Oakwood Hypnotherapy Clinic – Privacy Policy
Last updated: August 2026

At Oakwood Hypnotherapy Clinic, your privacy, confidentiality and the security of your personal information are taken seriously. This Privacy Policy explains what information I collect, why I collect it, how it is used and stored, how long it is retained, when it may be shared and your rights under current UK data protection legislation.

This policy reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and amendments introduced by the Data (Use and Access) Act 2025.

1. Who I am

I am Vicky Chew, trading as Oakwood Hypnotherapy Clinic. For the purposes of UK data protection legislation, I am the Data Controller for personal information processed within my practice.

Practice: Oakwood Hypnotherapy Clinic
Practitioner: Vicky Chew
Email:hello@oakwoodhypnotherapy.co.uk
Website: www.oakwoodhypnotherapy.co.uk
WhatsApp: Available through the contact button on the Oakwood Hypnotherapy Clinic website
ICO registration: Oakwood Hypnotherapy Clinic is registered with the Information Commissioner's Office (ICO)
Professional insurance: Balens

I practise within the professional, ethical, supervisory and insurance requirements that apply to my hypnotherapy practice.

2. What information I collect

When you contact me or become a client, I may collect and process information including:

  • your name, address and contact details;

  • your date of birth;

  • appointment information;

  • information provided during your initial consultation;

  • your reason for seeking hypnotherapy;

  • relevant personal and family circumstances;

  • relevant medical history and medication where this is clinically relevant;

  • information concerning your physical or mental health;

  • previous therapy or treatment where relevant;

  • lifestyle information where clinically relevant;

  • brief clinical and session notes;

  • information concerning your progress;

  • GP details where appropriate;

  • emergency contact information where appropriate;

  • communications between us; and

  • payment and transaction information.

I aim to collect only information that is relevant and reasonably necessary to provide safe and appropriate hypnotherapy and to meet my professional responsibilities.

3. Lawful basis for processing your information

Where information is necessary to respond to your enquiry, arrange appointments and provide the hypnotherapy services you have requested, I will normally rely on Article 6(1)(b) UK GDPR – Contract.

This allows me to process personal information where it is necessary to take steps at your request before entering into a therapeutic agreement and to provide the services you have agreed to receive.

There may be circumstances in which another lawful basis applies, including compliance with a legal obligation or legitimate interests relating to the appropriate administration, protection and operation of my practice.

4. Health information and special category data

During your initial consultation and therapy, you may provide information concerning your physical or mental health, medical history, medication and other sensitive matters.

Health information is classed as special category personal data under UK GDPR and receives additional protection.

For the routine processing of relevant health and other special category information for the purpose of providing hypnotherapy, I rely on Article 9(2)(a) UK GDPR – Explicit Consent.

I will ask you to provide explicit consent as part of the initial consultation and consent process.

You may withdraw consent to future processing that relies on your consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

If you withdraw consent to processing information that is necessary for me to provide hypnotherapy safely and appropriately, I may no longer be able to continue providing therapy.

There may also be circumstances where another legal condition permits or requires processing, including certain safeguarding situations or the establishment, exercise or defence of legal claims.

5. Why I use your information

Your information may be used to:

  • respond to your enquiry;

  • arrange and manage appointments;

  • assess whether hypnotherapy is appropriate;

  • provide hypnotherapy;

  • maintain appropriate clinical records;

  • monitor your progress;

  • communicate with you about appointments or therapy;

  • provide appropriate therapeutic resources;

  • process payments and maintain appropriate financial records;

  • meet professional, supervisory and insurance requirements;

  • fulfil safeguarding responsibilities;

  • comply with legal obligations; and

  • establish, exercise or defend legal claims where necessary.

Your information will not be used for an unrelated purpose without an appropriate lawful basis.

6. Clinical records

I maintain appropriate records of my clinical work. These may include personal and contact information, relevant case history, consent to therapy, relevant medical and health information, the reason for seeking hypnotherapy, brief session records, relevant advice provided and relevant correspondence.

Clinical records are intended to be accurate, relevant and proportionate.

I follow the principle of data minimisation. I do not aim to create a detailed account of everything discussed during therapy, only information reasonably necessary to maintain an appropriate professional and clinical record.

