Privacy Policy
Ripon Hypnotherapy
Last updated: September 2026
At Ripon Hypnotherapy, your privacy, confidentiality and the security of your personal information are taken seriously.
This Privacy Policy explains what information I collect, why it is collected, how it is used and stored, how long it is retained, when it may be shared and your rights under current UK data protection legislation.
This policy reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and amendments introduced by the Data (Use and Access) Act 2025, including provisions which came fully into force during 2026.
___________________________________________________________
Who I am
I am Fiona Rose, Hypnotherapist and owner/practitioner at Ripon Hypnotherapy.
For the purposes of UK data protection legislation, I am the Data Controller for personal information processed within my practice.
Practice: Ripon Hypnotherapy
Practitioner: Fiona Rose
Email: riponhypno@gmail.com
Website: riponhypno.co.uk
ICO Registration: Ripon Hypnotherapy Clinic is registered with the Information Commissioner’s Office (ICO)
Professional Insurance: Balens Ltd
I am a member of Association for Professional Hypnotherapy and Psychotherapy (APHP) and National Council for Hypnotherapy (NCH) and practise in accordance with the relevant professional and ethical requirements.
I am registered with the Information Commissioner's Office (ICO).
________________________________________________________________
What information I collect
When you contact me or become a client, I may collect and process information including:
your name, address and contact details;
your date of birth;
appointment information;
information provided during your initial consultation;
your reason for seeking hypnotherapy;
relevant personal and family circumstances;
relevant medical history;
medication where relevant;
information concerning your physical or mental health;
previous therapy or treatment;
lifestyle information where clinically relevant;
brief clinical and session notes;
information concerning your progress;
GP details where appropriate;
emergency contact information;
communications between us;
payment and transaction information.
I aim to collect only information that is relevant and reasonably necessary to provide safe and appropriate hypnotherapy and meet my professional responsibilities.
________________________________________________________________
Lawful basis for processing your information
UK data protection law requires me to have an appropriate lawful basis for processing your personal information.
Where information is necessary to arrange and provide the hypnotherapy services you have requested, I will normally rely upon:
Article 6(1)(b) – Contract
This allows me to process personal information where this is necessary to take steps at your request before entering into a therapeutic agreement and to provide the hypnotherapy services you have agreed to receive.
There may be circumstances in which another lawful basis applies, including compliance with a legal obligation or legitimate interests relating to the appropriate administration, protection and operation of my practice.
________________________________________________________________
Health information and special category data
During your initial consultation and therapy, you may provide information concerning your physical or mental health, medical history, medication and other sensitive matters.
Health information is classed as special category personal data under UK GDPR and receives additional protection.
Where appropriate to my practice, for the routine processing of relevant health and other special category information for the purposes of providing hypnotherapy, I rely upon:
Article 9(2)(a) – Explicit Consent
I will ask you to provide explicit consent to the processing of relevant health and other special category information as part of my initial consultation and consent process. You may withdraw consent to future processing that relies upon your consent at any time. Withdrawal does not affect processing which was lawful before consent was withdrawn.
If you withdraw consent to processing information that is necessary for me to provide hypnotherapy safely and appropriately, I may no longer be able to continue providing therapy. There may be circumstances where another legal condition permits or requires processing, including certain safeguarding situations or the establishment, exercise or defence of legal claims.
________________________________________________________________
Why I use your information
Your information may be used to:
respond to your enquiry
arrange and manage appointments
assess whether hypnotherapy is appropriate
provide hypnotherapy
maintain appropriate clinical records
monitor your progress
communicate with you about appointments or therapy
provide appropriate therapeutic resources
process payments
maintain appropriate financial records
meet professional and insurance requirements
fulfil safeguarding responsibilities
comply with legal obligations
establish, exercise or defend legal claims where necessary
Your information will not be used for an unrelated purpose without an appropriate lawful basis.
___________________________________________________________
Clinical records
I maintain appropriate records of my clinical work in accordance with my professional responsibilities.
These may include:
personal and contact information
relevant case history
consent to therapy
relevant medical and health information
the reason for seeking hypnotherapy
treatment plans where appropriate
brief session records
relevant advice provided
relevant correspondence
Clinical records are intended to be accurate, relevant and proportionate.
