our Services from secure network environments.

​​

6. HOW LONG DO WE KEEP YOUR INFORMATION?

We only keep your personal data for as long as necessary to satisfy the purposes outlined in this notice, as well as our legal, financial, and professional insurance requirements.

​

In line with standard UK therapeutic regulations and insurance policies, clinical notes and client records are securely retained for 7 years after your therapy ends (or, in the case of minors, 7 years after they turn 18). Once this retention period passes, all digital records are permanently deleted and any physical papers are securely shredded.

​

7. YOUR PRIVACY RIGHTS

Depending on where you live (including the UK, EEA, Switzerland, Canada, and other international regions), you have specific rights regarding your personal data under applicable data protection laws. These include your right to:

• Access: Request a copy of the personal data and clinical notes we hold about you (a Subject Access Request).

• Rectification: Request that we correct any inaccurate or incomplete personal information.

• Erasure ("Right to be Forgotten"): Request that we delete your data (subject to our legal and insurance requirements to retain medical records for 7 years).

• Restriction: Request that we limit how we process your data under certain conditions.

• Withdraw Consent: If we rely on your explicit consent to hold certain information, you can withdraw it at any time by contacting us directly.

• ​

To exercise any of these rights, please email us at contact@tuluatherapy.com.

​

Right to Complain
If you are located in the UK and believe we are handling your data unlawfully, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) via their website (www.ico.org.uk). If you are located internationally, you may contact your local country or state data protection authority.

​

8. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to remain compliant with changing global laws and professional guidelines. The updated version will be indicated by the "Last updated" date at the top of this document. We encourage you to review this policy periodically.

​

9. HOW CAN YOU CONTACT US?
If you have questions, comments, or formal data requests regarding this policy, please contact us by email or post:

Email: contact@tuluatherapy.com

Postal Address:

Tulua Therapy

102 Cranbrook Road

Ilford, London

IG1 4NH

United Kingdom