Sam Harrison Hypnotherapy
Privacy

Privacy policy

1. Introduction

At Sam Harrison Hypnotherapy, I am committed to protecting your privacy and handling your personal data with the utmost transparency and security. This policy outlines how I collect, use, and store your information in compliance with the UK GDPR and the Data (Use and Access) Act 2025 (DUAA 2025).

2. Controller Contact Details

I am the Data Controller for this practice.

3. Data Collected

I collect and process the following information to provide safe and effective hypnotherapy:

  • Identity Data: Name, date of birth, gender.
  • Contact Data: Phone number, email address, home address.
  • Special Category (Health) Data: Medical history, lifestyle details, session notes, and psychological history.
  • Emergency Contact: Name and phone number of your GP or a next of kin.

3a. Enquiries and Initial Contact

If you contact me to enquire about my services, I may collect personal information that you choose to provide, such as your name, email address, telephone number and any information you include within your enquiry.

You may contact me through a number of methods, including:

  • the contact form on my website;
  • email;
  • telephone call or text message; or
  • social media messaging.

I use this information solely to respond to your enquiry, arrange an introductory call or appointment where requested, and communicate with you about the hypnotherapy services you have enquired about.

Information submitted through the contact form on my website is not stored on the website. It is transmitted to me by email using ImprovMX, an email forwarding service. ImprovMX processes the information as necessary to deliver the message to my email account and may retain limited delivery logs for security and troubleshooting purposes.

If you contact me through a social media platform, your message and associated account information may also be processed and stored by that platform in accordance with its own privacy policy.

If you contact me by telephone or text message, your telephone number and any messages exchanged may be stored on my password or biometrically protected business device.

The lawful basis for processing enquiries is Article 6(1)(b) UK GDPR (Contract) where you have contacted me to take steps before potentially entering into a contract for hypnotherapy services. Where this basis does not apply, I may rely on Article 6(1)(f) UK GDPR (Legitimate Interests) for the legitimate purpose of responding to genuine enquiries about my services.

Information provided as part of an initial enquiry will not be used for marketing purposes unless you have separately consented to receive marketing communications.

4. Working with Children and Young People

  • Parental or guardian consent is required before therapy begins.
  • Confidentiality is respected, however parents or guardians will be informed if there are safeguarding concerns.
  • Information may be shared without consent if there is a risk of harm to the client or others, as required by law.

5. Online Sessions

  • If you request an online appointment, sessions are delivered using Microsoft Teams.
  • Microsoft Teams is a secure platform that uses encryption to help protect privacy during online sessions.
  • Online sessions with minors will only take place with parental consent and in line with safeguarding guidelines.

6. Purpose & Lawful Basis for Processing

In accordance with the law, I process your data under the following legal bases:

  • Contract: To provide the hypnotherapy services you have requested.
  • Consent: For specific marketing or communication preferences you have opted into.
  • Health Care Exemption: (Article 9 UK GDPR) For the provision of health or social care or treatment.
  • Recognised Legitimate Interest (Safeguarding): As updated by DUAA 2025, I may process data without explicit consent where it is necessary for safeguarding an individual at risk or protecting your vital interests.

7. Data Sharing

Your data is strictly confidential. It is never sold or shared for marketing purposes. It is only shared under the following conditions:

  • Supervision: I may discuss your case with a professional supervisor. In these instances, all data is fully anonymised.
  • Legal/Safety Obligations: If I believe there is a risk of serious harm to yourself or others, or if I am legally compelled by a court of law.
  • Integrated Digital Services: Using verified, secure platforms for appointment booking or telehealth as permitted under DUAA 2025 standards.

8. Data Retention

I retain your records for a period of 7 to 8 years following your final session (or until age 25 if the client was a minor).

Deletion: After this period, digital files are permanently deleted using secure wiping software, and physical files are destroyed via cross-cut shredding.

9. Security Measures

I employ robust technical and organisational measures to ensure your data remains private:

  • Physical: Paper records and consultation forms are kept in locked filing cabinets / drawers.
  • Digital: All emails are encrypted. Mobile devices and tablets used for scheduling are secured with biometric locks (FaceID/Fingerprint) and high-strength passwords.
  • Storage: Digital session notes are stored on encrypted, cloud-based platforms that meet UK data protection standards.

10. Your Data Subject Rights

Under the UK GDPR and DUAA 2025, you have the following rights:

  • Right of Access: You can request a copy of the data I hold about you.
  • Right to Rectification: You can ask me to correct inaccurate information.
  • Right to Erasure: Also known as the "Right to be Forgotten" (subject to legal retention requirements).
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

11. Complaints Process

If you have concerns about how I handle your data, please contact me directly so we can resolve the matter.

In line with the 2025 DUA amendments, which aim to streamline the complaints process, you have the right to lodge a formal complaint with the Information Commissioner's Office (ICO) if you remain unsatisfied.

ICO Website: ico.org.uk

Last updated: 12 August 2026