PRIVACY POLICY
1. Introduction
At ESPRIT Hypnotherapy, we respect your privacy and are committed to protecting the personal information you provide to us.
This Privacy Policy explains how we collect, use, store and protect your personal information when you contact us, use our services or visit our website.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and other applicable data-protection and privacy legislation.
We will only collect and use personal information where we have a lawful basis to do so, will only collect information that is relevant to the purposes for which it is needed, and will take appropriate steps to keep it secure.
This Privacy Policy may be updated from time to time to reflect changes in legislation, regulatory guidance, our services or the way we process personal information.
2. Who is responsible for your information?
For the purposes of data-protection law, ESPRIT Hypnotherapy is the Data Controller for the personal information that we collect and use in connection with our services.
Our contact details for data-protection matters are:
ESPRIT Hypnotherapy
Email: info@esprithypnotherapy.co.uk
Data protection contact: Jane Randall
If you have any questions about how we use your personal information, or wish to exercise any of your data-protection rights, please contact us using the details above.
3. Information we collect
When you contact us through our website, by telephone, email or other means, we may collect:
-
Your name
-
Your email address
-
Your telephone number
-
Information you choose to provide about the reason for your enquiry
-
Any other information that you voluntarily provide to us
If you decide to proceed with an appointment, we may collect additional information necessary to provide our services.
4. Information collected during an initial consultation
As part of an Initial Consultation, we may ask for:
-
Your name and address
-
Your telephone number
-
Your email address
-
Your GP's contact details
-
Relevant health information
-
Information relevant to your suitability for hypnotherapy
-
An emergency contact ("ICE" – In Case of Emergency)
-
Information you provide during consultations and subsequent sessions
We may also make notes about information you provide during sessions. These notes may be used to help us plan subsequent sessions and prepare appropriate material or scripts.
We will seek to collect only information that is relevant and necessary for the provision of our services.
5. Health information and special-category data
Some of the information collected during an initial consultation or subsequent sessions may constitute health data.
Health information is classed as special-category personal data under Article 9 of the UK GDPR and is subject to additional legal protection.
We will only process health information where we have:
-
a lawful basis under Article 6 of the UK GDPR; and
-
an appropriate condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018.
Our processing of health information is necessary for purposes connected with assessing suitability for hypnotherapy, providing and managing our services, maintaining appropriate client records and protecting the safety and wellbeing of clients.
Where appropriate, we may ask for your explicit consent to the processing of particular health information. Where we rely on consent, you may withdraw that consent, although this will not affect processing that we have already carried out lawfully or processing that we are permitted or required to continue for another legal reason.
6. How we use your information
We may use your personal information to:
-
Respond to enquiries.
-
Discuss your requirements.
-
Arrange and manage appointments.
-
Provide hypnotherapy services.
-
Assess information relevant to your suitability for hypnotherapy.
-
Contact you during the period in which we are working together.
-
Maintain appropriate client and treatment records.
-
Prepare for future sessions.
-
Prepare scripts or other material used during sessions.
-
Deal with emergencies where necessary.
-
Maintain appropriate financial and administrative records.
-
Manage and improve our services.
-
Deal with complaints or enquiries.
-
Meet legal, regulatory, professional, insurance or accounting requirements.
-
Establish, exercise or defend legal claims where necessary.
We will not use your personal information for purposes that are incompatible with the purposes described in this Privacy Policy unless we have a lawful basis to do so and, where required, provide you with appropriate information about the new purpose.
7. Our lawful bases for processing
Depending on the circumstances, we may rely on one or more of the following lawful bases under Article 6 of the UK GDPR:
-
Contract: where processing is necessary to provide services you have requested or to take steps at your request before entering into an agreement.
-
Legal obligation: where we need to process information to comply with a legal requirement.
-
Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your rights and interests.
-
Consent: where we have asked you to provide consent for a particular use of your information.
-
Vital interests: where processing is necessary to protect someone's vital interests in an emergency and the applicable legal conditions are met.
Where we process special-category health information, we will also identify and rely on an appropriate Article 9 condition.
8. Emergency situations and confidentiality
We normally treat information that you provide to us as confidential.
However, there may be circumstances in which information needs to be disclosed without your consent, for example where this is necessary to protect someone's vital interests, where there is a serious and immediate risk of harm, where disclosure is required by law, or where disclosure is necessary for the prevention, detection or prosecution of crime.
Where we consider that disclosure is necessary to protect you, another person, or the public, we will disclose only information that is necessary and proportionate to the circumstances.
Where appropriate and lawful, we may contact your GP or another appropriate professional or organisation in an emergency or where this is necessary to address a serious risk.
9. Emergency contact information
If you provide ICE (In Case of Emergency) contact details, these will be used only for appropriate emergency purposes or where necessary to protect your vital interests or those of another person.
We will not routinely contact your emergency contact for general administration or marketing purposes.
10. Marketing
We may ask whether you would like to receive promotional information or further information about our services or general wellbeing.
Marketing communications will only be sent where we have an appropriate lawful basis to do so.
Where consent is the lawful basis, you are free to withdraw your consent at any time.
You can ask us to stop sending marketing communications at any time by contacting us at:
Withdrawing consent for marketing will not affect any processing that is necessary for providing our services or that we are otherwise legally entitled or required to carry out.
11. Sharing your information
We will not sell your personal information.
We may share personal information where this is necessary and lawful, including with:
-
Professional advisers where necessary.
-
Your GP or another appropriate professional in circumstances where disclosure is necessary and lawful, including appropriate emergency situations.
-
Law-enforcement or regulatory authorities where we are legally required or permitted to do so.
