Privacy Policy
Last updated: 21 August 2026
Your privacy matters to me. This Privacy Policy explains what personal information I collect through Dragonfly Therapist, why I collect it, how it is used and stored, who may process it on my behalf, and the rights you have in relation to your information.
For the purposes of UK data-protection law, Vanessa Vile is the data controller for personal information collected through Dragonfly Therapist.
If you have any questions about this policy or the way your information is handled, please contact:
What information I may collect
The information I collect depends on how you interact with me and which service you use.
This may include:
your name, date of birth, email address, telephone number and home address;
booking and appointment information;
emergency-contact and GP details where relevant;
correspondence between us;
information about the reason you are seeking support;
information generated during our work together, including appropriate client or session notes;
payment and transaction information;
accessibility or communication needs;
dietary, allergy or relevant wellbeing information where required for retreat attendance;
information needed to prepare a Soul Plan Reading or other specialist service;
newsletter and marketing preferences; and
technical website information such as IP address, browser information and cookie or analytics data.
For psychotherapy, counselling, hypnotherapy and Threshold work, I may also need to collect information about your physical health, mental health, medication, diagnoses, treatment history, current professional support and current wellbeing.
For silent-retreat suitability, I may ask for limited health or wellbeing information where this is reasonably necessary to assess whether the retreat is appropriate and can be attended safely.
Health and mental-health information is classed as special-category personal data under UK GDPR and receives additional legal protection.
I only collect information that is reasonably necessary for the service being provided, for assessing suitability and safety where relevant, or for meeting my professional, ethical, administrative and legal responsibilities.
How I collect your information
I usually collect information directly from you when you:
contact me through my website or by email;
complete a contact or enquiry form;
book an appointment through Acuity Scheduling;
complete a client intake or returning-client check-in;
agree to client terms;
attend a session or retreat;
book a Soul Plan Reading, Going Beyond the Veil session or other spiritual or intuitive service;
make a payment;
subscribe to a newsletter or other communication; or
otherwise communicate with me about my services.
Information may also be created during our work together, for example through appropriate client or session notes.
Where a recording forms part of a particular service, such as Going Beyond the Veil, this will be explained to you as part of that service.
Why I process your information and my lawful bases
Under UK data-protection law, I must have a lawful basis for processing personal information.
Where I process special-category data, such as health or mental-health information, I must also have an additional condition under Article 9 UK GDPR.
The basis I rely upon depends on the purpose for which the information is being used.
Therapy and Threshold work
For psychotherapy, counselling, hypnotherapy and Threshold work, I may need personal and health-related information in order to assess suitability, understand anything relevant to your wellbeing, provide the service appropriately, maintain professional records and meet my ethical and professional responsibilities.
For ordinary personal information used in connection with these services, I may rely on:
Article 6(1)(b) UK GDPR — contract, where processing is necessary to take steps at your request or provide the service you have booked; and/or
Article 6(1)(f) UK GDPR — legitimate interests, where processing is necessary for the responsible operation of my private practice, including maintaining appropriate records, managing professional risk and establishing, exercising or defending legal rights.
Where I process health or mental-health information as part of therapeutic work, I rely on:
Article 9(2)(h) UK GDPR — health or social care, where processing is necessary for the provision of health care or treatment and is carried out in circumstances where a duty of confidentiality applies.
The corresponding UK-law condition is:
Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 — health or social care purposes.
I do not rely on consent as the Article 9 condition for health information that is genuinely necessary to assess suitability for or provide therapeutic work.
You will still be given clear information about how your personal information is used and may be asked to confirm that you have read this Privacy Policy.
Silent-retreat suitability
For The Stillpoint Within and other retreats, I may ask for limited health or wellbeing information where this is reasonably necessary to assess suitability and support the safety of the retreat.
This may include information relating to relevant physical or mental-health conditions, medication, current support, accessibility requirements or other circumstances that could affect your participation.
Because retreat suitability information is collected for safety and suitability rather than necessarily as part of health-care treatment, I do not automatically rely on Article 9(2)(h) for this processing.
