Privacy & Data Protection Policy

​

Kim Sweetland Hypnotherapy
Last updated: August 2026

​

Your privacy and confidentiality are important to me. When you contact Kim Sweetland Hypnotherapy or work with me as a client, I need to collect and use some personal information about you.

​

This policy explains what information I collect, why I need it, how it is used and protected, how long it is kept, who it may be shared with and the rights you have in relation to your personal information.

​

I handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2026 and other applicable UK data protection legislation.

​

Who is responsible for your information?

​

I, Kim Sweetland, trading as Kim Sweetland Hypnotherapy, am the Data Controller responsible for the personal information described in this policy.

​

Kim Sweetland Hypnotherapy
42 Halsdon Road
Exmouth
Devon
EX8 1SR

Email: kimsweetlandhypno@gmail.com
Telephone: 07742 254305

​

Kim Sweetland Hypnotherapy is registered with the Information Commissioner's Office (ICO).

ICO registration reference: C1385794

​

What information do I collect?

​

The information I collect depends upon how you interact with me and whether you become a client.

​

It may include:

• your name;

• your email address and telephone number;

• your date of birth;

• appointment and booking information;

• payment and transaction information;

• emergency contact details;

• GP and other relevant healthcare or care-provider details;

• information you provide when making an enquiry;

• correspondence between us by email, SMS, WhatsApp or social media;

• information provided on your intake and consent forms;

• relevant information about your circumstances, relationships, family, work, lifestyle and support network;

• information about what you would like help with;

• therapy records and session notes; and

• other information you choose to share with me in connection with your therapy.

 

I aim to collect only information that is relevant and reasonably necessary for providing and administering my services.

 

Health and other sensitive information

​

Providing safe and appropriate hypnotherapy may involve you sharing information about your physical or mental health, medical history, medication, symptoms or other sensitive aspects of your life.

​

Health information is classed as special category data under UK data protection law and receives additional protection.

Where I rely upon your explicit consent to process health or other special category information for the purpose of providing hypnotherapy, I will ask for this separately on your client consent form.

​

You can withdraw consent where consent is the legal basis I am relying upon. Withdrawing consent does not affect processing that lawfully took place before you withdrew it. Depending upon the information involved, withdrawing consent may mean that I am unable to continue providing therapy safely or appropriately.

​

How do I collect your information?

​

Most of the information I hold is provided directly by you.

​

This may happen when you:

• make a booking through my website;

• contact me using my website contact form;

• email me;

• telephone or text me;

• contact me through WhatsApp or social media;

• complete my online intake and consent form;

• complete a paper intake or consent form;

• speak to me before or during a therapy session; or

• otherwise communicate with me in connection with my services.

 

Appointments are managed through Wix Bookings. If you contact me directly to arrange an appointment, I may enter the necessary booking information into Wix Bookings on your behalf.

​

Online client intake and consent forms are provided through Jotform. Completed forms are stored within my password-protected Jotform account. I also print a copy for the client's paper record.

​

In limited circumstances, I may receive information about you from another person or organisation, for example a healthcare professional or another person you have authorised to contact me.

​

Why do I use your information?

​

I may use your personal information to:

• respond to enquiries about my services;

• arrange, confirm and manage appointments;

• provide Solution Focused Hypnotherapy safely and appropriately;

• maintain appropriate client and therapy records;

• communicate with you in connection with your appointments or therapy;

• process and record payments;

• maintain appropriate financial and business records;

• meet my legal, regulatory, insurance and professional obligations;

• maintain the security and effective operation of my business;

• respond appropriately to safeguarding or serious welfare concerns;

• establish, exercise or defend legal claims where necessary;

• deal with data protection requests or complaints; and

• send blog updates or other marketing communications where you have chosen to receive them.

​

What are my lawful bases for processing your information?

​

Data protection law requires me to have an appropriate lawful basis for using personal information. The basis I rely upon depends upon why the information is being used.

