top of page

Privacy Policy

Flourish Hypnotherapy Privacy Policy


Denise Tait | Hypnotherapist
Last updated: September 2026

​

At Flourish Hypnotherapy, your privacy, confidentiality and the security of your personal information are taken seriously.

​

This Privacy Policy explains what information I collect, why I collect it, how it is used and stored, how long it may be retained, when it may be shared and your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and subsequent amendments.

Who I am

I am Denise Tait, owner and practitioner at Flourish Hypnotherapy.

I trained in Solution Focused Hypnotherapy with the Rachel Farnborough School of Hypnotherapy and am a member of SFTA – Solution Focused Training Academy.

For the purposes of UK data protection legislation, I am the Data Controller for personal information processed within my practice.

​

Practice: Flourish Hypnotherapy
Practitioner: Denise Tait
Website: flourishhypnotherapy.co.uk
Email: denise@flourishhypnotherapy.co.uk
Telephone: 07554 118457

I am registered with the Information Commissioner's Office (ICO).

​

Information I may collect

When you contact me or become a client, I may collect information including:

  • your name and contact details;

  • your date of birth;

  • appointment information;

  • information provided during your initial consultation;

  • your reason for seeking hypnotherapy;

  • relevant personal and family circumstances;

  • relevant medical history and medication;

  • information relating to your physical or emotional wellbeing;

  • details of previous therapy or treatment where relevant;

  • lifestyle information where relevant to therapy;

  • brief clinical and session notes;

  • information concerning your progress;

  • GP details where appropriate;

  • emergency contact information;

  • communications between us; and

  • payment and transaction information.

  • ​

I aim to collect only the information reasonably necessary to provide safe and appropriate hypnotherapy and meet my professional responsibilities.

Why I process your information

Where personal information is required to arrange and provide the hypnotherapy services you have requested, I will normally process it under Article 6(1)(b) of UK GDPR – Contract.

​

This allows me to process information necessary to take steps at your request before entering into a therapeutic agreement and to provide the hypnotherapy services you have agreed to receive.

​

Other lawful bases may apply in certain circumstances, for example where processing is required to meet a legal obligation or for the legitimate administration and protection of my practice.

Health information & other sensitive information

During your initial consultation and therapy you may provide information about your physical or mental health, medical history, medication or other sensitive matters.

​

Health information is classed as special category personal data and receives additional protection under UK GDPR.

​

Where appropriate, I rely upon Article 9(2)(a) – Explicit Consent for the routine processing of relevant health and other special category information needed to provide hypnotherapy.

​

You will be asked to give explicit consent to this as part of the consultation and consent process.

​

You may withdraw consent to future processing that relies upon your consent at any time. This does not affect processing that was lawful before consent was withdrawn.

​

If you withdraw consent to the processing of information necessary for me to provide hypnotherapy safely and appropriately, I may no longer be able to continue working with you.

​

How I use your information

 

Your information may be used to:

  • respond to an enquiry;

  • arrange and manage appointments;

  • assess whether hypnotherapy is appropriate for you;

  • provide hypnotherapy;

  • maintain appropriate clinical records;

  • monitor your progress;

  • communicate with you about appointments or therapy;

  • provide relevant therapeutic resources or recordings;

  • process payments;

  • maintain appropriate financial records;

  • meet professional and insurance requirements;

  • fulfil safeguarding responsibilities;

  • comply with legal obligations; and

  • establish, exercise or defend legal claims where necessary.

  • ​

Your information will not be used for an unrelated purpose without an appropriate lawful basis.

​

Clinical records

 

I maintain appropriate records of my clinical work.

​

These may include contact information, relevant case history, consent to therapy, relevant health information, the reason for seeking hypnotherapy, brief session notes and relevant correspondence.

​

I follow the principle of data minimisation. This means my notes are not intended to provide a detailed account of everything discussed during therapy. I record information that is reasonably necessary to maintain an appropriate professional and clinical record.

​

How long I keep your information

 

Clinical records are retained securely in accordance with the requirements of my professional body and professional indemnity insurer.

​

For adult clients, clinical records will normally be retained for 8 years following the last interaction with the client, unless a different retention period is required by law, my professional body or my professional indemnity insurer.

​

Different retention periods may apply to records relating to children and young people.

​

Financial and accounting information may also be retained for the period required by tax and financial legislation.

​

At the end of the appropriate retention period, information will be securely destroyed or deleted unless there is a legitimate or legal reason for retaining it for longer.

​

How your information is kept secure

I take reasonable and proportionate steps to protect your personal and clinical information from loss, unauthorised access, disclosure, alteration or destruction.

Measures may include:

​

  • password-protected devices;

  • device locking and appropriate access controls;

  • secure electronic storage;

  • encryption where appropriate;

  • up-to-date software and security;

  • secure backups;

  • secure storage of any paper records; and

  • secure deletion or destruction of information when it is no longer required.

​

Access to client information is limited to what is necessary for the running of my practice.

​

Appropriate arrangements will also be made for the protection of clinical records should I retire, cease practising, become incapacitated or die.

​

Confidentiality

 

Information discussed during therapy will normally remain confidential.

There are, however, circumstances in which confidentiality cannot be absolute.

Information may need to be shared where:

​

  • you have given permission;

  • disclosure is required by law;

  • there is an appropriate safeguarding concern;

  • a child or vulnerable person may be at risk;

  • there is a serious risk of harm;

  • disclosure is necessary for the establishment, exercise or defence of legal claims; or

  • another lawful basis permits or requires disclosure.

  • ​

Where disclosure is necessary, I will aim to share only information that is relevant and proportionate.

​

Where it is appropriate and safe to do so, I would normally discuss this with you.

Safeguarding

 

I have professional responsibilities in relation to safeguarding and child protection.

​

Where information gives rise to a safeguarding concern, it may be necessary to share relevant information with an appropriate safeguarding organisation, local authority, police, healthcare professional or other appropriate organisation.

​

Where a statutory reporting duty applies, I will comply with that duty.

​

Professional supervision

 

Professional supervision is an important part of safe and ethical therapeutic practice.

​

My clinical work may therefore be discussed with my professional supervisor.

Wherever reasonably possible, information that could identify an individual client will be removed or minimised. Only information reasonably necessary for effective professional supervision will be discussed.

​

Your GP and other healthcare professionals

 

There may occasionally be circumstances in which communication with your GP or another healthcare professional is appropriate.

 

Where possible, I will seek your permission before contacting another healthcare professional.

 

There may be exceptional circumstances in which information has to be shared without consent, for example where required by law or where there is an appropriate safeguarding or serious safety concern.

​

Email, telephone and messaging

I may communicate with you by:

  • telephone;

  • email;

  • SMS/text; and

  • WhatsApp.

  • ​

I aim to minimise the amount of sensitive clinical information included in routine electronic communications.

​

Electronic communication carries some degree of privacy and security risk, so please avoid sending unnecessary sensitive or confidential information by email, text or messaging services.

Online hypnotherapy​

Where hypnotherapy is provided online, sessions may take place using Google Meet or Zoom.

​

Online therapy sessions are not routinely recorded.

​

If there were a genuine reason for recording a session, this would be discussed with you beforehand, including why it was being recorded, how it would be stored, who would have access to it and when it would be deleted.

​

Hypnotherapy recordings

As part of therapy, I may provide hypnosis, relaxation or other therapeutic audio recordings.

​

General recordings that do not contain identifiable information about you are not normally treated as part of your clinical record.

​

If an individual recording is created specifically for you and contains identifiable personal information, it will be treated as personal information and protected accordingly.

Payments

Payment information will only be processed where necessary to administer appointments, receive payment and maintain appropriate financial records.

I accept payment by Bank Transfer / Stripe / PayPal or Cash.

 

Where an external payment provider is used, that organisation processes information in accordance with its own privacy and data-protection responsibilities.

​

I do not routinely retain full credit or debit card details.

Organisations and services I use

I may use third-party services to help operate Flourish Hypnotherapy.

These may include:

Email: Gmail or Proton Mail.
Appointment booking: Wix Bookings
Payment processing: Wix Payments, Stripe or PayPal
Video consultations: Google or Zoom
Website hosting: Wix 
Clinical records/storage: Password protected files in Google and a locked filing cabinet.
 

