Privacy Policy & GDPR

This Privacy Notice explains how Emma Horton, trading as Emma Horton Hypnotherapy collects, uses, stores, and protects your personal data in accordance with the UK GDPR, the Data Protection Act 2018, and current guidance from the Information Commissioner’s Office (ICO).

 

1. Who We Are

Data Controller: Emma Horton, trading as Emma Horton Hypnotherapy

Business address: 39A Church Street, Weybridge, Surrey, KT13 8DG

Email: emma@emmahortonhypnotherapy.co.uk

Phone: 07798 876561

As a sole trader hypnotherapist, I am the data controller responsible for your personal data.

 

2. The Information I Collect

I may collect the following personal data:

• full name

• address

• telephone number

• email address

• date of birth

• emergency contact details

• GP details (where relevant)

• medical history

• mental and emotional wellbeing information

• presenting issues and therapy goals

• session notes and progress records

• appointment history

• payment and invoice records

• communications by email, phone, or text

For hypnotherapy services, this may include special category data, particularly information concerning your physical or mental health.

 

3. Why I Collect Your Information

Your information is collected to:

• assess whether hypnotherapy is suitable for you

• provide safe and effective treatment

• keep accurate clinical records

• monitor progress

• arrange appointments

• process payments

• comply with legal, insurance, and professional obligations

• manage complaints and data protection concerns

 

4. Lawful Basis for Processing

I process your personal data under:

Article 6 UK GDPR

• contract – to provide the therapy service you request

• legal obligation – tax, insurance, and record keeping

• legitimate interests – safe professional practice and administration

Article 9 UK GDPR (Special Category Data)

Because health and emotional wellbeing information is collected, I also rely on:

• explicit consent

• provision of health / therapeutic care, where applicable

Special category data is prohibited unless a valid Article 9 condition applies. 

 

5. Consent for Therapy Records

By engaging in hypnotherapy services, you consent to the recording and secure storage of therapy-related information necessary for your care.

This includes:

• health history

• therapeutic goals

• session notes

• progress observations

• relevant safeguarding concerns

You may withdraw consent for optional processing at any time, although this may affect my ability to continue treatment safely.

 

6. How Your Data Is Stored

Your data may be stored:

• in secure password-protected digital files

• encrypted cloud storage

• secure booking or practice management software

• password-protected phone and computer devices

• locked paper records, where used

I take appropriate technical and organisational steps to protect digital records from misuse, unauthorised access, accidental loss, or disclosure.

This is particularly important for therapy notes and health-related data.

 

7. Confidentiality and When Information May Be Shared

All therapy sessions are confidential.

Your information will not be shared without your consent unless I am legally or ethically required to do so, including where there is:

• risk of serious harm to yourself

• risk of harm to another person

• safeguarding concerns involving children or vulnerable adults

• legal requirement or court order

• professional supervision (where anonymised where possible)

If I work with a clinical supervisor, information shared for supervision purposes will be minimised and anonymised where possible.

 

8. How Long I Keep Records

Hypnotherapy client records and session notes are typically retained for 7 years after the final session.

For clients under 18, records may be kept until age 25.

Financial records are kept for 6 years for HMRC purposes.

Retention periods should also reflect insurer or professional body requirements.

 

9. Complaints About Misuse of Personal Data

If you have concerns about how your personal data has been collected, used, stored, or handled digitally, you have the right to make a complaint directly to me.

This includes concerns regarding:

• therapy notes

• health information

• email communications

• booking systems

• cloud-stored records

• accidental disclosure

• unauthorised access

Complaints should be submitted to:

emma@emmahortonhypnotherapy.co.uk

Please include:

• your full name

• details of the issue

• relevant dates

• information involved

• supporting evidence

I will acknowledge and investigate complaints promptly and respond in writing within 30 days.

This section is designed to align with the updated ICO complaints handling expectations. 

 

10. Data Breaches

If your personal data is lost, accessed improperly, or disclosed in error, please contact me immediately.

Where required by law, any reportable breach involving personal or health-related data will be notified to the ICO without undue delay.

 

11. Your Rights

You have the right to:

• request access to your records

• request correction

• request erasure, where lawful

• restrict processing

• object to processing

• withdraw consent

• complain to the ICO

 

12. ICO Complaint Rights

If you are unhappy with how I deal with your personal data, you may complain to the Information Commissioner’s Office (ICO).

The ICO normally expects you to contact me first.

​​

 

What if I would like my data to be destroyed before this date?

Under GDPR rules, you are able to request the deletion of any of your records at any  time.​

 

Are our discussions within the hypnotherapy sessions confidential?

Yes, unless I need support from my supervisor or I believe that you are about to harm yourself or another.

​

What if I see you outside of a hypnotherapy session?

If we see each other outside of a session I will smile but not initiate a conversation to ensure your confidentiality.  You are welcome to share with anyone about the therapy you are receiving but I am obligated by GDPR law to ensure your confidentiality is protected.  I would request that in order to ensure the success of your treatment, that you refrain from discussing your treatment with me outside of your sessions.

 

Will you discuss information about me with other health and social care professionals?

Only with your written consent.

 

I am fully insured; hold a current DBS certificate and I am registered with The National Council for Hypnotherapy and The Association for Solution Focused Hypnotherapy.  I abide by the codes of conduct of the AfSFH and the NCH.