If you run a therapy practice in the UK, whether that's counselling, psychotherapy, acupuncture, cosmetic treatments, nursing-based acupuncture, or anything else that involves keeping notes on clients, you're handling personal data. Some of it, like health information and treatment notes, counts as a special, more sensitive category under the law. This guide pulls together what the Information Commissioner's Office (ICO), the UK's data protection regulator, says businesses like yours need to do.