General Data Protection Regulation (GDPR)
We are a Data Controller of your information.
- Our needs to perform a contract with you
- You have given us permission to do so
- Processing your personal information is in our legitimate interests
- We need to comply with the law
Personal data that we process shall not be kept for longer than is necessary. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies.
If you are a resident of the European Economic Area (EEA), you have certain data protection rights. If you wish to be informed what Personal Information we hold about you and if you want it to be removed from our systems, please contact us by email.
In certain circumstances, you have the following data protection rights :
- The right to access, update or to delete the information we have on you.
- The right of rectification.
- The right to object.
- The right of restriction.
- The right to data portability
- The right to withdraw consent
When you contact us via our website Contact form, we will collect your name and email address. By using the Contact Form you consent to us using this information for correspondence purposes, notably to discuss your interest in Hypnotherapy treatment and to book an appointment. To have your email deleted from our records, please contact us by email.
Blog Subscription Service
When you sign up to our Blog Subscription service, we will collect your email address. By using the Blog Suscription service you consent to us using this information in order to send you by email our Blog Posts as and when they are published. To unsubscribe and have your email deleted from this service, either click “Unsubscribe” at the bottom of a Blog Post email, or contact us by email.
Subject to your prior consent, we may publish information you provide about treatment you received from us as a Testimonial on our website. Such information may be available, via the internet, around the world. We cannot prevent the use (or misuse) of such information by others. To have your testimonial deleted from our website please contact us by email.
Like any other website, our website uses ‘cookies’. These cookies are used to store information including visitors’ preferences, and the pages on the website that the visitor accessed or visited. The information is used to optimize the users’ experience by customizing our web page content based on visitors’ browser type and/or other information.
You can choose to disable cookies through your individual browser options. More information on how to do this can be found by visiting the following links :
- https://support.google.com/chrome/answer/95647?hl=en (Chrome);
- https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);
- http://www.opera.com/help/tutorials/security/cookies/ (Opera);
- https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer);
- https://support.apple.com/kb/PH21411 (Safari); and
- https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).
Note that if you block cookies, some features of our website may not be available to you.
Links to other sites
Our website follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and a part of hosting services’ analytics. The information collected by log files include internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable. The purpose of the information is for analyzing trends, administering the site, tracking users’ movement on the website, and gathering demographic information.
We do not knowingly collect any Personal Identifiable Information from children under the age of 18. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.
What is the GDPR (General Data Protection Regulations, 2018) and how does it affect me?
The GDPR replaces the 1998 Data Protection Act to ensure that your personal and sensitive, confidential data is kept private and held securely, being processed in the way that we have agreed. It is there to protect your rights as a consumer of a service that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we might exchange. You can find more information in the documents I gave you at our initial consultation.
How long will you hold my information for?
I adhere to the standards of the CNHC, an organisation that stipulates I must hold your data for 8 years after your final session, unless you are a child, in which case I must hold your data until your 25th birthday, or unless you are 17 when treatment ends and then I must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.
What if I don’t want my records to be held for that long?
Under the GDPR you can make a request in writing to me, for all your records to be deleted. In this case all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. I would have to save the request for deletion that you made but would not save any other data.
Why do you need to record this information?
I collect information about: why you are using the service, a small amount of medical information and a small amount of information about your lifestyle and significant others, (family, friends etc.) alongside brief session notes. This information enables me to provide a high quality service to you, ensuring I am equipped with the knowledge of our previous discussions prior to each session. Your contact details / address and doctor’s details will only be used with your explicit consent or under extreme circumstances threatening your safety or the safety of others. See Terms and Conditions form (supplied at time of consultation).
What provision is made to ensure my information is held securely?
Hardcopy documents – Are all stored in a locked cabinet.
Text messages – My mobile phone is secured with a pin code.
Emails – My email account requires a user name and password.
Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.
Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.
Is what we discuss kept confidential?
Everything we talk about during our sessions is strictly confidential between you and me. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor*. During these discussions I do not disclose any details that may identify you to my supervisor, and my supervisor also adheres to the GDPR.
*supervisors are specially trained hypnotherapists with whom therapists can discuss client issues – disclosing no names or information that would identify a client.
What if I see you outside of the session?
To ensure your confidentiality, if we see each other socially, or outside of our sessions I will not engage in any conversation regarding your therapy. You are welcome to talk with other people about the therapy you are receiving, but I am obligated by GDPR law to ensure that your confidentiality is protected.
What happens to my information if anything happens to you, the therapist, so you cannot continue with my treatment?
In the event of the therapist being incapable of continuing with your treatment, e.g. because of illness or death, you will be contacted by a trusted person who will also respect rules of confidentiality. You will then be given the option of being put in touch with another therapist for continuation of your sessions.
What happens if you, the therapist, are temporarily incapacitated so you cannot keep an appointment?
If possible, I will contact you myself, otherwise a trusted relative (spouse) will inform you.
What about passing on information to other Health and Social Care Professionals?
As I adhere to the GDPR, any contact, relating to you, with other health care professionals would only be made with your signed consent, e.g. If I were to write to your GP to notify them of your treatment with me, and to notify them of the treatment ending. This would only happen if it seemed that it would be particularly beneficial to you or if I need verification that Hypnotherapy is suitable for you. I would only do this if you were to sign the specific consent for this at the time, if such a decision is made.
In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. I would always aim to discuss this with you prior to contacting anyone.
If I was issued with a police warrant or court order for information about you, by law I would also have to provide them with the information.