Hypnotherapy privacy policy

Calming Path Therapy

1. WHO I AM

Calming Path Therapy is operated by Duane Barrington Fowler, a sole trader. I am the data controller responsible for deciding how and why your personal information is used.

Email: duane@calmingpaththerapy.co.uk. Correspondence address: 111 Waltham Road, Carshalton, SM5 1PS

This Privacy Notice explains how I collect, use, store, and share personal information relating to website visitors, people making inquiries, and clients using my services.

2. INFORMATION I MAY COLLECT

Depending on your contact with Calming Path Therapy, I may collect the following:

• your name, email address, telephone number, and correspondence address;

• your country or general location, particularly for online appointments;

• booking information, appointment dates, service selections, and attendance records;

• information required to arrange a home visit;

• payment, invoice, refund, and transaction information;

• messages, emails, and other administrative communications;

• accessibility or communication requirements you choose to provide;

• information about your reasons for seeking support, goals, relevant history, health, medication, and well-being;

• consent records, therapeutic agreements, and case notes;

• safeguarding, risk, referral, or significant-event information where necessary;

• complaints, feedback, and related correspondence; and

• technical information generated when you use the website, such as IP address, device information, and cookie preferences.

Health and well-being information is “special category data” and receives additional protection under data protection law.

I do not normally receive or retain your complete payment card details. Card payments are processed by Wix Payments and its authorised financial partners.

3. HOW INFORMATION IS COLLECTED

Information is normally collected directly from you when you:

• visit the website;

• complete a contact or booking form;

• create an account;

• book, cancel, or rearrange an appointment;

• make a payment;

• communicate by telephone, email, or another agreed method; or

• participate in an initial conversation, consultation, or hypnotherapy session.

In limited circumstances, information may be received from another person or organisation, such as a referrer, healthcare professional, emergency contact, safeguarding authority, or payment provider.

This will only be used where there is an appropriate reason and lawful basis.

4. WHY I USE YOUR INFORMATION

I may use personal information to:

• respond to inquiries and provide information about services; •

assess whether a requested service is appropriate and within my professional competence;

• arrange, confirm, and manage appointments; • provide hypnotherapy and maintain appropriate professional records; • process payments, refunds, invoices, and receipts

• communicate administrative information and appointment reminders;

• manage packages and booking history;

• maintain safety, professional standards, and safeguarding responsibilities;

• obtain professional supervision, using anonymised or minimised information wherever reasonably possible;

• respond to complaints, legal claims, or regulatory inquiries;

• maintain accounting, tax, and business records;

• protect the security and proper operation of the website and booking system; and

• Send marketing communications only where you have chosen to receive them.

I will not sell your personal information.

5. LAWFUL BASES

Under the UK GDPR, I rely on one or more of the following lawful bases:

Contract and steps before entering a contract: To respond to a request, arrange appointments, provide agreed services, and manage payment.

Legal obligation: To meet tax, accounting, safeguarding, regulatory, or other legal requirements.

Legitimate interests: To operate and protect the practice, maintain appropriate professional records, manage complaints, establish or defend legal claims, and improve administrative services. When relying on legitimate interests, I consider whether the use is necessary, proportionate, and balanced against your rights and expectations.

Consent: For optional marketing, non-essential cookies, and other processing where consent is the appropriate lawful basis. Consent can be withdrawn at any time.

6. SPECIAL CATEGORY INFORMATION

Where I process information concerning your physical or mental health, medication, wellbeing or therapeutic history, I must identify both an Article 6 lawful basis and an additional condition under Article 9 of the UK GDPR.

I will normally rely on your explicit consent to process special category information for the purpose of considering suitability and providing hypnotherapy. In limited circumstances, information may also be processed where necessary to protect vital interests when a person cannot give consent, or for the establishment, exercise or defence of legal claims.

You may withdraw consent by contacting me. Withdrawal does not affect processing that took place lawfully before consent was withdrawn. It may not always require the deletion of information that must be retained under another lawful basis or special-category condition. If essential information can no longer be processed, I may be unable to continue providing the service.

7. CONFIDENTIALITY AND SHARING

Information shared during therapeutic work is treated confidentially. Confidentiality is not absolute, and information may be disclosed where:

• you have requested or authorised the disclosure;

• It is necessary to address a serious concern about your safety or another person’s safety;

• Safeguarding action is required;

• Disclosure is required by law, a court order, or an appropriate legal authority;

• Information is required for a complaint, insurance matter, or legal claim; or

• Appropriately minimised information is discussed through professional supervision.

Where reasonably possible and appropriate, I will discuss a proposed disclosure with you before it is made.

Information may also be processed or received by trusted service providers supporting the practice, including:

• Wix, Wix Bookings, and Wix Payments;

• payment processors, card networks, and financial institutions;

• Google services used for business email, calendar, or online meetings;

• the practice’s bank and accounting or bookkeeping providers;

• secure record-storage or practice-management providers;

• professional supervisors;

• insurers, legal advisers, or professional bodies; and

• regulators, safeguarding bodies, emergency services, or public authorities where necessary and lawful.

These recipients receive only the information reasonably necessary for their role. Service providers acting as processors are expected to handle information under appropriate contractual and security obligations.

Clinical information will not be included in invoices, receipts, or ordinary calendar titles unless necessary.

8. WIX, PAYMENTS, AND ONLINE SERVICES

The website, booking system, and checkout are provided through Wix. Wix and its payment partners process information needed to manage bookings, prevent fraud, accept payments, and provide receipts or refunds.

Online appointments are currently provided using Google Meet. Information processed through these services is also subject to the providers’ applicable privacy information and contractual terms.

Please avoid including medical history, diagnoses, trauma details, or other sensitive information in ordinary website message fields or unsecured email unless specifically requested through an appropriate process.

9. INTERNATIONAL TRANSFERS

Some technology and payment providers may process information in, or allow access from, countries outside the United Kingdom.

Where a restricted international transfer occurs, I will take reasonable steps to ensure that it is covered by a lawful transfer mechanism, such as UK adequacy regulations or appropriate contractual safeguards. Further information about applicable safeguards may be requested using the contact details above.

10. HOW LONG INFORMATION IS RETAINED

Information is retained only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, tax, insurance, and professional requirements.

Unless a different period is justified:

• Enquiries that do not lead to therapeutic work will normally be retained for up to 12 months after the last meaningful contact;

• booking, payment, invoice and accounting records will normally be retained for six years after the relevant financial period;

• Client agreements, consent records, and relevant therapeutic case records will normally be retained securely for seven years after our work together ends. This period supports continuity of care and enables me to respond to complaints or establish, exercise, or defend possible legal or insurance claims.

• Complaint, safeguarding, or legal-claim information may be retained for longer where reasonably necessary;

• Marketing information will be retained until you unsubscribe or the information is no longer required; and

• Cookies and technical information will be retained according to the applicable cookie or service-provider settings.

Retention periods will be reviewed regularly. Information will be securely deleted, anonymised or destroyed when it is no longer required. A legal or regulatory requirement, active complaint, safeguarding concern, anticipated legal claim or specific instruction from my insurer may justify retaining relevant information for longer.

11. SECURITY

Reasonable technical and organisational measures are used to protect information from accidental loss, misuse, unauthorised access, alteration, or disclosure. These include access controls, password protection, two-step verification where available, secure storage, and limiting access to those who genuinely require it.

Client records are kept separately from general website content wherever reasonably practicable. Website booking forms are not used as a substitute for detailed clinical records.

No internet or storage system can be guaranteed completely secure. Any suspected personal data breach will be assessed and reported to the Information Commissioner’s Office and affected individuals where required by law.

12. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances and lawful basis, you may have the right to:

• be informed about how your information is used;

• request access to your personal information;

• ask for inaccurate or incomplete information to be corrected;

• request erasure of information in certain circumstances;

• request restriction of processing in certain circumstances;

• object to particular uses of your information;

• receive certain information in a portable format;

• withdraw consent where processing relies upon consent; and

• complain to the Information Commissioner’s Office.

These rights are not absolute, and a request may be limited where another lawful reason requires or permits information to be retained.

YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE USE OF YOUR PERSONAL INFORMATION FOR DIRECT MARKETING.

To exercise a right, contact duane@calmingpaththerapy.co.uk. I may need to confirm your identity before releasing or changing information. Requests will normally be answered within one month, subject to any lawful extension.

1. MARKETING

You will not be added to an email or SMS marketing list merely because you make an inquiry or book an appointment.

Marketing communications will only be sent where you have actively chosen to receive them or another lawful basis clearly applies. You can unsubscribe at any time using the link in the message or by contacting me.

Administrative communications concerning an appointment, payment, policy, or service are not marketing messages.

2. COOKIES

The website may use essential cookies required for security, bookings, checkout, and basic operation. Non-essential analytics or marketing cookies will only be used in accordance with your cookie choices.

Further information will be provided through the website’s Cookie Policy and cookie-preference controls.

3. AUTOMATED DECISION-MAKING

Calming Path Therapy does not currently use solely automated decision-making that produces legal or similarly significant effects concerning clients.

Payment and technology providers may use automated systems for fraud prevention and account security under their own responsibilities and privacy information.

4. LINKS TO OTHER WEBSITES

The website may contain links to external websites. Calming Path Therapy is not responsible for the privacy practices or content of external sites. You should review their privacy information before providing personal information.

5. CHANGES TO THIS NOTICE

This Privacy Notice may be updated to reflect changes in the practice, technology, professional requirements, or data-protection law. The latest version and revision date will be published on the website. Material changes will be communicated where appropriate.

6. QUESTIONS AND COMPLAINTS

If you have a question or concern about how your information is handled, please contact:

Duane Barrington Fowler Calming Path Therapy Email: duane@calmingpaththerapy.co.uk Address: 111 Waltham Road, Carshalton, SM5 1PS

You also have the right to complain to the Information Commissioner’s Office:

Website: https://ico.org.uk/make-a-complaint/ Telephone: 0303 123 1113

I would appreciate the opportunity to address your concern first, but you are not required to contact me before approaching the ICO.