Privacy policy

Birkdale Hypnotherapy

Last updated: August 2026

At Birkdale Hypnotherapy, your privacy, confidentiality and the security of your personal information are taken seriously.

This Privacy Policy explains what information I collect, why I collect it, how it is used and stored, how long it is retained, when it may be shared and your rights under current UK data protection legislation.

This policy reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and amendments introduced by the Data (Use and Access) Act 2025, including provisions which came fully into force during 2026.

Who I am

I am Catherine Eland, Clinical Solution Focused Hypnotherapist and owner of Birkdale Hypnotherapy.

For the purposes of UK data protection legislation, I am the Data Controller for personal information processed within my practice.

Practice: Birkdale Hypnotherapy
Practitioner: Catherine Eland
Email: catherineeland@sfta.co.uk
Telephone: 07825 047849
Website: www.birkdalehypnotherapy.co.uk

I am a member of the National Council for Hypnotherapy (NCH) and practise in accordance with its professional and ethical requirements.

What information I collect

When you contact me or become a client, I may collect and process information including:

  • your name, address and contact details;
  • your date of birth;
  • appointment information;
  • information provided during your initial consultation;
  • your reason for seeking hypnotherapy;
  • relevant personal and family circumstances;
  • relevant medical history;
  • medication where relevant;
  • information concerning your physical or mental health;
  • previous therapy or treatment;
  • lifestyle information where clinically relevant;
  • brief clinical and session notes;
  • information concerning your progress;
  • GP details where appropriate;
  • emergency contact information;
  • communications between us;
  • payment and transaction information.

I aim to collect only information that is relevant and reasonably necessary to provide safe and appropriate hypnotherapy and meet my professional responsibilities.

Lawful basis for processing your information

UK data protection law requires me to have an appropriate lawful basis for processing your personal information.

Where information is necessary to arrange and provide the hypnotherapy services you have requested, I will normally rely upon:

Article 6(1)(b) – Contract

This allows me to process personal information where this is necessary to take steps at your request before entering into a therapeutic agreement and to provide the hypnotherapy services you have agreed to receive.

There may be circumstances in which another lawful basis applies, including compliance with a legal obligation or legitimate interests relating to the appropriate administration, protection and operation of my practice.

Health information and special category data

During your initial consultation and therapy, you may provide information concerning your physical or mental health, medical history, medication and other sensitive matters.

Health information is classed as special category personal data under UK GDPR and receives additional protection.

For the routine processing of relevant health and other special category information for the purposes of providing your hypnotherapy, I will normally rely upon:

Article 9(2)(a) – Explicit Consent

You will be asked to provide explicit consent to the processing of relevant health and other special category information as part of the initial consultation and consent process.

You may withdraw consent to future processing that relies upon your consent at any time.

Withdrawal does not affect processing which was lawful before consent was withdrawn.

If you withdraw consent to processing information that is necessary for me to provide hypnotherapy safely and appropriately, I may no longer be able to continue providing therapy.

There may be limited circumstances where another legal condition permits or requires the processing of special category information, including certain safeguarding situations or the establishment, exercise or defence of legal claims.

Why I use your information

Your information may be used to:

  • respond to your enquiry;
  • arrange and manage appointments;
  • assess whether hypnotherapy is appropriate;
  • provide hypnotherapy;
  • maintain appropriate clinical records;
  • monitor your progress;
  • communicate with you about your appointments or therapy;
  • provide appropriate therapeutic resources;
  • process payments;
  • maintain appropriate financial records;
  • meet professional and insurance requirements;
  • fulfil safeguarding responsibilities;
  • comply with legal obligations;
  • establish, exercise or defend legal claims where necessary.

Your information will not be used for an unrelated purpose without an appropriate lawful basis.

Clinical records

I maintain appropriate records of my clinical work in accordance with my professional responsibilities.

These may include:

  • personal and contact information;
  • relevant case history;
  • consent to therapy;
  • relevant medical and health information;
  • the reason for seeking hypnotherapy;
  • treatment plans where appropriate;
  • brief session records;
  • relevant advice provided;
  • relevant correspondence.

Clinical records are intended to be accurate, relevant and proportionate.

I follow the principle of data minimisation. This means that I do not aim to create a detailed account of everything discussed during therapy. I record information that is reasonably necessary to maintain an appropriate professional and clinical record.

How long I keep your clinical records

My record-retention arrangements follow the current requirements of the National Council for Hypnotherapy and take account of my professional and insurance responsibilities.

Adult clients

Clinical records will normally be retained securely for 8 years following the last interaction with the client.

