Privacy Policy

Privacy Policy (UK GDPR)

This Privacy Policy explains how your personal data is collected, used and protected in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

Inner Spark Hypnotherapy is the Data Controller responsible for your personal data.

Contact details:
Inner Spark Hypnotherapy
Telephone: 07721 784945
Email: info@innersparkhypnotherapy.co.uk

Inner Spark Hypnotherapy is registered with the Information Commissioner’s Office (ICO).

ICO registration number: ZA773301

2. What Personal Data I Collect

I may collect and process the following personal information:

  • Your name, address and contact details
  • Your date of birth
  • Your occupation and relevant personal circumstances
  • Health information, including relevant medical conditions and medication
  • Your GP’s details, where required for emergency purposes
  • Consultation information, session notes and therapeutic goals
  • Any other information you choose to share with me

I only collect information that is relevant and reasonably necessary to provide safe and effective hypnotherapy services.

3. Lawful Basis for Processing

I process your personal data under one or more of the following lawful bases:

  • Contract – where processing is necessary to provide the hypnotherapy services you have requested
  • Legitimate interests – where processing is necessary to run my practice safely, securely and effectively
  • Legal obligation – where processing is necessary to meet a legal, regulatory or safeguarding obligation

Information about your physical or mental health is considered special category personal data. Where I process health-related information for the provision of therapy, I rely on the health or social care condition under Article 9(2)(h) of the UK GDPR.

4. How Your Data Is Stored

Paper records

  • Paper records are kept securely in locked storage
  • These records may include consultation forms, agreements and session notes

Electronic records

  • Contact details and electronic records are stored on password-protected devices
  • Email correspondence is stored securely and deleted when it is no longer required

Security measures

I take appropriate steps to protect your personal data. These measures include:

  • Password-protected devices
  • Restricted access to personal information
  • Secure physical and electronic storage practices
  • Data minimisation, so that only necessary information is collected and retained

5. How Your Data Is Used

Your information may be used to:

  • Provide safe and effective hypnotherapy services
  • Contact you about appointments and therapy sessions
  • Respond to questions or enquiries about my services
  • Maintain accurate clinical and administrative records
  • Collect and record payments
  • Meet professional, insurance, safeguarding and legal obligations

You are not legally required to provide your personal information to me. However, I may be unable to provide therapy if I do not have the information needed to work with you safely and effectively.

6. Sharing Your Data

Your personal data will not normally be shared with another person or organisation without your consent.

Information may be shared without your consent in the following limited circumstances:

Professional supervision

  • Cases may be discussed anonymously for professional support, development or supervision
  • Information that could directly identify you will not normally be disclosed during supervision

Safeguarding and legal requirements

  • Where there is a serious risk of harm to you or another person
  • Where disclosure is necessary to meet a safeguarding responsibility
  • Where information must be provided by law, a court order or another lawful authority

Emergency situations

  • Relevant information may be shared with your GP, emergency services or another appropriate healthcare professional where this is necessary to protect your vital interests or those of another person

Where you are receiving therapy as part of a wider care arrangement or following a referral, agreed levels of information may be shared with the relevant parties. Where possible, this will be discussed and agreed with you beforehand.

7. Data Retention

Your records are normally retained for seven years after your therapy ends.

This retention period supports:

  • Professional standards
  • Insurance requirements
  • Legal and regulatory obligations

Once the applicable retention period has ended, paper records will be securely shredded and electronic records will be securely deleted.

Some information may need to be retained for longer where this is required by law, necessary in connection with a legal claim or required by an insurer or professional body.

8. Your Data Protection Rights

Depending on the circumstances, you have the right to:

  • Be informed about how your personal information is collected and used
  • Access the personal information held about you
  • Request correction of inaccurate or incomplete information
  • Request erasure of your personal information where the right applies
  • Restrict processing of your information in certain circumstances
  • Object to certain types of processing
  • Request data portability where the right applies
  • Withdraw consent where consent is being relied upon

Some of these rights are not absolute. A request may be limited or refused where information must be retained or processed to meet a legal, professional, insurance or safeguarding obligation. If this applies, I will explain the reason to you.

To exercise your rights, please email info@innersparkhypnotherapy.co.uk.

9. Consent and Communication

Where I rely on your consent for a particular form of communication, such as SMS appointment reminders, you may withdraw that consent at any time.

Withdrawing consent will not affect processing that has already taken place lawfully.