Where another organisation processes personal information on my behalf, I take reasonable steps to ensure appropriate data-protection arrangements are in place.

​

Some technology providers may process or store information outside the United Kingdom. Where this occurs, I take reasonable steps to ensure that transfers comply with UK data-protection requirements and appropriate safeguards are in place.

​

Artificial intelligence

I do not routinely enter identifiable clinical records or identifiable sensitive client information into general-purpose artificial intelligence systems.

​

If I were to use an AI, transcription or automated service that processed identifiable personal or clinical information, I would first consider its necessity, lawful basis, security, confidentiality and data-protection implications.

​

Removing a person's name does not necessarily make information anonymous if other information could identify them.

Marketing

Receiving hypnotherapy from Flourish Hypnotherapy does not automatically add you to a marketing list.

​

If I offer newsletters, supportive updates or other marketing communications, consent to receive these will be separate from consent to therapy.

​

You may withdraw consent to marketing at any time.

​

Withdrawing from marketing will not affect communications that are necessary in relation to your appointments or therapy.

Testimonials

Testimonials, photographs or client stories will not be published simply because somebody has received hypnotherapy from me.

​

I will obtain specific permission before using an identifiable client testimonial.

Additional consent will be obtained before publishing a client's name, photograph or other identifying information, and particular care will be taken where a testimonial reveals information about health or treatment.

Website enquiries

If you contact me through the Flourish Hypnotherapy website, the information you provide will be used to respond to your enquiry and, where appropriate, arrange an appointment.

​

Making an enquiry does not automatically add you to a marketing list.

Information from enquiries that do not result in a therapeutic relationship will not be retained indefinitely without an appropriate reason.

Website and cookies

The Flourish Hypnotherapy website may use cookies and similar technologies to provide website functionality, maintain security and understand how visitors use the website.

​

Where consent is required for cookies or similar technologies, an appropriate consent mechanism will be provided.

​

Further information about cookies used by the website will be made available where appropriate.

Data breaches

If a personal-data breach occurs, I will take appropriate steps to contain and investigate it, assess any potential risk and document the incident and the action taken.

​

Where required by law, the Information Commissioner's Office and/or affected individuals will be notified within the required timescale.

Your data-protection rights

Depending on the circumstances, you may have rights including:

  • the right to be informed about how your information is used;

  • the right to access personal information held about you;

  • the right to have inaccurate information corrected;

  • the right to request erasure in certain circumstances;

  • the right to restrict processing in certain circumstances;

  • the right to object to certain processing;

  • the right to data portability where applicable; and

  • rights relating to certain forms of automated decision-making.

  • ​

Not every right applies in every circumstance.

​

If you wish to exercise a data-protection right, please contact:

Denise Tait
Flourish Hypnotherapy
Email: denise@flourishhypnotherapy.co.uk
Telephone: 07554 118457

Accessing your information

You have the right to ask for access to personal information I hold about you. This is known as a Subject Access Request (SAR).

​

Requests may be made verbally or in writing.

​

I may ask for information reasonably necessary to confirm your identity or clarify the information you are requesting.

​

Requests will normally be dealt with without undue delay and within one month, subject to any provisions or permitted extensions under current data-protection legislation.

​

Information relating to another person may need to be redacted or withheld where appropriate.

Complaints

If you are unhappy with the way Flourish Hypnotherapy has collected, used, stored or otherwise handled your personal information, please contact me in the first instance:

​

Denise Tait
Flourish Hypnotherapy
Email: denise@flourishhypnotherapy.co.uk
Telephone: 07554118457

​

I will take reasonable steps to investigate your concern and keep you informed of the outcome.

​

If you remain dissatisfied, you have the right to raise your concern with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

​

Changes to this Privacy Policy

 

This Privacy Policy will be reviewed periodically and whenever there is a significant change to data-protection legislation, professional requirements, the technology I use or the way I provide my services.

​

The current version of this policy will be available at:

flourishhypnotherapy.co.uk

Last reviewed: September 2026

bottom of page