Privacy Policy

When you visit my website, I may collect the following information:

• Your name and email address, if you complete a contact form

• The content of any message you send via the website

• Technical data such as your browser type and IP address (collected automatically by my website platform, Wix)

I do not use tracking cookies, analytics tools, or marketing pixels. My website uses essential cookies only, which are necessary for the site to function correctly.

A full copy of the privacy notice for clients will be provided with the client agreement prior to any treatment commencing. The details are summarised in this document.

If you engage my hypnotherapy services, I will collect and process additional information including:

• Your name, contact details, and date of birth

• Information about your health, wellbeing, and the concerns you wish to address

• Session notes and records of our work together

• Payment information (processed securely and not stored by me)

This information is classified as special category data under UK GDPR because it relates to your health and mental wellbeing. I collect this data only with your explicit consent, which you will be asked to provide before we begin working together.

Website enquiries: I use the information you provide via the website contact form to respond to your enquiry and to arrange an initial consultation if appropriate. My lawful basis for this processing is legitimate interests. This information will only be used to respond to your enquiry. 

​

Therapy clients: I use your personal and health information to provide safe, appropriate, and effective hypnotherapy sessions; to maintain accurate client records; and to fulfil my professional obligations as a qualified practitioner. My lawful basis for processing special category health data is your explicit consent.

Legal compliance: I may process your data where required to comply with a legal obligation.

Website enquiry data: If you contact me but do not proceed to therapy, I will retain your enquiry details on my records for no longer than 6 months, after which they will be securely deleted.

​

Therapy client records: In line with professional guidance, I retain client records for a minimum of 8 years after the end of our work together (or, in the case of a minor, until they reach the age of 25). Records are then securely destroyed.

Website enquiries:

• My website platform (Wix) — which processes technical data as part of hosting my website, under its own privacy policy

• I do not sell, rent, or share your personal information with third parties for marketing purposes.

Therapy clients: In limited circumstances, I may share information with:

• My clinical supervisor, in an anonymised or confidential form, as required by my professional obligations.

• Emergency services or relevant authorities, only where there is a serious risk of harm to you or others, in line with my duty of care

I take the security of your personal data seriously. Secure storage is used to protect your personal information against unauthorised access. Initial consultation notes and subsequent session notes containing your sensitive information are stored as PDFs in a secure electronic folder which is protected with two factor authentication. Paper notes collected during sessions will be securely digitised and stored electronically as above and then destroyed. Up to the point of digitalisation, they will be locked in a secure filing cabinet.

Please be aware that email and online contact forms are not entirely secure methods of communication. If you have concerns, please contact me by phone to discuss.

Note: online sessions are held over Zoom or Teams, no recordings or transcripts will be made from sessions. Session notes will be taken by hand. 

• Your right of access

You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access

• Your right to rectification

You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.

• Your right to erasure

You have the right to ask us to delete your personal information. Read more about the right to erasure

• Your right to restriction of processing

You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.

• Your right to object to processing

You have the right to object to the processing of your personal data. Read more about the right to object to processing

• Your right to data portability

You have the right to ask that we transfer the personal information you gave us to another organization, or to you. Read more about the right to data portability.

• Your right to withdraw consent

When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay, and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

All hypnotherapy services provided under this agreement are delivered within the United Kingdom. These Terms and Conditions are governed by and construed in accordance with the laws of England and Wales.

​I may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. I encourage you to review this policy periodically.

If you have any questions about this Privacy Policy or how I handle your data, please contact me:

Email: caramhypno@gmail.com

Website: www.caramarshallhypnotherapy.co.uk

Telephone: 0776 773 8197

Business name: Cara Marshall Hypnotherapy Ltd

Where we get personal information from: Directly from you

Our lawful bases for collecting or using personal information to provide services, for legal requirements, for dealing with queries, complaints or claims are:

• Contract: we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

• Consent from yourself: We have permission from you after you have all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Recognised legitimate interests: our purpose for collecting or using personal information to provide services for clients are that we need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’), We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

•  Consent: we have permission from you after we give you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: cmarshallhypnotherapy@gmail.com

Telephone: 0776 773 8197

​

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. 

​

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

​

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint