Privacy Policy
LAST REVIEW: October 2026
1. Who I Am
I am Andrea Massey, a Clinical Hypnotherapist & Psychotherapist, providing hypnotherapy services in Brighton & Hove and online.
I am the data controller for the personal information I collect and use in connection with my practice. This means I am responsible for ensuring that your personal information is handled in accordance with applicable data protection law.
ICO registration number: 00010443729
Contact email: hello@andreamassey.com
Postal address: 6 Silverdale Avenue, Hove, East Sussex, BN3 6FF.
2. Purpose of This Privacy Policy
This Privacy Policy explains how I collect, use, store, protect and share your personal information when you contact me, enquire about my services, book an appointment or receive hypnotherapy.
I process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable data protection and privacy legislation.
I aim to collect only the information I need, keep it secure and retain it only for as long as necessary.
3. Information I May Collect
Depending on your interaction with my practice, I may collect the following information:
Contact information: your name, email address, telephone number and postal address, where relevant.
Personal details: your date of birth and emergency contact details, where appropriate.
Health information: relevant medical history, physical or mental health information, medication information and other details you choose to share that may be relevant to your suitability for therapy or treatment.
Therapy records: assessment forms, information discussed during consultations and sessions, therapy notes, treatment plans and progress reviews.
Appointment and administrative information: appointment records, correspondence, cancellations and payment or invoicing information.
Website information: information submitted through my website's contact forms, booking forms or other online features, together with technical information collected through cookies or similar technologies where applicable.
Marketing information: your email address, subscription preferences and records of consent or withdrawal if you choose to receive marketing communications.
I may also receive relevant information from another person, such as a referrer or healthcare professional, where appropriate and lawful.
I will explain why information is needed when I request it. You can ask me if you are unsure whether particular information is necessary.
4. How I Use Your Information
I use personal information where necessary to:
Respond to enquiries and provide information about my services.
Arrange consultations and appointments.
Assess whether hypnotherapy is suitable for you.
Provide and review therapy services and treatment plans.
Communicate with you about appointments and your care.
Maintain appropriate professional and administrative records.
Process payments and maintain financial records.
Meet legal, professional, insurance and record-keeping obligations.
Maintain the security of my practice and respond to complaints.
Protect your vital interests or the interests of another person in an appropriate emergency.
Send marketing communications where I have a lawful basis to do so.
I will not use your personal information for an unrelated purpose without an appropriate lawful basis and, where required, informing you or obtaining your consent.
5. Lawful Basis for Processing
Data protection law requires me to have a lawful basis for processing personal information. Health information is also classed as special-category personal data and requires an additional legal condition.
Depending on the purpose, I may rely on the following lawful bases under Article 6 of the UK GDPR:
Contract: where processing is necessary to take steps at your request before entering into an agreement or to provide services under an agreement with you.
Legitimate interests: where processing is necessary for the legitimate interests of operating and administering my practice, provided these interests are not overridden by your rights and freedoms.
Legal obligation: where processing is necessary to comply with a legal requirement.
Consent: where I have asked for your consent to a particular use of your personal information and you have freely given it.
For health information and other special-category data, I will also identify and rely on an applicable condition under Article 9 of the UK GDPR. This may include explicit consent where appropriate, or another condition permitted by law where its requirements are met.
I will not assume that consent to receive therapy automatically constitutes consent for every use of your personal information.
Where I rely on consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before withdrawal. I may still need to retain certain information where another lawful basis applies.
6. Confidentiality
Information you share during consultations and therapy sessions is treated as confidential and handled with care.
Confidentiality may be limited where there is an appropriate legal or safeguarding reason to disclose information. This may include circumstances where:
There is a serious concern about the safety or welfare of you or another person.
Disclosure is required by law or a valid court order.
Information needs to be shared to address a safeguarding concern.
Disclosure is otherwise necessary and lawful in the circumstances, including certain emergencies.
Any disclosure will be considered carefully, concerning necessity, proportionality, applicable law and my professional obligations.
Where appropriate and safe to do so, I will discuss a proposed disclosure with you beforehand. This may not be possible where doing so could increase risk or where the law prevents it.
7. Professional Supervision
I may discuss aspects of my professional work with my clinical supervisor as part of maintaining appropriate professional standards.
I will anonymise information wherever reasonably possible so that you cannot be identified. If information cannot be fully anonymised, I will take appropriate steps to protect confidentiality and ensure that any disclosure is lawful and consistent with my professional obligations.
8. Storage and Security
I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.
Depending on the systems used, these measures may include:
Password-protected devices and accounts.
Multi-factor authentication where available and appropriate.
Restricted access to client records.
Secure storage and backups where appropriate.
Secure handling and disposal of paper records.
Appropriate checks and contractual safeguards for service providers handling personal information on my behalf.
Paper records are stored securely and confidentially destroyed when no longer required.
Where cloud-based or other digital services are used, I take reasonable steps to assess their security and suitability. No system or method of electronic communication can be guaranteed to be completely secure.
If a personal data breach occurs, I will assess it and take appropriate action, including notifying the relevant regulator and affected individuals where required by law.
9. Online Sessions and Electronic Communications
I may communicate with you by email, telephone or other agreed methods and may provide sessions online using an appropriate video-conferencing platform.
I take reasonable steps to maintain confidentiality when communicating electronically. However, email, messaging services and online platforms carry some security and privacy risks.
Please consider your own privacy when joining an online session or sending sensitive information electronically. Where possible, use a private space and a secure device.
Online sessions are not routinely recorded. If this changes, I will explain the purpose, legal basis and arrangements for recording before doing so.
10. Website Enquiries, Cookies and Newsletter Sign-up
Website enquiries
If you contact me through my website, email or an online enquiry form, I will use the information you provide to respond to your enquiry and, where appropriate, arrange services.
If you enquire but do not proceed with therapy, I will retain your information only for an appropriate period, taking account of the purpose of the enquiry, any follow-up, applicable legal requirements and the need to deal with potential complaints or claims.
Cookies and similar technologies
My website is hosted on Squarespace and may use cookies or similar technologies that are necessary for the website to function, maintain security or provide features you request.
Other cookies or technologies, such as certain analytics or tracking tools, may be subject to consent requirements. I will manage these in accordance with applicable privacy and electronic communications law.
Please refer to my Cookie Policy and the cookie preferences available on my website for further information about the technologies actually in use and the choices available to you.
Free audio and email subscriptions
If you sign up for my free guided relaxation audio, I will use the information you provide to deliver the audio and manage your request.
If you separately choose to receive marketing emails from me, I will use your email address for that purpose in accordance with your consent and applicable data protection and electronic marketing laws.
You can unsubscribe from marketing emails at any time using the unsubscribe link provided or by contacting me. You can request the free audio without subscribing to marketing emails where the sign-up arrangements offer that choice.
11. AI-Assisted Tools
I may use AI-assisted software for certain administrative tasks, such as drafting general documents or preparing non-clinical materials.
I will not intentionally enter identifiable client information, therapy notes or health information into an AI system unless I have established that the processing is lawful, that the necessary special-category condition and confidentiality requirements are met, and that appropriate security, contractual and any international-transfer safeguards are in place.
Where a service provider processes personal information on my behalf, I will assess its suitability and the relevant privacy and security arrangements.
AI tools do not replace my professional judgement or responsibility for decisions about your care. I will comply with applicable requirements relating to automated decision-making.
12. Sharing Your Information
I do not sell your personal information.
I may share information where necessary and lawful with:
My clinical supervisor, subject to appropriate confidentiality safeguards.
Healthcare professionals or other people involved in your care, where appropriate and lawful.
Website, email, cloud-storage, appointment-booking and payment service providers that support my practice.
Professional advisers, insurers or regulators where access is necessary and lawful.
Relevant authorities where disclosure is required by law or justified by a safeguarding concern or other lawful reason.
Where a provider processes personal information on my behalf, I will take appropriate steps to ensure that suitable contractual and security safeguards are in place.
Some service providers may store or access information outside the United Kingdom. Where personal information is transferred internationally, I will ensure that the transfer meets applicable legal requirements and that any necessary safeguards are in place.
I will limit the information shared to what is reasonably necessary for the relevant purpose.
13. How Long I Keep Your Information
I retain personal information only for as long as necessary for the purposes for which it was collected, taking account of legal obligations, professional guidance, insurance requirements and the need to establish, exercise or defend legal claims.
My retention arrangements distinguish between different types of information:
Adult therapy records: I currently intend to retain these for up to eight years after the end of therapy, subject to confirming that this period is appropriate for my professional and insurance requirements.
Children and young people's records: these are retained in accordance with an appropriate retention schedule that takes account of the person's age, applicable professional guidance, legal requirements and the need to protect their interests.
Enquiries that do not proceed to therapy: these are retained only for an appropriate period to manage the enquiry, any follow-up and any relevant complaint or claim.
Financial and invoicing records: these are retained for the period required by applicable tax, accounting and other legal obligations.
Newsletter and marketing records: these are retained while needed to administer subscriptions and demonstrate compliance with applicable marketing requirements. Unsubscribe information may be retained where necessary to respect your decision not to receive further marketing.
When information is no longer required, I will securely delete or destroy it unless there is a lawful reason to retain it for longer.
14. Your Right to Request Erasure
You may ask me to erase your personal information.
I will assess your request in accordance with applicable data protection law. There may be circumstances where I am entitled or required to retain some information, for example where it is necessary to comply with a legal obligation or establish, exercise or defend legal claims.
Professional guidance or insurance requirements may be relevant to that assessment but do not automatically override your rights.
If I cannot fully comply with your request, I will explain the reasons, subject to any applicable legal restrictions.
15. Your Data Protection Rights
Subject to the applicable legal conditions and exceptions, you may have the right to:
Access: request a copy of the personal information I hold about you.
Rectification: ask me to correct inaccurate or incomplete information.
Erasure: ask me to delete your personal information where the legal requirements are met.
Restriction: ask me to restrict how I use your information in certain circumstances.
Object: object to certain processing, including processing based on legitimate interests.
Data portability: request certain information in a portable format where the legal requirements are met.
Withdraw consent: withdraw consent where I rely on it for processing.
Complain: raise a concern or data protection complaint with the relevant regulator or me.
These rights are not absolute and may be subject to legal conditions or exceptions.
To exercise a right, please get in touch with me using the details in Section 1. I may need to verify your identity before responding to a request.
I will respond within the applicable legal time limits.
16. How to Raise a Data Protection Complaint
If you are concerned about how I have collected, used, stored or shared your personal information, please contact me at [insert your privacy contact email] or use the complaints form on my website.
I will acknowledge your data protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.
I will consider the issues raised carefully and take appropriate action where necessary.
If you remain dissatisfied, you may complain to the relevant data protection regulator. You can find guidance through the Information Commissioner's Office website at https://ico.org.uk/.
17. Changes to This Privacy Policy
I may update this Privacy Policy from time to time to reflect changes in legislation, professional guidance, the services I provide or the systems I use.
I will publish the latest version on my website, dated with the most recent review.
If a change materially affects how I use your personal information, I will provide further information where required by law.
I am Andrea Massey, a Clinical Hypnotherapist & Psychotherapist committed to protecting your privacy and handling your personal information responsibly.
I am the Data Controller for the personal information you provide in connection with my services.
ICO Registration Number: 00010443729