I follow the principle of data minimisation. This means that I do not aim to create a detailed account of everything discussed during therapy. I record information that is reasonably necessary to maintain an appropriate professional and clinical record.
________________________________________________________________
How long I keep clinical records
My record-retention arrangements reflect the requirements of NCH and Balens Ltd (Insurance).
Adult clients: Clinical records will normally be retained securely for 8 years following the last interaction with the client.
Children under 16 when last seen: Records will normally be retained until the client reaches 25 years of age.
Clients aged 17 when last seen: Records will normally be retained until the client reaches 26 years of age.
Financial and accounting information may also be retained for the period required by applicable tax and financial legislation.
At the end of the appropriate retention period, information will be securely destroyed or deleted unless there is a legitimate reason for retaining it for longer.
________________________________________________________________
Security and storage of clinical records
I take reasonable and proportionate measures to protect personal and clinical information from accidental loss, unauthorised access, disclosure, alteration or destruction. Access to client information is limited to what is necessary for the safe and effective running of the practice.
Electronic systems and devices used for the practice are protected using appropriate security measures, including password protection, access controls, device locking, software and security updates and secure deletion where appropriate.
Any paper records are kept securely and disposed of confidentially when no longer required.
Appropriate arrangements will also be made for the future protection of clinical records should I retire, cease practising, become incapacitated or die.
________________________________________________________________
Confidentiality
Information discussed during therapy will normally remain confidential. However, confidentiality is not absolute.
Information may need to be shared where:
you have given permission;
disclosure is required by law;
there is an appropriate safeguarding concern;
a child or vulnerable person may be at risk;
there is a serious risk of harm;
disclosure is necessary for the establishment, exercise or defence of legal claims;
another lawful basis permits or requires disclosure.
Where disclosure is necessary, I will aim to disclose only information that is relevant and proportionate to the situation. Where it is appropriate and safe to do so, I will normally discuss this with you.
________________________________________________________________
Safeguarding and child protection
I have professional responsibilities concerning safeguarding and child protection. Where information gives rise to a safeguarding concern, information may need to be shared with an appropriate safeguarding organisation, local authority, police, healthcare professional or other appropriate body. Where a statutory reporting duty applies, I will comply with that duty. I will not promise absolute confidentiality where information indicates that safeguarding action or disclosure may be necessary.
________________________________________________________________
Professional supervision
Professional supervision forms an important part of safe and ethical clinical practice. My clinical work may therefore be discussed with my professional supervisor.
Wherever reasonably possible, identifying information is removed or minimised. Only information reasonably necessary for effective professional supervision will be discussed.
________________________________________________________________
GP and other healthcare professionals
There may be circumstances where communication with your GP or another
healthcare professional is appropriate. Where possible, I will seek your permission
before contacting another healthcare professional. There may be exceptional circumstances where information needs to be shared without consent, for example where required by law or where there is an appropriate safeguarding or serious safety concern.
________________________________________________________________
Email, telephone and messaging
I may communicate with you using telephone, email or WhatsApp. I aim to minimise sensitive clinical information contained in routine electronic communications. Electronic communication carries some degree of privacy and security risk. You should therefore avoid sending unnecessary sensitive information through email or messaging services.
________________________________________________________________
Online hypnotherapy
Where therapy is provided online, I use Microsoft Teams. Online therapy sessions are not routinely recorded. If there were a genuine reason for recording a session, this would be discussed with you in advance, including the purpose of the recording, how it would be stored, who would have access and when it would be deleted.
________________________________________________________________
Hypnotherapy recordings
As part of therapy, I may provide hypnosis, relaxation or other therapeutic audio recordings. General recordings which do not contain identifiable information about you are not normally part of your clinical record. Where a recording is individually created and contains identifiable personal information, it will be treated appropriately as personal information.
________________________________________________________________
Payments
Payment information is processed only where necessary to administer appointments, receive payment and maintain appropriate financial records. I currently accept payment by bank transfer. Where an external payment provider is used, that organisation will process information in accordance with its own data protection responsibilities. I do not routinely retain full credit or debit card information.