Where I rely on Article 9(2)(a) UK GDPR — explicit consent for special-category retreat information, you will be asked to give that consent clearly and separately when the information is collected.
You may withdraw consent where consent is the basis for processing. However, if the information is genuinely necessary for me to assess whether you can safely attend a retreat, withdrawing consent may mean that I am unable to confirm or continue your participation.
Soul Plan Readings, Going Beyond the Veil and other spiritual or intuitive services
I do not routinely collect health or mental-health information for Soul Plan Readings, Going Beyond the Veil or other spiritual and intuitive services.
For these services, I generally process ordinary personal information necessary to:
arrange and administer your booking;
communicate with you;
provide the service you have requested;
process payment; and
maintain appropriate business records.
For this processing, I may rely on:
Article 6(1)(b) UK GDPR — contract, where the information is necessary to provide the service you have booked; and/or
Article 6(1)(f) UK GDPR — legitimate interests, where processing is necessary for the responsible administration and operation of my business.
If you voluntarily disclose health or other sensitive information during one of these services, I will only record or retain it where there is a genuine reason to do so.
Enquiries and administration
I use personal information to respond to enquiries, arrange appointments, issue confirmations, manage cancellations and rescheduling, process payments and maintain appropriate administrative records.
Depending on the circumstances, I may rely on:
Article 6(1)(b) — contract or steps taken at your request before entering a contract;
Article 6(1)(f) — legitimate interests; or
another lawful basis where appropriate.
Financial, professional and legal records
I may retain or process information where necessary to meet tax, accounting, insurance, legal or professional obligations.
Where processing is required to comply with a legal obligation, I may rely on:
Article 6(1)(c) UK GDPR — legal obligation.
Where information is retained in connection with managing professional risk or establishing, exercising or defending legal claims, I may rely on legitimate interests and any relevant special-category condition where applicable.
Marketing and newsletters
If you choose to subscribe to newsletters or marketing communications, I will use your contact information for that purpose.
Receiving marketing is optional and is not a condition of working with me.
Where consent is required, I rely on:
Article 6(1)(a) UK GDPR — consent.
You can unsubscribe at any time using the unsubscribe option within the communication or by contacting me directly.
Information collected through therapy, Threshold work, retreat participation or another client service will not automatically be added to a marketing list.
Who may process or receive your information
I treat client information as confidential.
However, some trusted service providers process personal information on my behalf so that I can operate my website, booking system and professional practice.
These may include:
Squarespace, which hosts my website;
Acuity Scheduling, which provides my appointment-booking system;
payment-processing providers;
email and communication providers;
secure cloud-storage providers;
video-conferencing or online-session platforms;
and professional, legal, accounting or technical providers where their involvement is genuinely necessary.
These organisations process information in accordance with their own legal and contractual data-protection obligations.
I may also discuss aspects of client work within appropriate professional supervision or consultation. Where this occurs, identifying information will be limited as far as reasonably possible.
I may disclose information without your consent where I am legally required to do so, or where a sufficiently serious safeguarding or safety concern justifies disclosure. Where it is safe and appropriate, I would normally aim to discuss this with you first.
I do not sell your personal information.
I do not disclose information to family members, employers or other professionals simply because they request it.
International transfers
Some of the technology providers I use may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, I use providers that put appropriate safeguards in place where required under UK data-protection law.
Further information about the international-transfer arrangements used by individual providers can be found in their own privacy and data-processing documentation.
Confidentiality
Information you share within therapeutic, Threshold and other private one-to-one work is treated confidentially.
There are limited circumstances in which confidentiality may need to be broken, including where:
there is a serious or immediate risk of harm;
a safeguarding concern arises;
disclosure is required by law; or
another overriding legal or professional obligation applies.
The specific limits of confidentiality applying to therapeutic and Threshold work are also explained within the relevant Client Agreement.
How long I keep your information
I only keep personal information for as long as it is reasonably necessary for the purpose for which it was collected, taking account of professional, legal, insurance and safeguarding considerations.
