Privacy policy

Who we are

Today Hypnotherapy is a trading name of Diane Gough, a hypnotherapist based in Stafford. In this policy, “I”, “me”, “we” and “us” mean Today Hypnotherapy. I am the data controller for the personal information described here, which means I decide how and why it is used.

• Address: 38 Westhead Avenue, Stafford, Staffordshire, ST16 3RP
• Email: [email protected]
• Phone: 07938 409468

I take your privacy seriously and handle your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

What information I collect

When you get in touch

If you use the contact form, email, phone or text me, I collect the details you give me. This is usually your name, email address, phone number and your message.

Please don’t include detailed medical or health information in the website form. We can talk about that privately.

If you become a client

To provide hypnotherapy safely, I keep client records. These may include your contact details, your GP’s details where relevant, notes from our sessions, and information about your health, wellbeing and goals that you choose to share with me. Health information is “special category” data under UK GDPR and is given extra protection.

When you visit the website

The website does not use analytics, advertising or tracking cookies. Like all websites, the services that host and deliver it process technical information such as your IP address and browser type so the pages can be sent to you securely. See cookies and third-party services below.

How and why I use your information

• To reply to enquiries and arrange appointments. Lawful basis: my legitimate interests in responding to people who contact me, and taking steps at your request before entering into an agreement.
• To provide hypnotherapy sessions. Lawful basis: performance of our agreement. For health information, I rely on your explicit consent, which I will ask for before we begin.
• To keep accounts and meet legal obligations. Lawful basis: legal obligation (for example, HMRC record keeping).
• To keep the website and contact form secure, including preventing spam. Lawful basis: legitimate interests.

I will never sell your information or use it for marketing without your permission.

Confidentiality

Everything you share in sessions is treated as confidential. The only exceptions are where I am required to share information by law, or where I believe you or someone else is at serious risk of harm. Wherever possible I would talk to you first. I may discuss my work in professional supervision, but never in a way that identifies you.

Who I share information with

I only share personal information where it is needed, and only with organisations that are required to keep it secure:

• DACCAA Ltd, who build and maintain this website. Messages sent through the contact form are processed by DACCAA Ltd using Spannr, their web forms service, and delivered to me by email. DACCAA Ltd acts as a data processor on my behalf and only uses form submissions to deliver them to me. DACCAA Ltd is registered in England and Wales (company number 14639674), 11 Othello Close, Stafford, ST17 9ZN.
• Cloudflare, which hosts the website and delivers some of its code libraries.
• Google, which provides reCAPTCHA (spam protection on the contact form) and the website fonts.
• My email, phone and secure storage providers, and my accountant where needed for financial records.
• Authorities or professionals, only where the law requires it or to protect someone from serious harm.

International transfers

Some of the providers above, such as Google and Cloudflare, may process data outside the UK, including in the United States. Where this happens, the transfer is protected by appropriate safeguards such as the UK–US Data Bridge or the International Data Transfer Agreement.

How long I keep information

• Enquiries that do not lead to sessions: up to 12 months, then deleted.
• Client records: 7 years after our last session, in line with professional guidance, then securely destroyed.
• Financial records: 6 years, as required by HMRC.

Your rights

You have the right to:

• ask for a copy of the information I hold about you
• ask me to correct information that is wrong or incomplete
• ask me to delete your information, where I am not legally required to keep it
• ask me to restrict or stop using your information, or object to how I use it
• ask for your information in a portable format
• withdraw your consent at any time, where I rely on consent

To use any of these rights, contact me using the details above. I will respond within one month, and there is usually no charge.

If you are unhappy with how I have handled your information, please tell me so I can put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy

I may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.