________________________________________________________________
Third-party service providers
I may use third-party organisations and technology providers to support the operation of my practice.
These may include:
Email: Gmail
Payment processing: Monzo
Video consultations: Microsoft Teams
Website hosting and contact form: Square Space
Messaging: WhatsApp
Where another organisation processes personal information on my behalf, I take reasonable steps to ensure that appropriate data protection arrangements are in place.
________________________________________________________________
Marketing and supportive updates
Receiving hypnotherapy does not automatically mean that you will be added to a marketing list. Where you are offered the option of receiving supportive updates, newsletters or marketing communications, this will be dealt with separately from your consent to therapy. Where marketing relies upon consent, you can withdraw that consent at any time. Marketing communications will provide an appropriate way to unsubscribe. Withdrawing from marketing will not affect essential communications relating to therapy or appointments.
________________________________________________________________
Testimonials
Client testimonials, photographs or stories will not be published simply because somebody has received hypnotherapy. Written consent will be obtained for the use of an identifiable client testimonial and appropriate additional consent will be obtained where a client's name, photograph or other identifying information is to be disclosed. Particular care will be taken where a testimonial reveals information about a person's health or treatment.
________________________________________________________________
Website enquiries
If you submit an enquiry through the Ripon Hypnotherapy website, the information you provide will be used to respond to your enquiry and, where appropriate, arrange an appointment. Making an enquiry does not automatically add you to a marketing list. Information from enquiries which do not result in a therapeutic relationship will not be retained indefinitely without an appropriate reason.
________________________________________________________________
Data breaches
A personal data breach can include loss, accidental disclosure, unauthorised access or information being sent to the wrong person. If a personal data breach occurs, I will take appropriate steps to contain it, establish what information is affected, assess the potential risk to the individual or individuals concerned, document the incident and action taken, determine whether the Information Commissioner's Office needs to be notified, notify affected individuals where legally required. Where notification to the ICO is required, this will be done within the legally required timescale.
Your data protection rights
Depending upon the circumstances, you may have rights including:
the right to be informed about how your information is used
the right to access personal information held about you
the right to have inaccurate information corrected
the right to request erasure in certain circumstances
the right to restrict processing in certain circumstances
the right to object to certain processing
the right to data portability where applicable
rights relating to certain forms of automated decision-making
Not every right applies in every circumstance. If you wish to exercise a data protection right, please contact:
Fiona Rose
Email: riponhypno@gmail.com
________________________________________________________________
Accessing your information - Subject Access Requests
You have the right to ask for access to personal information I hold about you. This is commonly known as a Subject Access Request (SAR). A request can be made verbally or in writing. In accordance with current UK data protection legislation, I will undertake a reasonable and proportionate search for information covered by your request. I may request information where reasonably necessary to confirm your identity. Where clarification is reasonably necessary to identify the information you are requesting, I may ask you to clarify your request. Where permitted under current legislation, the response period may be paused while clarification is awaited. Requests will normally be dealt with without undue delay and within one month, subject to the provisions and permitted extensions contained within data protection legislation. Information concerning another individual may need to be redacted or withheld where appropriate.
________________________________________________________________
Data protection complaints – updated 2026
If you are unhappy with the way Ripon Hypnotherapy has collected, used, stored, disclosed or otherwise handled your personal information, you have the right to make a data protection complaint.
Please contact:
Fiona Rose
Email: riponhypno@gmail.com
Please provide sufficient information for me to understand and investigate your concern. In accordance with current data protection requirements, I will:
provide an appropriate way for you to make a complaint
acknowledge receipt of your complaint within 30 days
take appropriate steps to investigate it without undue delay
keep you appropriately informed about its progress
inform you of the outcome without undue delay
If you remain dissatisfied, you have the right to raise your concern with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.
________________________________________________________________
Changes to this Privacy Policy
This Privacy Policy will be reviewed periodically and whenever there is a significant change to:
data protection legislation
professional requirements
the technology used within my practice
the way personal information is processed
the services I provide
The current version will be available at:
Last reviewed: September 2026