7. How long I keep records

For adult clients, clinical records will normally be retained securely for eight years following the last interaction with the client, in line with the retention arrangements adopted for my practice and my insurance requirements.

Different retention periods may apply where required by law, an insurer or another applicable professional requirement.

Financial and accounting information may also be retained for the period required by tax and financial legislation.

At the end of the appropriate retention period, information will be securely destroyed or deleted unless there is a legitimate reason for retaining it for longer.

8. Security and storage of information

I take reasonable and proportionate measures to protect personal and clinical information from accidental loss, unauthorised access, disclosure, alteration or destruction.

Access to client information is limited to what is necessary for the safe and effective running of the practice.

Electronic systems and devices used for the practice are protected using appropriate security measures, including password protection, access controls, device locking, software and security updates and secure deletion where appropriate.

Any paper records are kept securely and disposed of confidentially when no longer required.

Appropriate arrangements will also be made for the future protection of clinical records should I retire, cease practising, become incapacitated or die.

9. Confidentiality

Information discussed during therapy will normally remain confidential. However, confidentiality is not absolute.

Information may need to be shared where:

  • you have given permission;

  • disclosure is required by law;

  • there is an appropriate safeguarding concern;

  • a child or vulnerable person may be at risk;

  • there is a serious risk of harm;

  • disclosure is necessary for the establishment, exercise or defence of legal claims; or

  • another lawful basis permits or requires disclosure.

Where disclosure is necessary, I will aim to disclose only information that is relevant and proportionate. Where it is appropriate and safe to do so, I will normally discuss this with you.

10. Safeguarding

I have professional responsibilities in relation to safeguarding. Where information gives rise to a safeguarding concern, information may need to be shared with an appropriate safeguarding organisation, local authority, police, healthcare professional or other appropriate body. Where a statutory reporting duty applies, I will comply with that duty.

11. Professional supervision

Professional supervision is an important part of safe and ethical clinical practice. My clinical work may therefore be discussed with my professional supervisor. Wherever reasonably possible, identifying information is removed or minimised, and only information reasonably necessary for effective supervision is discussed.

12. GP and other healthcare professionals

There may be circumstances where communication with your GP or another healthcare professional is appropriate. Where possible, I will seek your permission before making contact. There may be exceptional circumstances where information needs to be shared without consent, for example where required by law or where there is an appropriate safeguarding or serious safety concern.

13. Email, telephone, text and WhatsApp

I may communicate with you by telephone, email, SMS/text and WhatsApp. I aim to minimise sensitive clinical information contained in routine electronic communications. Electronic communication carries some degree of privacy and security risk, so you should avoid sending unnecessary sensitive information by email, text or messaging services. The Oakwood Hypnotherapy Clinic website provides a direct WhatsApp contact button for enquiries. Information sent through WhatsApp is also subject to WhatsApp's own privacy and security arrangements.

14. Online hypnotherapy

Where therapy is provided online, I use Microsoft Teams or Zoom, depending on client preference. Online therapy sessions are not routinely recorded. If there were a genuine reason for recording a session, this would be discussed with you in advance, including the purpose of the recording, how it would be stored, who would have access and when it would be deleted.

15. Hypnotherapy recordings

As part of therapy, I may provide hypnosis, relaxation or other therapeutic audio recordings. General recordings that do not contain identifiable information about you are not normally part of your clinical record. Where a recording is individually created and contains identifiable personal information, it will be treated as personal information and protected accordingly.

16. Payments

Payments are currently accepted by bank transfer. Payment information is processed only where necessary to administer appointments, receive payment and maintain appropriate financial records. I do not routinely retain full credit or debit card information.

17. Bookings and website enquiries

Appointments are arranged directly by telephone or through the consultation/contact form on the Oakwood Hypnotherapy Clinic website. There is currently no separate online booking system. If you submit an enquiry through the website, the information you provide will be used to respond to your enquiry and, where appropriate, arrange an appointment. Making an enquiry does not automatically add you to a marketing list. Information from enquiries that do not result in a therapeutic relationship will not be retained indefinitely without an appropriate reason.

