Terms and Conditions

Privacy Policy for Cambridge HypnoCoach 

Last updated: September 2026 

 At Cambridge Hypnotherapy, your privacy, confidentiality and the security of your personal information are taken seriously.  

This Privacy Policy explains what information I collect, why I collect it, how it is used and stored, how long it is retained, when it may be shared and your rights under current UK data protection legislation. 

 This policy reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and amendments introduced by the Data (Use and Access) Act 2025, including provisions which came fully into force during 2026.  

Who I am 

I am Tamsin Barker, Clinical Hypnotherapist and Life Coach. The owner and practitioner at Cambridge HypnoCoach.  

For the purposes of UK data protection legislation, I am the Data Controller for personal information processed within my practice.  

Practice: Cambridge HypnoCoach 

Practitioner: Tamsin Barker 

Email: tamsin@tamsinbarker.co.uk 

Telephone: 07977223108 

Website: www.cambridgehypnocoach.com 

I am a member of APHP and the ICF. I practise in accordance with the relevant professional and ethical requirements. I am registered with the Information Commissioner's Office. 

What information I collect  

When you contact me or become a client, I may collect and process information including:  

• your name, address and contact details;  

• your date of birth; 

• appointment information;  

• information provided during your initial consultation;  

• your reason for seeking hypnotherapy;  

• relevant personal and family circumstances;  

• relevant medical history;  

• medication where relevant;  

• information concerning your physical or mental health;  

• previous therapy or treatment;  

• lifestyle information where clinically relevant;  

• brief clinical and session notes;  

• information concerning your progress;  

• GP details where appropriate;  

• emergency contact information;  

• communications between us;  

• payment and transaction information.  

I aim to collect only information that is relevant and reasonably necessary to provide safe and appropriate hypnotherapy and meet my professional responsibilities. 

Lawful basis for processing your information  

UK data protection law requires me to have an appropriate lawful basis for processing your personal information. Where information is necessary to arrange and provide the hypnotherapy services you have requested, I will normally rely upon:  

Article 6(1)(b) – Contract  

This allows me to process personal information where this is necessary to take steps at your request before entering into a therapeutic agreement and to provide the hypnotherapy services you have agreed to receive.  

There may be circumstances in which another lawful basis applies, including compliance with a legal obligation or legitimate interests relating to the appropriate administration, protection and operation of my practice. 

Health information and special category data  

During your initial consultation and therapy, you may provide information concerning your physical or mental health, medical history, medication and other sensitive matters.  

Health information is classed as special category personal data under UK GDPR and receives additionalprotection.  

Where appropriate to my practice, for the routine processing of relevant health and other special category information for the purposes of providing hypnotherapy, I rely upon:  

Article 9(2)(a) – Explicit Consent  

I will ask you to provide explicit consent to the processing of relevant health and other special category information as part of my initial consultation and consent process.  

You may withdraw consent to future processing that relies upon your consent at any time.  

Withdrawal does not affect processing which was lawful before consent was withdrawn. 

 If you withdraw consent to processing information that is necessary for me to provide hypnotherapy safely and appropriately, I may no longer be able to continue providing therapy.  

There may be circumstances where another legal condition permits or requires processing, including certain safeguarding situations or the establishment, exercise or defence of legal claims. 

Why I use your information 

Your information may be used to:  

• respond to your enquiry;  

• arrange and manage appointments;  

• assess whether hypnotherapy is appropriate;  

• provide hypnotherapy;  

• maintain appropriate clinical records;  

• monitor your progress;  

• communicate with you about appointments or therapy;  

• provide appropriate therapeutic resources;  

• process payments;  

• maintain appropriate financial records;  

• meet professional and insurance requirements;  

• fulfil safeguarding responsibilities;  

• comply with legal obligations;  

• establish, exercise or defend legal claims where necessary.  

Your information will not be used for an unrelated purpose without an appropriate lawful basis.  

I maintain appropriate records of my clinical work in accordance with my professional responsibilities. These may include:  

• personal and contact information;  

• relevant case history;  

• consent to therapy;  

• relevant medical and health information;  

• the reason for seeking hypnotherapy;  

• treatment plans where appropriate;  

• brief session records;  

• relevant advice provided;  

• relevant correspondence.  

Clinical records are intended to be accurate, relevantand proportionate. I follow the principle of data minimisation. This means that I do not aim to create a detailed account of everything discussed during therapy.  

I record information that is reasonably necessary to maintain an appropriate professional and clinical record.  

How long I keep clinical records  

My record-retention arrangements reflect the requirements of APHP, NCH, ICF and BalensInsurance.  

Adult clients: Clinical records will normally be retainedsecurely for 8 years following the last interaction with the client.  

Children under 16 when last seen: Records will normally be retained until the client reaches 25 years of age.  

