Privacy policy
This notice explains how Central London Hypnotherapy uses the personal information you share when you contact Tim Dunton, book a consultation or attend hypnotherapy sessions. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If anything is unclear, please get in touch.
Who is responsible for your information
The data controller is Tim Dunton, a sole trader trading as Central London Hypnotherapy, trading as Central London Hypnotherapy. The practice is run by Tim Dunton, who is the person responsible for data protection.
- Address: 9 Coldbath Square, Farringdon, London EC1R 5HL
- Telephone: 07975 653893
- Contact form: contact page
What information is collected
When you contact Tim or request a consultation
- Your name, telephone number and email address
- Your preferred times to be contacted
- Anything you choose to write in your message, which may include information about your health or the reason you are seeking help
If you become a client
- Contact details and, where needed, your address and date of birth
- Appointment, booking and payment records
- Notes made during your consultation and sessions, which may include information about your physical and mental health, medication, GP details and personal circumstances
- Any messages you send between sessions
Information about your health is special category data under UK GDPR. It is given extra protection and is only collected where it is needed to provide your sessions safely and properly.
When you visit this website
When you visit this website, we count page views with Vercel Web Analytics. It sets no cookies, stores nothing on your device and doesn't identify you: it records only which page was visited, the referring website, and your rough location, device type and browser, and a temporary visitor code is discarded after 24 hours. Like all websites, the server that hosts it may also briefly record technical information such as your IP address and browser type in security logs, used only to keep the site running safely. If you choose Accept on the cookie banner, Google Analytics is also used (see Cookies below).
Why your information is used, and the legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry and arranging a free consultation | Taking steps at your request before entering into an agreement, and legitimate interests in responding to enquiries |
| Providing your hypnotherapy sessions, keeping appointment records and taking payment | Performance of our agreement with you |
| Keeping session notes, including health information | Your explicit consent (see below) |
| Keeping financial records for tax purposes | Legal obligation |
| Dealing with complaints, insurance or legal claims | Legitimate interests, and where health data is involved, establishing or defending legal claims |
Health information in plain words
Because health information is special category data, UK GDPR requires an additional condition before it can be used. Tim asks for your explicit consent to record health information as part of your consultation (UK GDPR Article 9(2)(a)). Where it applies, Tim may also rely on the condition for the provision of health or social care by someone working under a duty of confidentiality (Article 9(2)(h)).
You can withdraw your consent at any time. If you do, Tim will stop adding to your notes, but may need to keep existing records for the period set out below, and it may not be possible to continue sessions safely without them.
Confidentiality
Everything you discuss in sessions is treated as confidential. Your information is never sold or shared for marketing. It would only be shared without your agreement in rare circumstances: where there is a serious risk of harm to you or someone else, where a child or vulnerable adult may be at risk, or where the law requires it. Wherever possible, Tim would talk to you first.
Who your information is shared with
Tim uses a small number of trusted service providers to run the practice. They act on his instructions and must keep your information secure:
- Contact form: Resend (passes your message to Tim's email); email: Microsoft Outlook
- Video calls for online sessions: Microsoft Teams or Zoom
- Card payments: a secure card payment provider
- Website hosting: Vercel
- Visit counting: Vercel Web Analytics (no cookies)
- Website statistics, only with your consent: Google Analytics (Google LLC)
If any of these providers store information outside the UK, Tim will make sure appropriate safeguards are in place, such as UK adequacy regulations or approved contract terms.
How long information is kept
- Enquiries that do not lead to sessions: 12 months
- Client notes and session records: 7 years after your last session
- Financial records: 6 years, as required by HMRC
After that, records are securely deleted or destroyed.
How your information is protected
Paper notes are kept locked away and electronic records are kept on password-protected, encrypted devices and accounts. Only Tim has access to your session notes.
Your rights
Under UK data protection law you have the right to:
- Ask for a copy of the information held about you
- Ask for inaccurate information to be corrected
- Ask for your information to be deleted, where there is no good reason to keep it
- Ask for its use to be restricted, or object to its use
- Ask for information you provided to be transferred to you or someone else in a usable format
- Withdraw your consent at any time, where consent is the basis for using it
To use any of these rights, contact Tim using the details above. There is normally no charge, and you will receive a reply within one month.
Complaints
If you are unhappy with how your information has been handled, please tell Tim first so he can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Cookies
This website uses Google Analytics cookies only if you choose Accept on the cookie banner; nothing from Google loads before that. With your consent, Google Analytics sets cookies named _ga and _ga_ followed by a code, which last up to 2 years, to count visits and show which pages are most useful. Advertising features are switched off. Google LLC processes this data as our processor, and it may be transferred to the United States under the UK–US data bridge. The legal basis is your consent, which you can change at any time: use Cookie settings at the bottom of every page, and if you reject, the Google Analytics cookies are deleted. Your choice is remembered in your browser's local storage, not in a cookie. Visit counting with Vercel Web Analytics uses no cookies (see above).
Changes to this notice
This notice may be updated from time to time. The date it was last reviewed is shown on this page.