Privacy policy
This notice explains how Hypnotherapy.London uses the personal information you share when you contact Tim Dunton, book a consultation, attend sessions, or arrange work on behalf of an organisation. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If anything is unclear, please get in touch.
Who is responsible for your information
The data controller is Tim Dunton, a sole trader trading as Hypnotherapy.London. Tim is the person responsible for data protection.
- Address: 9 Coldbath Square, Farringdon, London EC1R 5HL
- Telephone: 07923 495558
- Contact: contact page
What information is collected
When you get in touch or book a consultation
- Your name, telephone number and email address
- Your preferred times to be contacted
- Anything you choose to tell Tim, which may include information about your health or the reason you are seeking help
If you become a client
- Contact details and, where needed, your address
- Appointment, booking and payment records
- Notes made during your consultation and sessions, which may include information about your physical and mental health and personal circumstances
- Any messages you send between sessions
Information about your health is special category data under UK GDPR. It is given extra protection and is only collected where it is needed to provide your sessions safely and properly.
Organisations and their staff
- Names, job titles and business contact details of the people who arrange or manage an engagement
- Contract, purchase order and invoicing details
- Names of participants and attendance records for workshops and programmes
Where an organisation funds one-to-one sessions for a member of staff, what is discussed in those sessions stays confidential between Tim and the participant. The organisation is told only what has been agreed in advance, such as attendance and invoicing, unless the participant asks for more to be shared.
When you visit this website
When you visit this website, we count page views with Vercel Web Analytics. It sets no cookies, stores nothing on your device and doesn't identify you: it records only which page was visited, the referring website, and your rough location, device type and browser, and a temporary visitor code is discarded after 24 hours. Like all websites, the server that hosts it may also briefly record technical information such as your IP address and browser type in security logs, used only to keep the site running safely.
Why your information is used, and the legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry and arranging a free consultation | Taking steps at your request before entering into an agreement, and legitimate interests in responding to enquiries |
| Providing sessions, keeping appointment records and taking payment | Performance of our agreement with you |
| Agreeing, delivering and invoicing work for organisations | Performance of our contract with the organisation, and legitimate interests in managing business relationships |
| Keeping session notes, including health information | Your explicit consent (see below) |
| Keeping financial records for tax purposes | Legal obligation |
| Dealing with complaints, insurance or legal claims | Legitimate interests, and where health data is involved, establishing or defending legal claims |
Health information
Because health information is special category data, UK GDPR requires an additional condition before it can be used. Tim asks for your explicit consent to record any health information (UK GDPR Article 9(2)(a)). You can withdraw your consent at any time. If you do, Tim will stop adding to your notes, but may need to keep existing records for the period set out below.
Confidentiality
Everything you discuss in sessions is treated as confidential. Your information is never sold or shared for marketing. It would only be shared without your agreement in rare circumstances: where there is a serious risk of harm to you or someone else, where a child or vulnerable adult may be at risk, or where the law requires it. Wherever possible, Tim would talk to you first.
Who your information is shared with
Tim uses a small number of trusted service providers to run the practice. They act on his instructions and must keep your information secure:
- Contact form and email: Resend (passes your message to Tim's email) and Microsoft Outlook
- Video calls for online sessions: Microsoft Teams or Zoom
- Card payments: a secure card payment provider
- Accounting and invoicing: an accounting software provider
- Website hosting: Vercel
- Visit counting: Vercel Web Analytics (no cookies)
- Video: Vimeo, only if you press play on a video (the player loads in Vimeo's do-not-track mode)
If any of these providers store information outside the UK, Tim will make sure appropriate safeguards are in place, such as UK adequacy regulations or approved contract terms.
How long information is kept
- Enquiries that do not lead to sessions: 12 months
- Client notes and session records: 7 years after your last session
- Contracts, invoices and financial records: 6 years, as required by HMRC
After that, records are securely deleted or destroyed.
How your information is protected
Paper notes are kept locked away and electronic records are kept on password-protected, encrypted devices and accounts. Only Tim has access to session notes.
Your rights
Under UK data protection law you have the right to:
- Ask for a copy of the information held about you
- Ask for inaccurate information to be corrected
- Ask for your information to be deleted, where there is no good reason to keep it
- Ask for its use to be restricted, or object to its use
- Ask for information you provided to be transferred to you or someone else in a usable format
- Withdraw your consent at any time, where consent is the basis for using it
To use any of these rights, contact Tim using the details above. There is normally no charge, and you will receive a reply within one month.
Complaints
If you are unhappy with how your information has been handled, please tell Tim first so he can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
Cookies
This website sets no cookies and uses no advertising or tracking tools, so there is no cookie banner. Videos load from Vimeo only when you press play, in Vimeo's do-not-track mode. Visits are counted with Vercel Web Analytics, which uses no cookies (see above). If this changes, this notice will be updated and your consent will be asked for before any non-essential cookies are used.
Changes to this notice
This notice may be updated from time to time. The date it was last reviewed is shown on this page.