GDPR Statement

This GDPR agreement sets out how personal data collected during the course of therapy is stored and processed to ensure privacy and confidentiality. 

Information Gathered

Information is gathered via the client take on form and session notes taken during each appointment.  Other forms specific to the treatment may also be used where relevant to the presenting problems, this might include GAD7, PHQ-9, IAPT Phobia Questionnaire. 

Zoom is used for on-line therapy and is securely encrypted.  Whilst Zoom has the ability to record sessions this will not be used. 

Therapeutic e-mail exchanges will be destroyed after the therapy session has ended.  Should they wish to, the client can also request these be deleted after each session. 

Information Storage

Personal data collected via any form of contact, that is either by e-mail or phone will be kept securely as detailed below. 

The client take-on form, contact details, brief session notes and other forms are stored on a computer and password protected.

The brief session notes are anonymized using the clients initials only and are password protected. 

All reasonable steps are taken to ensure that client data is treated securely and in accordance with this privacy policy.

How information is used

Contact details are used to provide clients with information of services, advice and guidance requested.  They are also used to book client sessions and inform the client of any changes in appointment times or in the rare case of cancellation. 

The session notes and any supporting forms are used to carry out my obligation as set out in the Client Contract Form. 

As part of my continuous professional development I attend supervision regularly. This is bound by a confidentiality contract with the supervisor and to protect your identity I only use the initial of your first name.

If testimonials are provided by the client then they will only be published with the consent of the client.  No testimonial will be published without this prior consent, to be given in writing.  

Data retention and duration

Text communication is deleted immediately while emails are purged once a month. After therapy has finished, your phone number will be deleted from my phone.

Client take on form, brief sessions notes and any specific CBT forms will be retained for as long as we are working together. After therapy has finished, I will retain these documents for a further year in case you decide to return to therapy with me. 

Your rights

You are entitled to view, amend, or delete the personal information that I hold. All requests have a month to be carried out

In the event of a data breach

I have a legal obligation to report a data breach to you and the Information Commissioners Office (ICO) within 72 hours.

Disclosure of your personal information

Client data will only be disclosed or shared where I am under a duty to disclose this in order to comply with any legal obligation. For example, as a legal requirement such as safeguarding children or vulnerable adults, terrorism or money laundering.  Further information of confidentiality is found in Annex 2 of the contract form. 

Changes to the GDPR agreement

I will notify you of changes I may make to this privacy policy in the future.

Consent to the GDPR agreement

Signing the Client Contract Form and using the services of Empowered You Hypnotherapy constitutes client approval and acceptance of this agreement.  In this the client consents to the use and storage of their data as detailed above. The client has the right to withdraw their consent at any time.