Children under 16 when last seen

Records will normally be retained until the client reaches 25 years of age.

Clients aged 17 when last seen

Records will normally be retained until the client reaches 26 years of age.

Different retention periods may apply where required by law, my insurance provider or another applicable professional requirement.

Financial and accounting information may also be retained for the period required by applicable tax and financial legislation.

At the end of the appropriate retention period, information will be securely destroyed or deleted unless there is a legitimate reason for retaining it for longer.

Security and storage of clinical records

I take reasonable and proportionate measures to protect personal and clinical information from accidental loss, unauthorised access, disclosure, alteration or destruction.

These measures may include:

  • password-protected devices;
  • appropriate access controls;
  • automatic device locking;
  • secure electronic storage;
  • encryption where appropriate;
  • software and security updates;
  • secure backups;
  • secure storage of paper records;
  • limiting access to client information;
  • secure destruction and deletion of records.

I am responsible for ensuring that clinical records remain protected throughout the required retention period.

Appropriate arrangements are also maintained for the future protection of clinical records should I retire, cease practising, become incapacitated or die.

Confidentiality

Information discussed during therapy will normally remain confidential.

However, confidentiality is not absolute.

Information may need to be shared where:

  • you have given permission;
  • disclosure is required by law;
  • there is an appropriate safeguarding concern;
  • a child or vulnerable person may be at risk;
  • there is a serious risk of harm;
  • disclosure is necessary for the establishment, exercise or defence of legal claims;
  • another lawful basis permits or requires disclosure.

Where disclosure is necessary, I will aim to disclose only information that is relevant and proportionate to the situation.

Where it is appropriate and safe to do so, I will normally discuss this with you.

Safeguarding and child protection

I have professional responsibilities concerning safeguarding and child protection.

Where information gives rise to a safeguarding concern, information may need to be shared with an appropriate safeguarding organisation, local authority, police, healthcare professional or other appropriate body.

Where a statutory reporting duty applies, I will comply with that duty.

I will not promise absolute confidentiality where information indicates that safeguarding action or disclosure may be necessary.

Professional supervision

Professional supervision forms an important part of safe and ethical clinical practice.

My clinical work may therefore be discussed with my professional supervisor.

Wherever reasonably possible, identifying information is removed or minimised. Only information reasonably necessary for effective professional supervision will be discussed.

GP and other healthcare professionals

There may be circumstances where communication with your GP or another healthcare professional is appropriate.

Where possible, I will seek your permission before contacting another healthcare professional.

There may be exceptional circumstances where information needs to be shared without consent, for example where required by law or where there is an appropriate safeguarding or serious safety concern.

Email, telephone and messaging

I may communicate with you by telephone, email, text message or another agreed communication method.

I aim to minimise sensitive clinical information contained in routine electronic communications.

Electronic communication carries some degree of privacy and security risk. You should therefore avoid sending unnecessary sensitive information through email or messaging services.

Online hypnotherapy

Where therapy is provided online, I may use an appropriate video-conferencing platform.

Online therapy sessions are not routinely recorded.

If there were a genuine reason for recording a session, this would be discussed with you in advance, including the purpose of the recording, how it would be stored, who would have access and when it would be deleted.

Hypnotherapy recordings

As part of your therapy, I may provide hypnosis, relaxation or other therapeutic audio recordings.

General recordings which do not contain identifiable information about you are not normally part of your clinical record.

Where a recording is individually created and contains identifiable personal information, it will be treated appropriately as personal information.

Payments

Payment information will be processed only where necessary to administer appointments, receive payment and maintain appropriate financial records.

Where payment is made through a bank or external payment provider, that organisation will process information in accordance with its own data protection responsibilities.

I do not routinely retain full credit or debit card information.

Third-party service providers

I may use reputable third-party organisations and technology providers to support the operation of my practice.

These may include providers of:

  • email;
  • appointment booking;
  • payment processing with Sum Up
  • video conferencing with Zoom
  • website hosting;
  • secure electronic or cloud storage;
  • accounting;
  • IT services.

Where another organisation processes personal information on my behalf, I take reasonable steps to ensure that appropriate data protection arrangements are in place.

International data transfers

Some technology providers may process or store information outside the United Kingdom.

Where personal information is transferred internationally, I will take reasonable steps to ensure that the transfer complies with current UK data protection legislation and that appropriate safeguards or recognised arrangements are in place.

Artificial intelligence

Artificial intelligence and automated systems create additional considerations concerning confidentiality and data protection.

