Hypnotherapy Privacy & Cookies Policy

1. Who I Am

I am Lisa Day, the owner and practitioner at Theta Flow Hypnotherapy, providing Solution Focused Hypnotherapy sessions online and/or in person.

Contact: Lisa.Day@thetaflowhypnotherapy.co.uk

07792 593 604

https://thetaflowhypnotherapy.co.uk 

This Privacy & Cookies Policy explains how I collect, use, store, and protect your personal information in line with UK GDPR and the Data Protection and Digital Information Act (DPDI Act) 2026. 

2. What Information I Collect

To provide therapy safely and effectively, I may collect:

• Your name and contact details
• Appointment and booking information
• Information you share during sessions
• Health or wellbeing information relevant to therapy
• Payment information processed through secure third party providers
• Website using data (via cookies, if you consent)

I only collect information that is necessary for therapy, communication, safety, or legal compliance. 

3. Why I Use Your Information

I use your information to:

• Provide hypnotherapy services
• Keep appropriate clinical notes
• Communicate about appointments
• Process payments securely 
• Meet legal, professional, and insurance obligations 
• Improve my website (with your consent for analytics cookies)

Lawful Bases for Processing

Under UK GDPR and the DPDI Act 2026, the lawful bases I rely on include:

• Contract – to provide therapy sessions you have booked
• Legitimate interests – for safe practice, record‑keeping, and continuity of care
• Legal obligation – where required by law or professional bodies
• Vital interests / safeguarding – if there is risk of harm to you or others
• Consent – for optional activities such as analytics cookies or contacting your GP

I do not use automated decision‑making or AI systems to process client data.

4. Who I Share Information With

I only share your information when necessary, such as with:

• Secure booking, payment, or email service providers
• My professional supervisor (anonymised where possible)
• Authorities in cases of safeguarding or legal obligation
• Your GP or other professionals only with your written consent, unless there is a risk of harm 

I do not sell or trade your personal data.

Under the DPDI Act, safeguarding, crime prevention, and system security are recognised legitimate interests that may require sharing information without consent when necessary for safety. 

5. How Long I Keep Information

I keep information for the following periods:

• Therapy notes: 5 years after your final session, or 5 years after a young person turns 18
• Administrative or contact information: only as long as necessary for its purpose
• Financial records: 6 years, as required by HMRC.

 All data is securely destroyed after the retention period. 

6. Your Rights

You have the right to:

• Access your personal data ( in accordance with the guidance outlined in my GDPR notice)
• Request corrections
• Request deletion (in accordance with the minimum term outlined in my GRPR notice)
• Withdraw consent (for cookies or optional communication).

2026 SAR (Subject Access Request) Rules

Under the DPDI Act:

• I may pause the 30‑day response period while verifying your identity
• Requests may be refused if they are clearly excessive or vexatious
• You will be informed of the reason if a request cannot be fulfilled

To exercise your rights, contact:

• Email: Lisa.Day@thetaflowhypnotherapy.co.uk
• Phone: 07792 593604

7. Cookies

The Theta Flow Hypnotherapy website uses cookies to ensure the site functions correctly and to improve your browsing experience. Cookies are small text files placed on your device when you visit a website. Some cookies are essential for the website to work, while others are optional and only used if you give consent.

Essential Cookies (always active)

These cookies are necessary for the website to operate. They enable core functions such as:

• remembering your cookie preferences
• ensuring pages load and display correctly
• maintaining basic security features

These cookies do not store personally identifiable information and cannot be switched off.

Optional Cookies (used only with your consent)

Optional cookies help me understand how visitors use the website so I can improve its layout, content, and accessibility. These may include:

• Analytics cookies – to understand which pages are visited and how users navigate the site
• Performance cookies – to help improve website speed and functionality

These cookies only run if you click “Accept” on the cookie banner. If you choose “Reject,” only essential cookies will be used.

Types of Cookies Used

• Session cookies – temporary cookies deleted when you close your browser
• Persistent cookies – remain on your device for a set period (typically between 1 day and 12 months)
• First‑party cookies – set directly by the Theta Flow Hypnotherapy website
• Third‑party cookies – set by trusted services such as analytics tools or embedded content (if used)

Any third‑party cookies used on the site will be listed in the cookie banner with their purpose and expiry period.

What Cookies Collect

Cookies may collect information such as:

• device type
• browser type
• pages visited
• time spent on the website
• general location (not precise)

Cookies do not collect therapy information, personal notes, or anything shared during sessions.

International Transfers

Some analytics tools may store data outside the UK. If used, these services must comply with UK data protection rules and provide appropriate safeguards. Full details will appear in the cookie banner.

Managing Your Cookie Preferences

You can:

• accept all cookies
• reject optional cookies
• change your preferences at any time via the cookie banner
• disable cookies through your browser settings

If you disable essential cookies, some parts of the website may not function correctly.

8. Questions Or Concerns

If you have any concerns about how your data is used, please contact:

Lisa.Day@thetaflowhypnotherapy.co.uk

07792 593 604

https://thetaflowhypnotherapy.co.uk 

You can also contact Information Commissioner's Office (ICO) at ico.org.uk