​

Contract

​

I process information where it is necessary to take steps at your request before entering into a contract or to provide the services you have agreed to receive from me.

​

This includes information needed to arrange and administer your appointments and provide the hypnotherapy service you have requested.

 

Legal obligation

​

I may process information where it is necessary to comply with a legal or regulatory obligation.

​

Legitimate interests

​

I may process personal information where this is necessary for a legitimate business or professional purpose and those interests are not overridden by your rights and interests.

​

For example, if you contact me by email, telephone, text, WhatsApp, my website or social media to ask about my services, I have a legitimate interest in using the information you have provided to respond to your enquiry.

​

My legitimate interests may also include maintaining appropriate business and client records, protecting the security of my business and systems, and establishing, exercising or defending legal claims where appropriate.

​

Where I rely upon legitimate interests, I consider why the processing is needed, whether it is necessary and proportionate and the possible impact upon the person whose information is being used.

​

Consent

​

I rely upon consent where this is the appropriate lawful basis, including where you have actively chosen to receive marketing or blog updates from me.

​

You can withdraw consent at any time.

​

Special category data

​

Health information and certain other particularly sensitive information are protected as special category data under the UK GDPR.

​

Where I rely upon consent to process special category information relevant to your hypnotherapy, I rely upon your explicit consent under Article 9(2)(a) of the UK GDPR.

​

I ask for this explicit consent separately from your acknowledgement of this privacy policy and other terms relating to your therapy.

​

There may be exceptional circumstances in which another condition under data protection law permits or requires the processing or disclosure of special category information, including certain serious safeguarding situations, protecting vital interests or establishing, exercising or defending legal claims.

​

What happens if you choose not to provide information?

​

You do not have to provide personal information simply because you make an enquiry.

​

I do, however, need certain information to provide hypnotherapy safely and appropriately. If you choose not to provide information that I reasonably need for this purpose, I may be unable to offer or continue therapy.

​

Where is your information stored?

​

Different information is stored in different ways.

​

Paper client records

​

Your intake and consent form and my handwritten therapy/session notes are kept in an individual client folder.

​

Client folders are stored in a locked filing cabinet at the clinic. When therapy finishes, the paper file is moved to my inactive-client records and remains securely stored.

​

Jotform

​

Online intake and consent forms are submitted and stored through Jotform and are accessed through my password-protected account with two-factor authentication. A paper copy is also retained within the client's secure paper record. The electronic copy provides a secure backup of essential client information in the event that the paper record is lost, damaged or destroyed.

 

Wix

​

Wix is used to host my website, receive website enquiries, manage appointments through Wix Bookings and process online deposits through Wix Payments.

​

Email

​

Client emails and website enquiries are received through my business Gmail account. Emails relating to previous clients may be moved to an inactive-client email folder.

​

Mobile communications and social media

​

Clients may contact me by SMS, WhatsApp or social media, principally Facebook. Information sent using these services may also be processed by the relevant service provider in accordance with its own privacy arrangements.

​

I am the only person with routine access to my client information and business systems.

​

Payments

​

If you book an appointment yourself through my website, a £10 deposit is taken through Wix Payments.

​

The remaining session fee may be paid by bank transfer or cash.

​

Payment providers and banks process financial information in accordance with their own legal and regulatory obligations. I retain the financial records I need for accounting, tax and business purposes.

​

I do not routinely receive or store your full debit or credit card details when an online payment is processed for me by a payment provider.

 

Who may I share information with?

​

I treat information provided during therapy as confidential and do not routinely share identifiable client information with other people.

Information may be disclosed where:

• you have asked or specifically authorised me to share it;

• I am legally required to disclose it;

• disclosure is necessary and justified in connection with a serious safeguarding or welfare concern;

• it is necessary to protect someone's vital interests;

• it is necessary for the establishment, exercise or defence of legal claims; or

• another lawful basis or legal requirement permits or requires disclosure.

 

Depending upon the circumstances, this could involve contacting an appropriate healthcare professional, your GP, an emergency service, safeguarding service or another relevant authority.