Clients aged 17 when last seen: Records will normally be retained until the client reaches 26 years of age.  

Financial and accounting information may also be retained for the period required by applicable tax and financial legislation.  

At the end of the appropriate retention period, information will be securely destroyed or deleted unless there is a legitimate reason for retaining it for longer.  

Security and storage of clinical records I take reasonable and proportionate measures to protect personal and clinical information from accidental loss, unauthorised access, disclosure, alteration or destruction.  

My security arrangements include, where appropriate:  

• password-protected devices;  

• appropriate access controls;  

• automatic device locking;  

• secure electronic storage;  

• encryption where appropriate;  

• software and security updates;  

• secure backups;  

• secure storage of paper records;  

• limiting access to client information;  

• secure destruction and deletion of records.  

I am responsible for ensuring that clinical records remain protected throughout the required retention period.  

Appropriate arrangements will also be made for the future protection of clinical records should I retire, cease practising, become incapacitated or die.  

Confidentiality Information discussed during therapy will normally remain confidential. However, confidentiality is not absolute. Information may need to be shared where:  

• you have given permission;  

• disclosure is required by law;  

• there is an appropriate safeguarding concern;  

• a child or vulnerable person may be at risk;  

• there is a serious risk of harm;  

• disclosure is necessary for the establishment, exerciseor defence of legal claims;  

• another lawful basis permits or requires disclosure.  

Where disclosure is necessary, I will aim to disclose only information that is relevant and proportionate to the situation. Where it is appropriate and safe to do so, I will normally discuss this with you.  

Safeguarding and child protection  

I have professional responsibilities concerning safeguarding and child protection. Where information gives rise to a safeguarding concern, information may need to be shared with an appropriate safeguardingorganisation, local authority, police, healthcare professional or other appropriate body.  

Where a statutory reporting duty applies, I will comply with that duty. I will not promise absolute confidentiality where information indicates that safeguarding action or disclosure may be necessary.  

I have an up-to date Safeguarding Policy and that myprocedures reflect current legislation.  

Professional supervision  

Professional supervision forms an important part of safe and ethical clinical practice. My clinical work may therefore be discussed with my professional supervisor. Wherever reasonably possible, identifying information is removed or minimised. Only information reasonably necessary for effective professional supervision will be discussed.  

GP and other healthcare professionals  

There may be circumstances where communication with your GP or another healthcare professional is appropriate. Where possible, I will seek your permission before contacting another healthcare professional. There may be exceptional circumstances where information needs to be shared without consent, for example where required by law or where there is an appropriate safeguarding or serious safety concern.  

Email, telephone and messaging  

I may communicate with you using:  

• telephone;  

• email;  

• SMS/text;  

• WhatsApp;  

• Facebook/Messenger 

I aim to minimise sensitive clinical information contained in routine electronic communications. Electronic communication carries some degree of privacy and security risk. You should therefore avoid sending unnecessary sensitive information through email or messaging services.  

Online hypnotherapy  

Where therapy is provided online, I use MS Teams or Zoom. Online therapy sessions are not routinely recorded. If there were a genuine reason for recording a session, this would be discussed with you in advance, including the purpose of the recording, how it would be stored, who would have access and when it would be deleted.  

Clinical Hypnotherapy Training Hypnotherapy recordings  

As part of therapy, I may provide hypnosis, relaxation or other therapeutic audio recordings. General recordings which do not contain identifiable information about you are not normally part of your clinical record. Where a recording is individually created and containsidentifiable personal information, it will be treated appropriately as personal information.  

Payments  

Payment information is processed only where necessary to administer appointments, receive payment and maintain appropriate financial records.  

I currently accept payment using:  

• Bank Transfer 
• Stripe  
• Paypal 

 Where an external payment provider is used, that organisation will process information in accordance withits own data protection responsibilities. I do not routinely retain full credit or debit card information.  

Third-party service providers 

I may use third-party organisations and technology providers to support the operation of my practice. These may include:  

Email: Go Daddy and Microsoft Outlook 

Appointment booking: Go Daddy and Microsoft Outlook 

Payment processing: Sage and Stripe 

Video conferencing: Microsoft Teams, Zoom 

Website hosting: Go Daddy 

Clinical record/cloud storage: Microsoft 365 

Accounting: Sage 

Where another organisation processes personal information on my behalf, I take reasonable steps to ensure that appropriate data protection arrangements are in place.  

International data transfers  

Some technology providers may process or store information outside the United Kingdom. Where personal information is transferred internationally, I will take reasonable steps to ensure that the transfer complies with current UK data protection legislation and that appropriate safeguards or recognised arrangements are in place.  

