Privacy Policy
June 2026
1. Who I Am
I am Andrea Massey, a Clinical Hypnotherapist & Psychotherapist committed to protecting your privacy and handling your personal information responsibly.
I am the Data Controller for the personal information you provide in connection with my services.
ICO Registration Number: 00010443729
2. Purpose of This Privacy Policy
This Privacy Policy explains how I collect, use, store and protect your personal information when you make an enquiry, book appointments or receive hypnotherapy services.
I process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable UK data protection legislation, including amendments introduced by the Data (Use and Access) Act 2025.
3. Information I May Collect
Depending on your interaction with my practice, I may collect:
Your name, postal address, telephone number and email address.
Date of birth.
Emergency contact details where appropriate.
GP or other healthcare professional details where relevant.
Medical history and health information relevant to your treatment.
Lifestyle information where relevant to your therapy goals.
Assessment forms, therapy notes and treatment plans.
Appointment records and correspondence.
Payment and invoicing information.
Information submitted through my website or contact forms.
4. Why I Collect Your Information
Your information is used to:
Provide safe and effective hypnotherapy services.
Assess your suitability for treatment.
Develop and review treatment plans.
Arrange appointments and communicate with you.
Maintain accurate professional records.
Meet legal, professional and insurance obligations.
Protect your welfare or the welfare of others where necessary.
5. Lawful Basis for Processing
I process your personal data where permitted by law, including for:
The performance of my contract with you when providing therapy services.
Compliance with legal and regulatory obligations.
Legitimate interests in operating a safe and effective professional practice.
The processing of health-related information where necessary for the provision and management of healthcare or under another lawful condition recognised by UK data protection law.
6. Confidentiality
Information shared during therapy is treated as confidential.
However, confidentiality may be limited where:
There is a serious risk of harm to you or another person.
Disclosure is required by law or court order.
Safeguarding responsibilities require information to be shared.
Disclosure is necessary to prevent serious crime or protect vital interests.
Where appropriate, I will endeavour to discuss any necessary disclosure with you beforehand unless doing so would increase risk or be unlawful.
7. Professional Supervision
As part of maintaining professional standards, I may discuss aspects of my work with a clinical supervisor.
Any information shared for supervision purposes will be anonymised wherever reasonably possible so that you cannot be identified.
8. Storage and Security
Electronic records are stored on password-protected devices and secure systems using appropriate security measures.
Where cloud-based storage providers are used, they are selected with appropriate safeguards designed to protect confidentiality and integrity.
Paper records are securely stored and, where appropriate, digitised before being confidentially shredded.
Access to client information is restricted to authorised persons.
9. Online Sessions and Electronic Communications
If therapy sessions are conducted online or communications take place by email, telephone or messaging services, reasonable steps are taken to maintain confidentiality.
While secure systems are used wherever possible, no electronic communication can be guaranteed to be completely secure.
10. Website Enquiries
If you contact me through my website, email or online enquiry form, the information you provide will be used solely to respond to your enquiry and, where appropriate, arrange services.
My website may use cookies or similar technologies necessary for its operation. Any optional cookies should only be used with your consent where required by law.
11. AI-Assisted Administrative Tools
From time to time, administrative tasks such as drafting documents, summarising notes or preparing non-clinical materials may involve AI-assisted software.
Personally identifiable client information will not be intentionally entered into AI systems unless appropriate safeguards, legal requirements and confidentiality obligations are met.
Clinical judgement and decision-making always remain my responsibility.
12. Sharing Your Information
Your personal information will not routinely be shared with third parties unless:
You have given your consent.
Sharing is necessary for your care or treatment.
It is required by law.
It is necessary for safeguarding or the prevention of serious harm.
Professional advisers, insurers or regulators legitimately require access.
Service providers acting on my behalf require limited access to perform secure administrative or technical functions.
Where third parties process information on my behalf, appropriate contractual and security safeguards are expected to apply.
13. Retention of Records
In accordance with professional guidance and insurance requirements:
Adult client records are generally retained for 8 years following the end of therapy.
Records relating to children and young people are retained in accordance with applicable professional guidance and legal requirements.
At the end of the retention period, records will be securely destroyed unless there is a lawful reason for continued retention.
14. Requests for Erasure
You may request that your personal data be erased.
However, I may be unable to comply where retention is necessary to meet legal obligations, insurance requirements, professional standards or to establish, exercise or defend legal claims.
15. Your Rights
Subject to applicable law, you have the right to:
Request access to your personal data.
Request correction of inaccurate information.
Request erasure where applicable.
Request restriction of processing.
Object to certain processing activities.
Request data portability where legally applicable.
Lodge a complaint about how your information has been handled.
16. How to Raise a Concern
If you have concerns about my handling of your personal information, please contact me so that I can investigate and attempt to resolve the issue promptly.
If you remain dissatisfied, you may submit a complaint to the Information Commissioner’s Office (ICO).
17. Changes to This Policy
This Privacy Policy may be updated periodically to reflect changes in legislation, professional guidance or business practices. The most recent version will always be made available to clients.