Amy Jones Hypnotherapy Limited is committed to protecting your privacy and handling your personal information responsibly, transparently and securely.
This Privacy Notice explains how your personal information is collected, used, stored and protected when you enquire about or receive services from Amy Jones Hypnotherapy, or when you visit our website.
This notice complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
1. Data Controller
Amy Jones Hypnotherapy Limited is the Data Controller for the personal information collected through this practice.
Amy Jones Hypnotherapy Limited
First Floor, Unit 3 Mandale Park, Greenside Way, Middleton, Manchester, M24 1ZE
Email: hello@amyjoneshypnotherapy.com
Website: www.amyjoneshypnotherapy.com
ICO Registration Number: ZC069025
2. The Information We Collect
The information collected depends upon the services you receive.
Identity and Contact Information
This may include:
• Full name
• Date of birth
• Postal address
• Email address
• Telephone number
• Emergency contact details
• GP details where relevant and with your permission
Health Information (Special Category Data)
As a healthcare practitioner, I collect information necessary to provide safe and effective therapy.
This may include:
• Your presenting concerns
• Relevant medical history
• Current medications
• Previous therapy or treatment
• Lifestyle information relevant to therapy
• Progress towards agreed goals
• Brief clinical session notes
• CORP research data
Health information is classified as Special Category Data under UK GDPR and receives additional legal protection.
Website Information
When you visit the website we may automatically collect:
• IP address
• Browser type
• Device information
• Pages visited
• Cookie preferences
• Website usage statistics
3. How Your Information Is Used
Your information is used to:
• Respond to enquiries
• Arrange appointments
• Deliver Solution Focused Hypnotherapy safely and effectively
• Maintain accurate clinical records
• Contact you regarding appointments
• Send email newsletters
• Meet professional and legal obligations
• Improve the quality of our services
• Manage the operation of the practice
Your information is never sold to third parties.
4. Lawful Basis for Processing
Under UK GDPR we rely upon the following lawful bases.
Contract
Processing necessary to provide the therapy services you request.
Legal Obligation
Processing required to comply with legal and regulatory responsibilities.
Legitimate Interests
Managing the safe and effective operation of the practice.
Special Category Data
Health information is processed under Article 9 UK GDPR because it is necessary for the provision of health care and with your explicit consent where required.
5. Confidentiality
Everything discussed during therapy is treated as confidential.
Confidentiality will only be broken where legally required or where there is a genuine safeguarding concern, including:
• Serious risk of harm to yourself
• Serious risk of harm to another person
• Concerns relating to children or vulnerable adults
• Court orders or legal obligations
Wherever possible this will be discussed with you first.
Anonymous case discussions may take place during professional clinical supervision to ensure safe and ethical practice.
6. Sharing Your Information
Your information will only be shared where necessary.
This may include:
• Your GP or another healthcare professional, with your written consent
• Clinical supervisor using anonymised information
• Safeguarding authorities where legally required
• Police or courts where required by law
• Professional indemnity insurers where necessary
• Regulatory or professional bodies if required
7. Third-Party Service Providers
To operate the practice securely, trusted providers may process limited personal information on our behalf.
These may include:
• Acuity Scheduling, Stripe, Microsoft 365, Zoom, Mailer Lite, Website hosting provider
Each provider has appropriate contractual obligations regarding confidentiality and data security.
8. International Transfers
Where a service provider stores information outside the United Kingdom, appropriate safeguards are in place to ensure your personal information receives the same level of protection required under UK GDPR.
9. How Long We Keep Information
Clinical records are retained for:
Adults
Eight years after your final appointment.
Children
Until your twenty-fifth birthday.
If treatment finishes after your seventeenth birthday, records are retained until your twenty-sixth birthday.
Records are securely destroyed or permanently deleted during the January following the end of the applicable retention period.
Retention periods follow current professional guidance and NHS record management principles where appropriate.
10. Protecting Your Information
Appropriate technical and organisational measures are used to protect your information.
These include:
• Password-protected devices
• Encrypted digital storage
• Secure cloud services
• Two-factor authentication where available
• Locked storage for paper records
• Regular software updates
• Secure disposal of confidential documents
Only information necessary to provide your care is collected.
11. Artificial Intelligence
Amy Jones Hypnotherapy Limited does not use artificial intelligence to make decisions about your care.
Any AI technology used within the practice is limited to administrative or business support tasks and is never used to replace professional clinical judgement.
12. Cookies
The website uses cookies to improve functionality and understand website usage.
You can manage your cookie preferences through your browser settings.
A separate Cookie Policy is available on the website.
13. Your Rights
Under UK GDPR you have the right to:
• Request access to your personal information.
• Request correction of inaccurate information.
• Request erasure where legally appropriate.
• Request restriction of processing.
• Object to certain processing.
• Request data portability where applicable.
• Withdraw consent where consent is relied upon.
Some rights are subject to legal and professional obligations relating to healthcare records.
14. Subject Access Requests
You may request a copy of your personal information at any time.
Requests should be made in writing to:
hello@amyjoneshypnotherapy.com
We will normally respond within one calendar month unless legislation allows an extension.
15. Data Protection Complaints
If you have concerns about how your personal information has been handled, please contact Amy Jones Hypnotherapy Limited in the first instance.
We aim to investigate and respond to complaints promptly and in accordance with UK data protection legislation.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office.
Information Commissioner’s Office, Wycliffe, Water Lane, Wilmslow, Cheshire, SK9 5AF
www.ico.org.uk
Telephone: 0303 123 1113
16. Changes to This Privacy Notice
This Privacy Notice may be updated periodically to reflect changes in legislation, professional guidance or practice procedures.
The latest version will always be available on our website.
________________________________________
Contact
Amy Jones Hypnotherapy Limited
First Floor, Unit 3 Mandale Park, Greenside Way, Middleton, Manchester, M24 1ZE
Email: hello@amyjoneshypnotherapy.com
Website: www.amyjoneshypnotherapy.com
Last Updated: August 2026