 

Any decision to disclose confidential information without your consent is considered carefully. Where disclosure is necessary, I aim to share only information that is relevant and proportionate to the situation.

 

Emergency contact information

​

I ask clients to provide an emergency contact on their intake form.

​

This information is intended for use where an unexpected practical or medical emergency occurs in connection with an appointment and it is appropriate to contact someone on your behalf.

​

Providing someone else's details as your emergency contact does not give that person routine access to information about your therapy.

 

Professional supervision

​

Professional supervision forms part of my ethical and professional practice.

​

I may discuss aspects of my client work during online professional supervision. These discussions are anonymous and I do not provide my supervisor with your written client records or other information intended to identify you.

​

Therapeutic executor

​

I have arrangements in place for a therapeutic executor to act if I become temporarily or permanently unable to manage my practice, for example through serious illness, incapacity or death.

​

My therapeutic executor is Christopher Sweetland.

​

If this arrangement ever needs to be activated, access to client information will be limited to what is reasonably necessary to protect clients' interests, contact affected clients and appropriately manage or close my professional practice and records.

​

Third-party service providers

​

I use a small number of external service providers in operating my practice. These currently include:

• Wix, for my website, website forms, bookings, payments and related website services;

• Jotform, for online client intake and consent forms;

• Google, including Gmail and Google Analytics;

• WhatsApp, where a client chooses to contact me using WhatsApp; and

• Meta/Facebook, where a client chooses to contact me through Facebook or where relevant website/social-media services are used.

 

These providers may process personal information on my behalf or as independent controllers for aspects of their services.

 

I take reasonable steps to use reputable service providers and appropriate privacy and security arrangements.

 

Information processed outside the UK

​

Some of the technology providers I use operate internationally and personal information may therefore be processed or accessed outside the UK.

​

Where a provider transfers personal information internationally, appropriate legal mechanisms and safeguards must be used as required by UK data protection law. These may include UK adequacy regulations or approved contractual safeguards.

 

Further information about international processing and the safeguards used by individual providers is available through their respective privacy information.

​

How do I protect your information?

​

I take reasonable technical and organisational measures to protect personal information against accidental loss, misuse, unauthorised access, alteration or disclosure.

​

These include:

• storing paper client records in a locked filing cabinet;

• password/PIN protection on my laptop;

• password and biometric protection on my mobile phone;

• password-protected access to relevant online systems;

• restricting routine access to client information to me;

• not sharing my passwords or PINs with other people; and

• limiting the information disclosed to third parties where disclosure is necessary.

 

My mobile phone is used for both business and personal purposes but is access-controlled and is not routinely accessible to anyone else.

Sessions are not audio or video recorded.

​

Personalised audio recordings

​

Occasionally I may create a personalised hypnotherapy or relaxation audio for a client.

 

A recording may include your first name but will not ordinarily contain your medical history, therapy records or other detailed personal information.

​

How long do I keep your information?

​

I keep client records for eight years after my last professional interaction with you, in accordance with my professional record-keeping requirements.

​

This includes the core information necessary to maintain an appropriate client record, such as intake and consent information, therapy records and relevant correspondence.

​

Some information may have a different retention period where this is appropriate. For example, financial records may need to be retained for periods required by tax or accounting law, while routine communications or duplicate information may be deleted when they are no longer reasonably necessary.

​

At the end of the relevant retention period, information is securely deleted or destroyed.

​

Your data protection rights

​

Depending upon the circumstances and the lawful basis being used, data protection law gives you a number of rights.

 

These can include the right to:

• be informed about how your personal information is used;

• access personal information I hold about you;

• ask me to correct inaccurate or incomplete information;

• ask for personal information to be erased in certain circumstances;

• ask me to restrict the way information is processed in certain circumstances;

• object to certain processing;

• receive or transfer certain information in a portable format where the right to data portability applies; and

• withdraw consent at any time where I am relying upon consent.

