Privacy Notice

My name is Joanne Smith, and I am a Solution Focused Hypnotherapist practising under the business name Joanne E Smith Hypnotherapy. I am a member of the National Council for Hypnotherapy (NCH).

I am committed to protecting your privacy, respecting your confidentiality and handling your personal information responsibly, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, applicable data protection legislation and the NCH Code of Ethical Conduct and Performance.

I am the data controller responsible for the personal information I collect and use in connection with my hypnotherapy practice.

ICO registration number: C2046645

Contact details:

Email: jesmith1974@outlook.comTelephone: 07946 509002

You can contact me using these details if you have any questions about this Privacy Notice or how your information is handled.

I only collect personal information that is relevant and necessary for providing my services, managing my business and meeting my professional and legal responsibilities.

This may include:

• Personal details: Your name, date of birth, address, telephone number and email address.
• Health information: Relevant medical history, physical and mental health information, current symptoms, medication and other information you choose to share that may be relevant to your hypnotherapy.
• Consultation and therapy records: Information discussed during consultations and sessions, your goals, progress, feedback, assessments and session notes.
• Emergency contact information: Details of a nominated emergency contact, where appropriate.
• Payment and booking information: Appointment dates, payment records, invoices and cancellation information.
• Website and communication information: Information you provide through my website, email, telephone, online forms or other methods of communication.

Health information is classed as special category personal data under UK GDPR and receives additional protection. I will take particular care when collecting, using and storing this information.

You are not required to provide information that is not necessary for the service. However, if you choose not to provide information that is essential to assessing your suitability for hypnotherapy or providing a safe service, I may be unable to proceed with your sessions.

I use your personal information for the following purposes:

• To respond to enquiries and arrange initial consultations.
• To assess your needs and suitability for Solution Focused Hypnotherapy.
• To provide, manage and review your hypnotherapy sessions.
• To maintain accurate client records and monitor your progress.
• To communicate with you about appointments and changes to my services.
• To process payments and maintain financial records.
• To meet my professional, insurance and legal obligations.
• To respond to concerns, complaints or legal claims where necessary.
• To protect your safety or the safety of others where there is a legitimate and sufficient reason to do so.

I will not collect or use your information for purposes that are incompatible with those explained in this notice without informing you and establishing an appropriate lawful basis.

Under UK GDPR, I must have a lawful basis for processing personal information.

Depending on the purpose, I may rely on the following lawful bases:

• Contract: Where processing is necessary to provide the services you have requested or to take steps at your request before entering into an agreement.
• Legal obligation: Where I need to process information to comply with applicable legal requirements, such as certain financial and tax record-keeping obligations.
• Legitimate interests: Where processing is necessary for legitimate business purposes, such as managing enquiries, maintaining appropriate business records or dealing with legal claims, provided these interests do not override your rights and freedoms.
• Consent: Where you have given valid consent for a specific purpose and consent is the appropriate lawful basis.

Where I process your health information or other special category data, I must also meet an additional condition under Article 9 of UK GDPR. Where appropriate, this will be your explicit consent to the processing of relevant health information for the purpose of assessing and providing hypnotherapy.

I will explain the relevant information and obtain any required consent before processing your information for these purposes. Consent can be withdrawn at any time where consent is the basis relied upon, although this does not affect the lawfulness of processing carried out before withdrawal. I may still need to retain certain records where another lawful basis or legal or professional obligation applies.

Confidentiality is fundamental to the therapeutic relationship. I will treat information you share with me respectfully and keep it confidential, in accordance with applicable data protection legislation and the professional standards of the NCH.

I will not routinely share information about your sessions with family members, friends, employers or other third parties without your permission.

However, confidentiality is not absolute. Information may need to be disclosed where:

• You have given appropriate consent.
• Disclosure is required by law or a valid legal order.
• I have a serious and reasonable concern that you, another person or the public may be at risk of significant harm.
• Disclosure is otherwise necessary and lawful to meet a safeguarding or other legal obligation.

Where possible and appropriate, I will discuss a proposed disclosure with you before making it. Where doing so would be inappropriate or could increase risk, I may need to act without prior discussion.

I will only disclose information that is necessary and appropriate in the circumstances.

I take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, disclosure or destruction.

These measures may include:

• Keeping electronic records in password-protected accounts and secure systems.
• Restricting access to client records to those who are authorised to access them.
• Using appropriate security measures when communicating online.
• Keeping paper records, where used, in secure storage.
• Taking care when sending emails, messages and other communications.
• Retaining only the information necessary for legitimate purposes and disposing of it securely when it is no longer required.

No method of electronic transmission or storage is completely secure. Nevertheless, I take reasonable steps to protect your information and minimise the risks involved.