-
Other parties where disclosure is necessary to establish, exercise or defend legal claims.
Where another organisation processes personal information on our behalf, we will ensure that appropriate contractual and other safeguards are in place as required by data-protection law.
12. How long we keep your information
We will not keep personal information for longer than is necessary for the purpose for which it was collected, unless we have a legal, regulatory, professional, insurance or other legitimate reason to retain it for longer.
Client records may be retained for up to seven years following the end of the client relationship, subject to our legal, professional and insurance requirements and any circumstances requiring a different retention period.
Where a longer or shorter retention period is required by law or is justified by the circumstances, we will apply the appropriate period.
When personal information is no longer required, it will be securely deleted, destroyed or anonymised.
The right to erasure does not require an organisation to delete information where there is a lawful reason to retain it.
13. Security of your information
We take appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
These measures include appropriate access controls, secure systems and procedures designed to limit access to personal information to those who need it for legitimate purposes.
No method of transmitting or storing information can be guaranteed to be completely secure. However, we will take reasonable and appropriate steps to protect the information we hold.
14. Online and webcam sessions
Where sessions are conducted by webcam using services using Zoom or Google Meet we will take reasonable steps to protect the confidentiality and security of the session.
Where a session is recorded solely because contemporaneous notes cannot reasonably be taken, the recording will be retained only for as long as necessary to prepare the relevant notes and will then be securely deleted.
Recordings will not be retained for longer than necessary and will not be used for any other purpose without an appropriate lawful basis.
15. Website analytics
We may use Google Analytics tools to understand how visitors use our website and to improve the website and our services.
Where analytics technologies require consent under applicable privacy and electronic communications legislation, we will seek that consent before placing or accessing the relevant information.
We do not intentionally use website analytics to identify individual clients unless this is clearly explained to you and there is an appropriate lawful basis for doing so.
16. Cookies
Our website may use cookies and similar technologies.
Some cookies or similar technologies may be necessary for the website to operate correctly. Other cookies, such as certain analytics or advertising technologies, may require your consent before they are used.
Where consent is required, you will be given an appropriate choice about whether to accept those technologies.
You can also manage cookies through your browser settings, although disabling certain cookies may affect the functionality of the website.
Further information about the cookies actually used on our website can be found in our Cookie Policy.
17. Links to other websites
Our website may contain links to other websites.
Once you leave our website, we are not responsible for the privacy practices, security or content of those websites.
We recommend that you read the privacy and cookie policies of any third-party website that you visit.
18. Your data-protection rights
Subject to certain legal conditions and exemptions, you have rights under UK data-protection law, including:
Right to be informed
You have the right to receive clear information about how and why we use your personal information. This Privacy Policy is intended to provide that information.
Right of access
You can ask us for a copy of the personal information we hold about you.
This is commonly known as a Subject Access Request (SAR).
We will carry out a reasonable and proportionate search for the information relevant to your request, as required by current data-protection law.
We will normally respond within one month of receiving a valid request and any information reasonably required to verify your identity. Where permitted by law, the response period may be extended for complex or multiple requests.
To make a Subject Access Request, contact:
Jane Randall
info@esprithypnotherapy.co.uk
Right to rectification
You can ask us to correct personal information that you believe is inaccurate or incomplete.
We will take reasonable steps to correct inaccurate information without undue delay.
Right to erasure
In certain circumstances, you can ask us to delete your personal information.
This right is not absolute. We may be entitled or required to retain information where there is a lawful reason to do so, including where retention is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
Right to restrict processing
In certain circumstances, you can ask us to restrict the way we use your personal information.
Right to data portability
In certain circumstances, you have the right to receive personal information that you have provided to us in a structured, commonly used and machine-readable format and to ask us to transmit it to another organisation.
This right only applies where the relevant legal conditions are met.
Right to object
You may have the right to object to certain processing of your personal information.
You have an absolute right to object to processing for direct marketing purposes.
Rights relating to automated decision-making
You have rights concerning certain decisions based solely on automated processing, including profiling, where those decisions have legal or similarly significant effects.
ESPRIT Hypnotherapy does not currently use your personal information to make decisions about you solely by automated means.
19. How to exercise your rights
To exercise any of your rights, please contact:
Jane Randall
ESPRIT Hypnotherapy
Email: info@esprithypnotherapy.co.uk
Please provide sufficient information for us to identify you and understand your request.
We may need to verify your identity before releasing personal information. Any verification we request will be proportionate to the circumstances.
20. Data-protection complaints
If you have concerns about how we have collected or used your personal information, we would encourage you to contact us first so that we can investigate and try to resolve your concern.
You can make a data-protection complaint by emailing:
You may also make a complaint in writing to:
Jane Randall, ESPRIT Hypnotherapy
We will acknowledge your data-protection complaint within 30 days of receiving it. We will then take appropriate steps to investigate the complaint, keep you informed about its progress where appropriate, and provide you with the outcome without undue delay, in accordance with current data-protection requirements.
21. Complaining to the Information Commissioner's Office
If you remain dissatisfied after contacting us, you have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
The ICO can be contacted through its website:
Information Commissioner's Office
You should normally give us the opportunity to address your concern before contacting the ICO.
22. Data breaches
If we become aware of a personal-data breach, we will assess the breach and take appropriate action in accordance with UK data-protection law.
Where the law requires us to notify the ICO or affected individuals, we will do so within the applicable statutory timescales.
23. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, the information we process, technology, legislation or regulatory guidance.
The date at the beginning of this policy shows when it was most recently updated.
Last updated: June 2026