18. Third-party service providers

I use a small number of third-party organisations and technology providers to support the operation of Oakwood Hypnotherapy Clinic. These currently include:

  • Website hosting and website contact form: Squarespace

  • Professional email: Namecheap Private Email

  • Video consultations: Microsoft Teams and Zoom

  • Messaging: WhatsApp

  • Payments: Bank transfer through the banking system

Where another organisation processes personal information as part of providing a service, that organisation is responsible for its own data protection obligations. I take reasonable steps to use services that provide appropriate privacy and security arrangements.

19. International data transfers

Some technology providers may process or store information outside the United Kingdom. Where personal information is transferred internationally, I will take reasonable steps to ensure the transfer complies with current UK data protection legislation and that appropriate safeguards or recognised arrangements are in place.

20. Artificial intelligence and automated systems

I do not routinely enter identifiable clinical records or identifiable sensitive client information into general-purpose artificial intelligence systems. If an AI, transcription, note-taking or other automated service were to process identifiable personal or clinical information, I would first consider the purpose, necessity, lawful basis, security, confidentiality and data protection implications. Removing a client's name alone does not necessarily make information anonymous if other information could reasonably identify them.

21. Marketing and supportive updates

Receiving hypnotherapy does not automatically mean that you will be added to a marketing list. If I offer supportive updates, newsletters or marketing communications, this will be dealt with separately from consent to therapy. Where marketing relies on consent, you can withdraw that consent at any time.

22. Testimonials

Client testimonials, photographs or stories will not be published simply because somebody has received hypnotherapy. Written consent will be obtained before using an identifiable client testimonial, with additional consent where a client's name, photograph or other identifying information is to be disclosed. Particular care will be taken where a testimonial reveals information about a person's health or treatment.

23. Website and cookies

The Oakwood Hypnotherapy Clinic website may use cookies and similar technologies to provide functionality, maintain security and understand how visitors use the website. Where consent is required for cookies or similar technologies, an appropriate consent mechanism will be provided. Certain limited uses may be permitted without consent under current UK law, but appropriate information about their use will still be provided.

24. Data breaches

A personal data breach can include loss, accidental disclosure, unauthorised access or information being sent to the wrong person. If a personal data breach occurs, I will take appropriate steps to contain it, establish what information is affected, assess the potential risk, document the incident and action taken, and determine whether the ICO and/or affected individuals must be notified. Where notification to the ICO is required, this will be done within the legally required timescale.

25. Your data protection rights

Depending on the circumstances, you may have rights including:

  • the right to be informed about how your information is used;

  • the right to access personal information held about you;

  • the right to have inaccurate information corrected;

  • the right to request erasure in certain circumstances;

  • the right to restrict processing in certain circumstances;

  • the right to object to certain processing;

  • the right to data portability where applicable; and

  • rights relating to certain forms of automated decision-making.

Not every right applies in every circumstance. To exercise a data protection right, contact:

Vicky Chew
Email:hello@oakwoodhypnotherapy.co.uk or use the contact options on the Oakwood Hypnotherapy Clinic website.

26. Accessing your information – Subject Access Requests

You have the right to ask for access to personal information I hold about you. This is commonly known as a Subject Access Request (SAR). A request can be made verbally or in writing. I will undertake a reasonable and proportionate search for information covered by your request and may ask for information where reasonably necessary to confirm your identity or clarify the information you are requesting. Requests will normally be dealt with without undue delay and within one month, subject to any permitted extensions under data protection legislation. Information concerning another person may need to be redacted or withheld where appropriate.

27. Data protection complaints

If you are unhappy with the way Oakwood Hypnotherapy Clinic has collected, used, stored, disclosed or otherwise handled your personal information, please contact me first so that I can understand and investigate your concern.

Practitioner: Vicky Chew
Practice: Oakwood Hypnotherapy Clinic
Email:hello@oakwoodhypnotherapy.co.uk
Website: www.oakwoodhypnotherapy.co.uk

I will acknowledge and investigate data protection complaints appropriately and without undue delay, keep you informed where appropriate, and tell you the outcome.

If you remain dissatisfied, you have the right to raise your concern with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

28. Changes to this Privacy Policy

This Privacy Policy will be reviewed periodically and whenever there is a significant change to:

  • data protection legislation;

  • professional requirements;

  • the technology used within my practice;

  • the way personal information is processed; or

  • the services I provide.

The current version will be available on the Oakwood Hypnotherapy Clinic website.

Last reviewed: August 2026