Privacy Policy

---

Last updated: July 2027

Fairfield Hypnotherapy is the trading name of Tracey Jesney, who is the Data Controller responsible for the personal information you provide.

I collect and process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This notice explains what information I collect, why I need it, how it is used, and your rights.

I am a registered member of the National Council for Hypnotherapy (NCH) and I follow their professional and ethical standards, including requirements around confidentiality, record‑keeping, and data protection.

What information I collect

I collect and process personal data only where it is necessary to provide safe, effective, and personalised hypnotherapy. This may include, but is not limited to:

• Your name 
• Address 
• Email address 
• Telephone number 
• Relevant information about your circumstances and reasons for seeking therapy 
• Information you share during therapy sessions that is necessary to support your      therapeutic work 
• For clients under 18, limited information about parents / carers or those with parental responsibility, where needed
• 
  

Some of the information I collect is special category data, such as information about your mental and physical health. I process this data because it is necessary for the provision of health‑related treatment and for the management of health or social care systems and services, in line with UK GDPR and the Data Protection Act 2018.

How and where your data is stored

I use a combination of handwritten records and secure electronic systems:

• Handwritten notes: Session notes and key clinical information are recorded by hand and stored securely in locked storage. 
• Acuity Scheduling: I use Acuity to manage appointments and basic contact details. Acuity is a third‑party online scheduling service; I take reasonable steps to ensure it meets      appropriate security and data protection standards. 
• Electronic communications: Email and any electronic documents are stored on password‑protected and encrypted devices wherever possible.
• 
  

Wherever possible, your data is stored within the UK or EEA. If a third‑party provider stores or processes data outside the UK/EEA, I will ensure that appropriate safeguards are in place (for example, approved contractual clauses or equivalent protections).

Why I need your data (lawful basis)

I collect and use your personal data for the following purposes:

• To provide hypnotherapy services, tailored to your individual needs, goals, and      desired outcomes 
• To manage appointments, including contacting you about bookings, reminders, rearrangements, or cancellations
• To maintain accurate and appropriate clinical records as required by my professional and legal obligations 
• To respond to queries or complaints related to the service I provide

The main lawful bases I rely on are:

• Contract – processing is necessary to provide you with therapy services you have requested 
• Legitimate interests – to maintain appropriate records and run a safe and professional practice 
• Legal obligation – where I must retain or share certain information in order to comply with the law (for example, safeguarding obligations)

For special category data (such as health information), I rely on the additional legal condition that processing is necessary for the purposes of health or social care (including the management of health or social care systems and services).

Confidentiality, safeguarding, and when I may share information

Everything you share with me in therapy is treated as confidential, in line with NCH ethical guidelines.

There are, however, a small number of situations where I may need to share information without your consent:

• Where there is a serious and immediate risk of harm to you or to others 
• Where I am required to do so by law (for example, a court order or statutory requirement) 
• Where it is necessary to share information with relevant professionals to safeguard a child or vulnerable adult

In circumstances where you inform me, inside or outside a therapy session, that you or someone else is at immediate risk of harm, I may use the information you have provided to contact emergency services or appropriate agencies to protect you or others from harm.

Professional supervision

To maintain professional standards and ensure the quality of the service I provide, I may discuss anonymised aspects of your case in professional supervision with another qualified therapist or supervisor. Any such discussion will maintain confidentiality and complete anonymity; you will not be identifiable.

Who I share your data with

I do not sell or pass your details to third parties for marketing.

I will not share your personal data with any other person or organisation without your explicit consent, except:

• In the safeguarding or legal circumstances described above; or 
• Where I am required to share information with my professional body, insurer, or      a regulatory authority as part of a complaint, claims process, or professional review. In these cases, I will share the minimum necessary information.

How long I keep your data

I retain client records in line with the requirements of my professional body (NCH) and legal obligations.

• For adult clients, records are normally kept for 8 years after the end of therapy. 
• For clients under 18, records are normally kept until the client reaches 25 (or 26 if      aged 17 at the end of treatment), in line with common clinical and legal guidance.

Records may include information about why you sought therapy, a brief summary of each session, and notes made as part of the therapeutic process.

After the relevant retention period has expired, records are securely destroyed (for example, by cross‑cut shredding of paper notes).

Your data protection rights

Under UK data protection law, you have the following rights:

• Right of access – to request a copy of the personal information I hold about you 
• Right to rectification – to ask me to correct any inaccurate or incomplete information 
• Right to erasure – to request deletion of your personal data where there is no longer a lawful reason for me to keep it 
• Right to restriction of processing – to request that I limit how I use your data in certain circumstances 
• Right to object – to object to certain types of processing, such as any non‑essential processing beyond providing therapy 
• Right to data portability – in limited circumstances, to request that information you have provided be transferred to you or another provider in a structured, commonly used format

These rights are not absolute and may be subject to legal or professional obligations. For example, I may need to retain certain information to comply with clinical record‑keeping or legal requirements, even if you request deletion.

Contact details and complaints

If you have any questions or concerns about how I handle your personal data, or if you wish to exercise any of your rights, please contact:

Data Controller: Tracey Jesney
Email: info@fairfieldhypnotherapy.co.uk

 

If you are not satisfied with my response, or believe your personal data has not been processed in accordance with data protection law, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):