Cirrus Hypnotherapy Privacy Policy
– Online Solution Focused Hypnotherapy
Effective Date: [14/07/2025] | Last Updated: [01/06/2026]
In May 2018, the Data Protection Act was replaced by the General Data Protection Regulation (GDPR). Chris is GDPR registered. The changes to the Data Protection Act are aimed at ensuring your personal, confidential and sometime sensitive data, is held privately and securely. This means that any data you give to Chris must be processed in a way you agree with. GDPR exists to protect your rights as a consumer. It applies to your identifiable data, e.g., your Name and address & any reason you might have for visiting Chris. It also covers any session records, text messages or emails between Chris & yourself.
This policy explains how we collect, use, store and protect your personal data, in compliance with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA) . It applies to all clients, website visitors and enquirers.
1. Who We Are
Data Controller: [Christian French / Cirrus Hypnotherapy]
Contact: [Chris@cirrushypno.co.uk] | | [WWW.Cirrushypno.co.uk]
I am a qualified solution-focused hypnotherapy practitioner, registered with [NCH - National Council for Hypnotherapy / AfSFH – Association for Solution Focused Hypnotherapy], bound by professional codes of ethics and confidentiality.
2. Data We Collect
We only collect what is necessary, following data minimisation principles.
Ordinary Personal Data
- Name, contact details (email, phone, address)
- Payment and billing information
- Appointment history, correspondence and notes
- Website usage data: IP address, device details, pages viewed, cookies (see Section 9)
Special Category Data (Sensitive Data)
As part of therapy, we collect health, wellbeing, mental health, personal history and circumstances – these are special category data under UK GDPR Article 9 . We only process this:
- With your explicit consent, or
- Where necessary for your treatment, care and professional obligations.
We never collect more than needed to deliver safe, effective solution-focused hypnotherapy.
3. Why We Use Your Data – Lawful Basis
We process data only where we have a clear legal reason:
For clients receiving services:
- Contract: To deliver sessions, agree goals, manage bookings and fulfil our service agreement.
- Legal Obligation: To meet professional, insurance, tax and regulatory requirements.
- Legitimate Interests: To ensure safe practice, safeguard wellbeing, maintain records and improve services – balanced against your rights.
- Explicit Consent: For sensitive health data and optional marketing; you may withdraw this at any time.
For enquirers / website users:
- Legitimate Interests: To respond to enquiries and manage relationships.
- Consent: For marketing communications (you can opt out anytime).
DUAA update
We apply recognised legitimate interests where permitted, and comply with simplified rules for access and complaints handling .
Purposes:
- Deliver online sessions, support and solution-focused work
- Plan, record and review progress
- Keep accurate, secure clinical records
- Process payments and administer accounts
- Communicate about appointments or service updates
- Comply with legal, ethical and insurance rules
- Improve services and website functionality
- Only send marketing if you have agreed.
4. Who We Share Data With
We never sell your data. We only share where necessary or required by law:
- Service Providers: secure hosting, video platforms, payment processors, accounting – all bound by contracts and confidentiality.
- Professional bodies / insurers: only as required for regulation or insurance purposes.
- Legal requirements: if ordered by court, or to protect vital interests / safety.
- Emergency situations: only to named contacts [Emergency contact / Doctor] or professionals [Emergency service operatives for Police/Ambulance/Fire service], strictly when necessary.
All transfers comply with UK rules; if data leaves the UK/EEA, we use approved safeguards.
5. Data Retention
We keep data only as long as required:
- Client records: 8 years after your last session (standard for therapy/insurance). For under-18s: retained until age 25+8 years, per guidance.
- Financial records: 6 years per HMRC rules.
- Enquiry data: 2 years if no service taken.
- After this: securely destroyed / deleted, no recovery possible.
What if I would like my data to be destroyed before this date?
- Due to the sensitive nature of what we do, my insurance company does not allow the deletion of data, before the minimum time for holding said data.
Am I able to see or get a copy of the information held by you?
- In line with GDPR, if you send Chris a request in writing, specifying the data you wish to see, he will supply you with a copy of your data within 30 days. Chris will need to confirm your identity before sending you the information. There will be no charge for this service. NB Chris’s insurance company’s legal team may wish to verify any information Chris sends out.
6. Your Rights (UK GDPR + DUAA)
You have full rights, including:
- Right to access: request a copy of all data we hold – we conduct proportionate searches only.
- Right to correct: update inaccurate or incomplete information.
- Right to erase (‘right to be forgotten’): where no legal reason to keep.
- Right to restrict processing: limit how we use your data in certain cases.
- Right to data portability: receive data in a usable format, where applicable.
- Right to object: to processing based on legitimate interests or marketing.
- Right to withdraw consent: at any time – does not affect past processing.
- Right not to be subject to automated decisions: we do not use automated profiling or decisions with legal/significant effect .
To exercise rights: email us at [Chris@cirrushypno.co.uk]. We respond within 1 month, free of charge unless requests are excessive.
DUAA: We have a clear process for handling complaints and will inform you of outcomes promptly .
7. Security & Confidentiality
We use appropriate and proportionate technical and organisational measures:
- End-to-end encrypted platforms for online sessions
- Password-protected systems, secure cloud storage
- Limited access – only we and authorised processors
- Confidentiality is core to our profession – we never discuss your details without consent, unless safety/legality requires.
What if I see you outside of a hypnotherapy session?
- With the clients consent we can have informal conversation not involving anything to do with any issue raised within sessions.
Are our discussions within the hypnotherapy sessions confidential?
- Everything you discuss with Chris during your sessions remains strictly confidential. Occasionally it may be necessary for Chris to discuss elements of your sessions with their supervisor to ensure that they are helping you in the most effective way. However, no identifying features about you will be disclosed during these discussions. Chris’s supervisor is also registered with the ICO and abides by GDPR requirements.
Will you discuss information about me with other health and social care professionals?
- Chris is only able to contact other health and social care professionals with your written consent. Should they write to your GP, to notify them that you have entered into a therapeutic relationship with them, or to notify them that your therapy has been successfully concluded, Chris would require your signature, in line with GDPR requirements. Cirrus does have a ‘duty of care’ towards their clients, so the only exceptions to this would be if they believed that you were about to harm yourself or others. Should this occur then Chris would be required to inform the relevant authorities. However, Chris would always aim to discuss this with you before taking any action. Legally, Chris would also have to provide the police with information as set out in a warrant or court order, should the situation arise.
8. Children / Under 18s
We only work with under-18s with parental/guardian consent, and follow stricter protection rules. Records retained per guidelines above.
9. Cookies & Online Tracking
Our website uses essential cookies only – required for function and booking. Non-essential cookies require your consent, per PECR and DUAA updates . See our separate Cookie Policy [link].
10. International Transfers
We store and process data in the UK / countries with adequate protection. Any transfers outside use approved clauses or safeguards.
11. Changes to This Policy
We may update this policy to reflect legal or practice changes – published here with updated date.
12. Complaints
If you are unhappy with how we handle your data:
1. Contact us first: [Chris@cirrushypno.co.uk]
2. You may also complain directly to the Information Commissioner’s Office (ICO):
- Website: https://ico.org.uk
- Helpline: 0303 123 1234
