Privacy Policy

To provide you with a professional service, I will hold your personal contact details and brief records of your sessions with me. This privacy notice explains how I handle your personal information and your rights under the General Data Protection Regulations and answers the most frequent questions. If you have any further queries, please do contact me.

What are your reasons for collecting this information?

The purpose for collecting your personal data is for the administration of the therapy service that I am providing to you, including to arrange, cancel and rearrange appointments.

How will my data be stored?
With the implementation of the General Data Protection Regulations (GDPR) in May 2018, replacing the Data Protection Act, the focus is on ensuring the secure and private storage of personal, confidential, and sometimes sensitive data. If I write notes in your session, these will be shredded immediately, with only your initial consultation notes and an appointment record stored securely on my laptop.

How long will you hold my information for?
I will only retain your personal information for as long as is necessary and in line with guidance from the Information Commissioner’s Office. I am registered with the NCH (National Council for Hypnotherapy) who specify that written client records should be securely stored for:

Adult clients: 8 years after the final session
Children under 16: Until they turn 25
17-year-old clients: Until they turn 26

What if I make an enquiry, but do not book any sessions?

When you contact me to book your initial consultation, I will collect information to help me to process your enquiry. This will include your name to book the appointment and your email address or phone number. This information is requested so that you could be informed if I was unable to attend an appointment due to unforeseen circumstances. If you make an enquiry and then decide not to proceed, I will ensure that your personal data is deleted within one month. If you would like me to delete this information sooner, please let me know.

What if I would like my data to be destroyed before this date?
Under GDPR rules, you have the right to request the deletion of any of your records at any time. I will then delete your records as soon as possible, and no more than one month after the date of your request.

Can I see or get a copy of the information you hold?
In accordance with GDPR, you have the right to access and obtain a copy of your information. I will respond within 30 days of receiving your request.

Are our discussions within the hypnotherapy sessions confidential?
Yes, I will maintain complete confidentiality unless there is a need for supervision support where you will remain anonymous, or if I believe there is information given that suggests you may harm yourself or others. Information will only be shared with other health and social care professionals with your written consent.

What if I see you outside of a hypnotherapy session?
If we were to meet up coincidently outside of our sessions together, I would say hello yet not stop for a conversation, unless you indicate that it suits you. If I am with someone else, you may notice that I only briefly acknowledge you to protect your privacy.

Third party recipients of personal data
I share a limited amount of personal data with third party’s applications to provide booking services using Acuity, and to fulfil my legal obligations in respect of tax and accounting purposes, using Xero accounting software. All data is held securely, and these apps are password protected with two-factor identification.

Data security
My email account is password protected, and my mobile phone and laptop used for running my business are password protected and have anti-virus software.

Website visitors
By accessing this website, you are consenting to the information collection and use practices described in this privacy notice. The website uses cookies and Google Analytics. Almost all websites use cookies which are small files that get put on your computer by websites as you surf them. These cookies can store information which can have privacy implications. Google Analytics gathers anonymous data on how people are using websites to provide visitor statistics and details of page views. You can opt out of Google analytics and other Google services here – http://tools.google.com/dlpage/gaoptout and https://www.google.com/dashboard/.

Your rights
Under GDPR 2018 guidelines you have the following rights: you can request access to the personal information that I store and process about you. You can ask for corrections to be made to the information held or for your personal information to be deleted. You can read more about your rights at ico.org.uk/your-data-matters. Please be aware that in certain situations, hypnotherapists may be unable to comply with the above requests. For example, if compelled to retain the records by a court of law. Please also be aware that there may be a charge for complying with a request if it is deemed to be excessive in nature.

Queries
‘Data controller’ is the term for the person or organisation that collects and stores and has responsibility for people’s personal information. I, Debra Penrice, am the data controller and I am registered with the Information Commissioner’s Office, registration number ZB852310. If you have any questions about this privacy policy or the way in which I handle your personal information you can contact me via phone on 07815 782696 or email at debra@storyhealing.net.

Complaints
If you have a complaint about how I handle your personal data, please get in touch by email at debra@storyhealing.net. If you want to make a formal complaint about processing your personal information you can contact the Information Commissioner’s Office (ICO), who oversees data protection law in the UK. For more information, go to ico.org.uk/make-a-complaint.