 

These rights do not apply in exactly the same way in every situation. There may, for example, be circumstances in which I am legally or professionally required to retain information despite a request for it to be erased.

 

I do not use solely automated decision-making to make decisions about clients that have legal or similarly significant effects.

 

Your right to object

​

You have the right to object to certain processing based upon legitimate interests. You also have an absolute right to object at any time to the use of your personal information for direct marketing.

​

If you object to direct marketing, I will stop using your personal information for that purpose.

​

Accessing your personal information

​

You have the right to ask for access to the personal information I hold about you. This is commonly known as a Subject Access Request (SAR).

​

A request can be made verbally or in writing, including by email or social media. You do not need to use a particular form or use the words “subject access request”.

​

I may need to ask for information to confirm your identity before releasing personal information.

​

I will respond without undue delay and normally within one month of receiving your request. In circumstances allowed by law, this may be extended by up to a further two months, for example where a request is complex or you have made a number of requests.

 

When responding to a subject access request, I will carry out a reasonable and proportionate search for the information covered by your request.

​

Subject access requests are normally free of charge. A reasonable fee may be charged, or a request may be refused, only where the law allows this.

​

I will take reasonable steps to provide personal information securely and in a clear and accessible form.

​

Marketing and blog updates

​

You may choose to receive blog updates and other relevant communications from Kim Sweetland Hypnotherapy.

​

Where I rely upon consent for electronic marketing, this choice is separate from agreeing to receive therapy and you are free to say no.

​

If you have opted in, you can change your mind at any time. Marketing emails will provide a way to unsubscribe, or you can contact me directly and ask me to stop sending them.

​

Choosing not to receive marketing or withdrawing marketing consent will not affect your therapy or your ability to use my services.

​

I do not sell client information or marketing lists to other organisations.

​

Data protection complaints

​

If you are concerned about the way I have collected, used, stored, disclosed or otherwise handled your personal information, you have the right to make a data protection complaint directly to me.

​

You can contact me at:

Kim Sweetland
Kim Sweetland Hypnotherapy
42 Halsdon Road
Exmouth
Devon
EX8 1SR

Email: kimsweetlandhypno@gmail.com
Telephone: 07742 254305

​

You do not need to use a particular form to complain. It will help me investigate if you explain what you believe has happened and provide any relevant information you have.

​

When I receive a data protection complaint, I will:

• acknowledge it within 30 days, unless I am able to investigate and provide an outcome within that period;

• take appropriate steps to investigate the complaint;

• make appropriate enquiries into what has happened;

• keep you appropriately informed about the progress of an ongoing investigation; and

• tell you the outcome of my investigation without unjustifiable or excessive delay, including any action I have taken or intend to take where appropriate.

 

I will keep an appropriate record of the complaint and its outcome.

​

You also have the right to raise concerns with the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

 

Cookies and website analytics

​

My website uses cookies and similar technologies. Some are necessary for the website to operate, while others may provide functionality or help me understand how visitors use the website.

​

My website currently uses Wix services and may use Wix Analytics and Google Analytics.

​

Where consent is required by law for a cookie or similar technology, you will be given an appropriate choice before that technology is used.

 

Changes to UK law allow certain limited categories of cookies to be used without consent where the relevant legal requirements are met, including some cookies used for website functionality or statistical purposes.

​

Further information about the cookies actually used on my website and the choices available to you is provided through the website's cookie notice and cookie settings.

​

Changes to this policy

​

I may update this Privacy & Data Protection Policy from time to time to reflect changes in my practice, the services and technology I use or changes to data protection law.

​

The latest version will be published on my website and will show the date it was last updated.

​

Contact me

​

If you have questions about this policy, would like to exercise a data protection right or have a concern about how your information is handled, please contact:

​

Kim Sweetland
Kim Sweetland Hypnotherapy
42 Halsdon Road
Exmouth
Devon
EX8 1SR

Email: kimsweetlandhypno@gmail.com
Telephone: 07742 254305