Withdrawal of consent may not apply where processing remains necessary for:

  • Providing the therapy services you have requested
  • Meeting legal, safeguarding, insurance or professional obligations
  • Establishing, exercising or defending legal claims

10. Personal Data Breaches

In the unlikely event of a personal data breach:

  • Immediate and appropriate steps will be taken to investigate and contain the breach
  • The circumstances, risks and actions taken will be recorded
  • You will be informed without undue delay where the breach is likely to result in a high risk to your rights and freedoms
  • The Information Commissioner’s Office will be notified without undue delay and, where required, within 72 hours of becoming aware of the breach

11. Website and Electronic Communication

  • Information submitted through the Inner Spark Hypnotherapy website is transmitted using a secure HTTPS connection
  • Information submitted through the website is not intentionally retained on the website for longer than necessary
  • Email correspondence is retained only for as long as it is reasonably necessary
  • Reasonable security measures are used, but no internet or email transmission method can be guaranteed to be completely secure

12. Complaints About Data Handling

If you have any concerns about how your personal information is collected, stored or used, you have the right to raise a complaint directly with Inner Spark Hypnotherapy in the first instance.

You can submit a data protection complaint by emailing:

info@innersparkhypnotherapy.co.uk

You also have the legal right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

Information Commissioner’s Office:
Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113

If you have any questions about how your information is handled or about this Privacy Policy, please contact info@innersparkhypnotherapy.co.uk.

Data Protection Complaints Policy

Effective date: 1 May 2026
Last reviewed: April 2026
Data protection contact: info@innersparkhypnotherapy.co.uk

1. Purpose

This policy explains how clients can raise concerns about how their personal data has been handled and how data protection complaints will be managed fairly, promptly, sensitively and transparently.

2. How to Make a Complaint

If you have a concern about how your personal information has been collected, stored, shared or used, please contact:

Email: info@innersparkhypnotherapy.co.uk

It would be helpful if your complaint included:

  • Your name and contact details
  • A clear description of your concern
  • Any relevant dates, appointments or correspondence
  • Details of what you would like me to do to resolve the matter, where applicable

You do not need to use a specific complaint form or refer to data protection legislation when making your complaint.

3. What Happens Next

  • I will acknowledge your complaint within five working days
  • I will investigate your concern fairly, appropriately and confidentially
  • I will keep you informed about the progress of the investigation where appropriate
  • I aim to provide a full response within 30 days

If your complaint is particularly complex or requires additional information, it may take longer to investigate. If this happens, I will explain the reason and keep you informed.

4. Complaint Outcomes

After reviewing your complaint, I will provide you with an outcome that:

  • Explains what happened and how your complaint was investigated
  • Responds to the concerns you raised
  • Explains whether any problems were identified
  • Sets out any appropriate steps taken to resolve the matter
  • Explains any actions taken to prevent the issue from happening again, where applicable
  • Explains the reasons for the decision where I consider that your information was handled appropriately

5. If You Are Not Satisfied

If you are not satisfied with my response, you may contact me again and explain which parts of your complaint remain unresolved.

You also have the legal right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters:

Information Commissioner’s Office
Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113

You may contact the ICO at any time. However, you are encouraged to contact Inner Spark Hypnotherapy first so that I have an opportunity to investigate and resolve your concern.

6. Confidentiality

All data protection complaints will be handled sensitively and in confidence.

Information relating to your complaint will only be accessed or shared where this is necessary to investigate the complaint, obtain appropriate professional or legal advice, comply with the law or resolve the matter.

7. Record Keeping

I keep appropriate records of data protection complaints in order to:

  • Monitor the effectiveness of the complaints process
  • Demonstrate how complaints have been investigated and resolved
  • Identify opportunities to improve my services and data-handling practices
  • Meet legal, regulatory, insurance and professional requirements

Complaint records will be stored securely and retained only for as long as reasonably necessary.

8. Related Rights

Making a complaint does not affect your other data protection rights, including:

  • The right to request access to your personal data
  • The right to request correction of inaccurate information
  • The right to request deletion where the right applies
  • The right to request restriction of processing
  • The right to object to certain processing

A data protection rights request and a data protection complaint may be handled separately because different legal requirements and response periods may apply.

9. Policy Review

This policy will be reviewed regularly and updated where necessary to reflect changes to the law, regulatory guidance or the way Inner Spark Hypnotherapy handles personal information.

Paula Greensted
Inner Spark Hypnotherapy