I provide hypnotherapy sessions online. To arrange and conduct sessions, I may use online meeting platforms, email, telephone and other communication services.

Where third-party platforms are used, some personal information may be processed by those providers in accordance with their own privacy policies and terms.

I will take reasonable steps to use suitable services and protect your confidentiality. You should also consider your own privacy when attending online sessions, including choosing a private location and using a secure internet connection where possible.

If a technical problem interrupts an online session, we will follow the arrangements agreed for dealing with the interruption and maintaining your safety.

I do not routinely record hypnotherapy sessions. If I ever propose to make a recording, I will explain why and obtain your informed agreement and any other consent required before doing so.

I do not sell or rent your personal information.

Where necessary and appropriate, I may share limited information with:

• My professional supervisor: Where appropriate for supervision and professional development, taking reasonable steps to protect your identity and confidentiality.
• Other healthcare professionals: Where sharing is necessary for your care and you have given appropriate consent, or where another lawful basis applies.
• Professional or regulatory bodies: Where disclosure is necessary to meet a legitimate professional, regulatory or legal obligation.
• My insurer or professional advisers: Where necessary to obtain advice, manage a claim or meet insurance requirements.
• Service providers: Such as secure email, online meeting, website hosting, booking, payment processing or record-keeping providers who help me operate my practice.
• Public authorities or emergency services: Where disclosure is required by law or is otherwise necessary and lawful to address a serious risk.

I will take reasonable steps to ensure that information is shared securely and only to the extent necessary. Where a service provider processes personal information on my behalf, I will take appropriate steps to ensure that suitable data protection arrangements are in place.

Some providers may process information outside the UK. Where this occurs, I will ensure that any required safeguards under applicable data protection law are in place.

I retain personal information only for as long as necessary for the purposes for which it was collected, taking account of legal requirements, professional guidance, insurance conditions and the nature of the information.

In accordance with NCH guidance on client record keeping, I generally intend to retain adult client records for eight years after the last interaction.

Different retention arrangements may apply to children and young people, financial records, complaints, legal claims or other documents where professional guidance or legal requirements specify a different period.

When information is no longer required, I will take appropriate steps to delete or securely destroy it.

Under UK GDPR, you have rights in relation to your personal information. Depending on the circumstances and applicable legal requirements, these may include:

• The right to be informed: To understand how your information is collected and used.
• The right of access: To request a copy of the personal information I hold about you.
• The right to rectification: To request correction of inaccurate or incomplete information.
• The right to erasure: To request deletion of your information where the legal conditions are met.
• The right to restrict processing: To request that I limit the use of your information in certain circumstances.
• The right to data portability: To request certain information in a commonly used electronic format where the legal conditions are met.
• The right to object: To object to certain types of processing, including processing based on legitimate interests.
• Rights relating to consent: To withdraw consent where consent is the basis for processing.

These rights are not absolute and may be subject to legal exemptions. For example, I may be required to retain certain clinical records to meet professional or legal obligations, even if you request their deletion.

To exercise any of your rights, please contact me using the details in Section 1. I may need to verify your identity before responding. I will respond within the timeframe required by data protection law.

I may use your contact details to communicate with you about appointments and the services you have requested.

I will not use your personal information to send direct marketing communications where consent or another applicable legal requirement has not been satisfied. You can opt out of marketing communications at any time.

I will not publish your name, photograph, testimonial or other identifiable information about your experience of hypnotherapy without obtaining your specific, informed permission and ensuring that the use complies with applicable data protection and professional requirements.

I will take particular care not to reveal a therapeutic relationship through social media posts, testimonials or other publicity.

My website may use cookies or similar technologies to make the website function, understand how visitors use it or support other website features.

Where required by law, I will obtain your consent before using non-essential cookies or similar technologies. You can manage cookies through the options made available on the website and through your browser settings.

If my website uses analytics, advertising tools or other third-party technologies, further details about the relevant providers and their use of information should be included in the website's cookie information.

If you have any concerns about how I handle your personal information, please contact me first using the details in Section 1. I will take your concerns seriously and aim to resolve them promptly and fairly.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: https://ico.org.uk/make-a-complaint/

You may also raise a concern through the National Council for Hypnotherapy's complaints procedure where it relates to my professional conduct or practice.

I may update this Privacy Notice from time to time to reflect changes in my practice, the services I provide, applicable legislation or professional guidance.

The latest version will be published on my website, with the date of the most recent update shown at the beginning.

If a significant change affects how I use your personal information, I will take appropriate steps to bring it to your attention.

If you have any questions about this Privacy Notice, the personal information I hold about you or your rights under data protection law, please contact:

Joanne SmithJoanne E Smith HypnotherapyEmail: jesmith1974@outlook.comTelephone: 07946 509002ICO registration number: C2046645