Therapy and Threshold records
Therapy and Threshold client records are generally retained for up to seven years after our work together ends, unless there is a professional, insurance, legal or safeguarding reason to retain them for a different period.
Retreat information
Retreat booking, health and suitability information is retained only for as long as reasonably necessary for the retreat, appropriate follow-up and any relevant legal, insurance or safeguarding requirements.
Spiritual and intuitive services
Soul Plan, Going Beyond the Veil and other spiritual or intuitive service records are retained only for as long as there is a reasonable administrative, professional or legal reason to keep them.
Enquiries
Enquiries that do not lead to work together are normally retained for a shorter period and deleted when there is no longer a reasonable need to keep them.
Financial records
Financial and transaction records are retained for the period required by relevant tax and accounting obligations.
Marketing
Marketing information is retained until you unsubscribe, withdraw consent or the information is no longer required.
Recordings
Where a recording forms part of an agreed service, it is retained only for as long as reasonably necessary to provide the recording or fulfil the agreed purpose, unless we have specifically agreed otherwise.
When information is no longer required, it is securely deleted or destroyed.
How I protect your information
I take reasonable technical and organisational measures to protect personal information from loss, unauthorised access, alteration or disclosure.
These measures may include:
password protection;
device encryption;
secure cloud-based systems;
appropriate access controls;
limiting access to personal information;
and collecting only the information reasonably necessary for the relevant purpose.
No method of electronic transmission or storage can be guaranteed to be completely secure, but I take reasonable steps to minimise the risks involved.
Cookies and website usage
This website is hosted through Squarespace and may use cookies and similar technologies.
Some cookies are necessary for the website to operate correctly.
Other cookies, including analytics or advertising-related technologies where enabled, are non-essential. Where consent is required, these should only be activated after you have made your choice through the website's cookie settings or consent banner.
Website analytics may include information such as:
pages visited;
browser or device type;
approximate location;
IP address; and
how visitors interact with the website.
This information may be used to understand how the website is used, monitor performance and improve functionality.
You can change your cookie choices using the website's cookie settings and through your browser.
Your data-protection rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
request access to the personal information I hold about you;
ask for inaccurate or incomplete information to be corrected;
request deletion of personal information in certain circumstances;
request restriction of processing in certain circumstances;
object to certain processing;
request data portability where that right applies;
withdraw consent where processing is based on consent; and
object to the use of your personal information for direct marketing.
These rights are not absolute in every situation.
For example, I may need to retain some client information where there is a lawful professional, insurance, safeguarding or legal reason to do so.
If you wish to exercise any of these rights, please contact:
I may need to verify your identity before providing, deleting or amending personal information.
Your right to object
Where I process personal information on the basis of legitimate interests, you may have the right to object to that processing.
If you object, I will consider your circumstances and whether there are compelling legitimate grounds for the processing to continue.
You can object to direct marketing at any time.
Automated decision-making
I do not use solely automated decision-making that produces legal or similarly significant effects on you.
Decisions about suitability for therapeutic work, Threshold work or retreat participation are made by me rather than by an automated system.
If you choose not to provide information
Some information is optional.
Other information may be necessary for me to assess suitability, provide a service safely, fulfil our agreement or meet my professional responsibilities.
If you choose not to provide information that is genuinely necessary for one of these purposes, I may be unable to provide or continue the relevant service.
Adults only
My therapeutic and Threshold services are intended for adults aged 18 and over.
I do not knowingly collect therapeutic information from children through my standard adult booking process.
Changes to this Privacy Policy
I may update this Privacy Policy from time to time to reflect changes to my services, systems, professional practice or legal requirements.
The current version will be published on my website with the date it was last updated.
Where a change would materially affect how existing client information is used, I will take reasonable steps to bring that change to the attention of those affected.
Questions or complaints
If you have questions or concerns about how your personal information has been handled, please contact me first so that I have an opportunity to respond.
Email: vanessa@dragonflytherapist.uk
You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.