Clinical Hypnotherapy Training Artificial intelligence  

Artificial intelligence and automated systems create additional considerations concerning confidentiality and data protection. I do not routinely enter identifiable clinical records or identifiable sensitive client information into general-purpose artificial intelligence systems. Where AI, transcription or another automated service would process identifiable personal or clinical information, I will consider the purpose, necessity, lawful basis, security, confidentiality and data protection implications before using that service. Removing a client's name alone does not necessarily make information anonymous if other information could reasonably identify them.  

Marketing and supportive updates  

Receiving hypnotherapy does not automatically mean that you will be added to a marketing list. Where you are offered the option of receiving supportive updates, newsletters or marketing communications, this will be dealt with separately from your consent to therapy.  

Where marketing relies upon consent, you can withdraw that consent at any time. Marketing communications will provide an appropriate way to unsubscribe.  

Withdrawing from marketing will not affect essential communications relating to therapy or appointments.  

Testimonials  

Client testimonials, photographs or stories will not be published simply because somebody has received hypnotherapy. Written consent will be obtained for the use of an identifiable client testimonial and appropriate additional consent will be obtained where a client's name, photograph or other identifying information is to be disclosed.  

Particular care will be taken where a testimonial reveals information about a person's health or treatment.  

Website enquiries  

If you submit an enquiry through the Cambridge HypnoCoach website, the information you provide will be used to respond to your enquiry and, where appropriate, arrange an appointment.  

Making an enquiry does not automatically add you to a marketing list. Information from enquiries which do not result in a therapeutic relationship will not be retainedindefinitely without an appropriate reason.  

Website and cookies  

My website may use cookies and similar technologies to provide functionality, maintain security and understand how visitors use the website. Where consent is requiredfor cookies or similar technologies, an appropriate consent mechanism will be provided.  

Changes introduced by the Data (Use and Access) Act 2025 allow certain limited uses of cookies and similar technologies without consent. Appropriate information about their use will nevertheless be provided.  

Data breaches  

A personal data breach can include loss, accidental disclosure, unauthorised access or information being sent to the wrong person. If a personal data breach occurs, I will: 

• take appropriate steps to contain it;  

• establish what information is affected;  

• assess the potential risk to the individual or individuals concerned;  

• document the incident and action taken;  

• determine whether the Information Commissioner's Office needs to be notified;  

• notify affected individuals where legally required.  

Where notification to the ICO is required, this will be done within the legally required timescale.  

Your data protection rights  

Depending upon the circumstances, you may have rights including:  

• the right to be informed about how your information is used;  

• the right to access personal information held about you;  

• the right to have inaccurate information corrected;  

• the right to request erasure in certain circumstances;  

• the right to restrict processing in certain circumstances;  

• the right to object to certain processing;  

• the right to data portability where applicable;  

• rights relating to certain forms of automated decision-making.  

Not every right applies in every circumstance. If you wish to exercise a data protection right, please contact: 

Name:  Tamsin Barker  

Email: tamsin@tamsinbarker.co.uk 

Telephone: 07977223108 

Accessing your information – Subject Access Requests  

You have the right to ask for access to personal information I hold about you. This is commonly known as a Subject Access Request (SAR).  

A request can be made verbally or in writing. In accordance with current UK data protection legislation, I will undertake a reasonable and proportionate search for information covered by your request.  

I may request information where reasonably necessaryto confirm your identity. Where clarification is reasonably necessary to identify the information you are requesting, I may ask you to clarify your request.  

Where permitted under current legislation, the response period may be paused while clarification is awaited.  

Requests will normally be dealt with without undue delay and within one month, subject to the provisions and permitted extensions contained within data protection legislation. 

Information concerning another individual may need to be redacted or withheld where appropriate.  

Data protection complaints – updated 2026  

If you are unhappy with the way Cambridge HypnoCoachhas collected, used, stored, disclosed or otherwise handled your personal information, you have the right to make a data protection complaint. Please contact:  

Tamsin Barker, Cambridge HypnoCoach  

Email: www.tamsin@tamsinbarker.co.uk 

Telephone: 07977223108 

Please provide sufficient information for me to understand and investigate your concern. In accordance with current data protection requirements, I will:  

• provide an appropriate way for you to make a complaint;  

• acknowledge receipt of your complaint within 30 days;  

• take appropriate steps to investigate it without undue delay;  

• keep you appropriately informed about its progress;  

• inform you of the outcome without undue delay.  

If you remain dissatisfied, you have the right to raise your concern with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.  

Changes to this Privacy Policy  

Privacy Policy will be reviewed periodically and whenever there is a significant change to:  

• data protection legislation;  

• professional requirements;  

• the technology used within my practice 

• the way personal information is processed;  

• the services I provide.  

The current version will be available at: www.tamsinbarker.co.uk 

Renewal date : September 2027, unless otherwise required