I do not routinely enter identifiable clinical records or identifiable sensitive client information into general-purpose artificial intelligence systems.

Where AI, transcription or another automated service would process identifiable personal or clinical information, I will consider the purpose, necessity, lawful basis, security, confidentiality and data protection implications before using that service.

Removing a client’s name alone does not necessarily make information anonymous if other information could reasonably identify them.

Marketing and supportive updates

Receiving hypnotherapy does not automatically mean that you will be added to a marketing list.

Where you are offered the option of receiving supportive updates, newsletters or other communications, this will be dealt with separately from your consent to therapy.

Where marketing relies upon consent, you can withdraw that consent at any time.

Marketing communications will provide an appropriate way to unsubscribe.

Withdrawing from marketing communications will not affect essential communications relating to your therapy or appointments.

Testimonials

Client testimonials, photographs or stories will not be published simply because somebody has received hypnotherapy.

Written consent will be obtained for the use of a client testimonial and additional consent will be obtained where the client’s name is to be disclosed.

Particular care will be taken where a testimonial reveals information about a person’s health or treatment.

Website enquiries

If you submit an enquiry through the Birkdale Hypnotherapy website, the information you provide will be used to respond to your enquiry and, where appropriate, arrange an appointment.

Making an enquiry does not automatically add you to a marketing list.

Information from enquiries which do not result in a therapeutic relationship will not be retained indefinitely without an appropriate reason.

Website and cookies

The Birkdale Hypnotherapy website may use cookies and similar technologies to provide functionality, maintain security and understand how visitors use the website.

Where consent is required for cookies or similar technologies, an appropriate consent mechanism will be provided.

Changes introduced by the Data (Use and Access) Act 2025 allow certain limited uses of cookies and similar technologies without consent. Appropriate information about their use will nevertheless be provided.

Data breaches

A personal data breach can include loss, accidental disclosure, unauthorised access or information being sent to the wrong person.

If a personal data breach occurs, I will:

  • take appropriate steps to contain it;
  • establish what information is affected;
  • assess the potential risk to the individual or individuals concerned;
  • document the incident and the action taken;
  • determine whether the Information Commissioner’s Office needs to be notified;
  • notify affected individuals where legally required.

Where notification to the ICO is required, this will be done within the legally required timescale.

Your data protection rights

Depending upon the circumstances, you may have rights including:

  • the right to be informed about how your information is used;
  • the right to access personal information held about you;
  • the right to have inaccurate information corrected;
  • the right to request erasure in certain circumstances;
  • the right to restrict processing in certain circumstances;
  • the right to object to certain processing;
  • the right to data portability where applicable;
  • rights relating to certain forms of automated decision-making.

Not every right applies in every circumstance.

If you wish to exercise a data protection right, please contact me.

Accessing your information – Subject Access Requests

You have the right to ask for access to personal information I hold about you. This is commonly known as a Subject Access Request (SAR).

A request can be made verbally or in writing.

In accordance with current UK data protection legislation, I will undertake a reasonable and proportionate search for information covered by your request.

I may request information where reasonably necessary to confirm your identity.

Where clarification is reasonably necessary to identify the information you are requesting, I may ask you to clarify your request. Where permitted under current legislation, the response period may be paused while clarification is awaited.

Requests will normally be dealt with without undue delay and within one month, subject to the provisions and permitted extensions contained within data protection legislation.

Information concerning another individual may need to be redacted or withheld where appropriate.

Data protection complaints – updated 2026

If you are unhappy with the way Birkdale Hypnotherapy has collected, used, stored, disclosed or otherwise handled your personal information, you have the right to make a data protection complaint.

Please contact:

Catherine Eland
Birkdale Hypnotherapy
Email: catherineeland@sfta.co.uk
Telephone: 07825 047849

Please provide sufficient information for me to understand and investigate your concern.

In accordance with current data protection requirements, I will:

  • provide an appropriate way for you to make a complaint;
  • acknowledge receipt of your complaint within 30 days;
  • take appropriate steps to investigate it without undue delay;
  • keep you appropriately informed about its progress;
  • inform you of the outcome without undue delay.

If you remain dissatisfied, you have the right to raise your concern with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.

Changes to this Privacy Policy

This Privacy Policy will be reviewed periodically and when there is a significant change to:

  • data protection legislation;
  • professional requirements;
  • the technology used within my practice;
  • the way personal information is processed;
  • the services provided by Birkdale Hypnotherapy.

The current version will be available through the Birkdale Hypnotherapy website.

Last reviewed: August 2026