Privacy Policy
Introduction
I am committed to safeguarding the privacy of my website visitors and individual existing and previous clients.
This policy applies where I am acting as a data controller with respect to the personal data of such persons, which means where I determine the purposes and means by which that personal data is processed.
The type of personal information I collect
I currently collect and process the following information:
· Personal identifiers, contacts and characteristics (for example, name and contact details).
· Background information related to why the client is using my service.
· Any medical information shared by the client before or during the course of the sessions relevant to the service they receive from me.
· Additional information which is shared by the client before or during the course of the sessions which assist in the provision of my service to the client (for example, about lifestyle and significant others such as family, friends or colleagues) alongside brief session notes.
· Information contained in, or relating to, any communication sent between individual people and me. The communication data may include communication content and metadata associated with the communication. Our website will generate the metadata associated with communications made using the website contact form.
· Individual website user account data including include your account identifier, name, email address, business name, account creation and modification dates, website settings and marketing preferences. The primary source of this data is the individual website user, although some data elements of may be generated by my website.
How I get the personal information and why I have it
The personal information I collect and process is provided to me directly by the client, and is important for one of the following reasons:
· To get in touch with people to respond to enquiries about the potential use of my services ("contact data"). The contact data may include your name, email address, telephone number and postal address. The source of the contact data is you.
· To enable me to understand the client's specific history and therapeutic needs, to provide a high-quality service to the client, and to ensure I am equipped with the knowledge of previous discussions prior to each session.
· To send written advice, homework tasks and audio recordings to work with as part of the therapy. It may also be necessary to send emails to confirm or rearrange appointments. All recordings will only be made with the knowledge and informed consent of the client, and will be kept no longer than is useful or necessary for the ongoing progress of the client’s well-being. After which, all recordings will be safely wiped.
· To contact clients (by email) regarding a monthly informative communication related to some of the issues that commonly arise related to my service and, on an occasional basis, direct marketing. The legal basis for this processing is legitimate interest, namely promoting my business and communicating marketing messages and offers to website visitors and existing or previous clients.
· For the purposes of obtaining or maintaining insurance coverage, managing risks and/or obtaining professional advice. The legal basis for this processing is legitimate interest, namely the proper protection of my business against risks.
· To comply with legal, regulatory and other vital obligations. I am obliged under the code of ethics of The British Institute of Hypnotherapy & NLP, of which I am a member, to collect and protect the personal information of my clients necessary to the effective delivery of my service and the safeguarding of my clients.
· Where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is legitimate interest, namely the protection and assertion of all parties' legal rights.
Client consent
Clients are able to remove consent at any time, by contacting arantxadedios@gmail.com and, assuming it complied with obligations under my membership organisation and my insurance company, all information would be permanently deleted. Any information relating to a client would only be shared with other health care professionals with that client's signed consent. The exceptions to this are in order to safeguard the client and the people around them, if the client were to disclose that they were going to carry out harm to themselves or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. I would always aim to discuss this with the client prior to contacting anyone. The same applies if I was issued with a police warrant or court order for information about a client, by law I would also have to release that information.
I have a professional obligation and duty of care to provide the most effective service to my clients once they agree to engage me to help them. The collection of some types of personal information is essential in order to be able fulfil that duty. A client does not have to consent to the collection of information. However, if a client chooses not to provide it, I may not be able to work with that client.
How I store clients' personal information
Clients' information is securely stored, with hard copies in my locked private premises and electronic data on devices protected by passwords, Touch ID and Face ID.
Under the code of ethics of my professional body, The British Institute of Hypnotherapy & NLP, I am obliged to keep case study notes including personal information for a minimum of 8 years after the client's final session. After this time, I will permanently and safely delete both hard copy and electronic copy data using the generally accepted processes (for example, paper shredders and confidential disposal units).
In the event of me being incapable of continuing with the treatment of a client or clients, e.g. because of illness or death, clients will be contacted by a trusted person who is also a qualified hypnotherapist and will also respect rules of confidentiality. Clients will be given the option of being put in touch with another therapist for continuation of their sessions.
To ensure client confidentiality, if I meet a client outside of sessions in a public setting, I will not engage in any conversation regarding that client's therapy. Clients are welcome to talk with other people about the therapy they are receiving, but I am obligated to ensure that client confidentiality is protected.
I am legally obliged to have a supervisor, with whom I must meet on a periodic basis and with whom I may discuss elements of client sessions. Supervisors are specially trained hypnotherapists bound by the same data privacy and protection regulations. No names or information that would identify a client would be disclosed.
Your data protection rights
Under data protection law, you have rights including:
Your right of access - You have the right to ask us for copies of your personal information.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact me at arantxadedios@gmail.com if you wish to make a request.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to me at arantxadedios@gmail.com.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Date of privacy policy creation: 08 / 11 / 2023