Privacy Policy

Data Controller

2 Oct 2026 · @Rosemary Gardiner

Last updated: 5th October 2026

1. Who I am

I am Rosemary Gardiner, a hypnotherapist trading as Rose Gardiner Hypnotherapy. I am the data controller for the personal information described in this policy, and I am registered with the Information Commissioner's Office (ICO), registration number ZC132281.

This policy explains what information I collect, why, how long I keep it and what rights you have. It applies to my website 'rosegardinerhypnotherapy.co.uk', to enquiries, and to the therapy services I provide in person and online. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact me about anything in this policy at:

Email: Rose@Rosegardinerhypnotherapy.co.uk
Telephone: +44 7884003253

2. What information I collect

I only collect information that I need to respond to you and to provide therapy safely.

If you make an enquiry or book a consultation:

Your name, email address and telephone number
Whatever you choose to tell me about why you are seeking help

If you become a client:

Contact details, including your postal address and date of birth
An emergency contact and your GP's details, where you provide them
Information about your health and wellbeing, including relevant medical and mental health history, medication, and the issue you would like help with
Notes of our sessions and your progress
Appointment and payment records

My assessment form also asks about your family background, childhood and significant relationships. Some of these questions are optional, and you can leave blank anything you would prefer not to answer.

If you sign up for emails or a free resource:

Your first name and email address

If you visit my website:

Technical information such as your IP address, browser type and the pages you visit, collected through cookies and similar technology (see section 9)

Card payments are handled by a third-party payment provider or, for sessions at the gym, by the gym (see section 6). I do not see or store your full card details.

Most of this information comes directly from you. Occasionally I may receive information from someone else, such as a referrer, and I will tell you if so.

3. How I use your information and my lawful basis

The law requires me to have a lawful basis for each use of your information. These are the ones I rely on.

What I do

Lawful basis

Reply to your enquiry and arrange a consultation

Legitimate interests (responding to people who contact me) or steps taken at your request before entering a contract

Provide therapy, keep session notes, manage appointments and take payment

Contract (providing the service you have asked for)

Keep financial records for tax purposes

Legal obligation

Keep client records for insurance and professional body requirements

Legitimate interests (being able to respond to a complaint or claim)

Send you my newsletter, free resources or offers

Consent, which you can withdraw at any time

Understand how my website is used, through non-essential cookies

Consent

4. Information about your health

Information about your physical and mental health is "special category" data, which the law protects more strictly. I need an additional condition to use it.

I process health information on the basis of your explicit consent, which I ask you to give in writing on my client intake form before we begin. You can withdraw this consent at any time by contacting me. If you do, I may be unable to continue providing therapy, because I cannot work safely without it. I may still need to keep the records already made, for the period in section 7, in case of a legal claim.

I do not use your information for automated decision-making or profiling.

5. Confidentiality

What you tell me in sessions is confidential. I will only share it without your consent in these limited circumstances:

I believe you or someone else is at risk of serious harm
There is a safeguarding concern about a child or an adult at risk
I am required to by law, for example by a court order or under terrorism or money laundering legislation

Wherever possible I will talk to you first.

I discuss my work in professional supervision, as good practice requires. I do this without using your name or identifying details.

I may record sessions or provide you with audio recordings to use at home. I will only record a session with your agreement.

6. Who I share your information with

I never sell your information or pass it to anyone for their own marketing.

I use a small number of trusted service providers who process information on my behalf, under contracts that require them to keep it secure:

Type of provider

What it is used for

IONOS

Website hosting and email

Appointment booking provider

Appointment booking

Email newsletter provider

Sending emails to subscribers

Payment provider

Taking payments

Video call provider

Online sessions

Secure storage provider

Storing client records

Sessions at Hampton Training Academy Ltd. I provide some sessions at the gym run by Hampton Training Academy Ltd. If you book a session there, the gym takes your booking and payment, so it holds your name, appointment time, booking status and payment details. It confirms your booking and attendance to me. I invoice the gym monthly, and my invoices contain no client names or personal details. I do not share your health information, session content or notes with the gym. Hampton Training Academy Ltd is responsible for how it uses the booking and payment information it holds, and you can ask the gym for a copy of its privacy policy.

I may also share information with my accountant, my professional insurer or legal advisers where necessary, and with others in the circumstances described in section 5.

Transfers outside the UK. Some of these providers store information outside the UK. Where they do, I make sure it is protected by a safeguard recognised in UK law, such as a UK adequacy decision or the International Data Transfer Agreement.

7. How long I keep your information

Information

How long I keep it

Client records and session notes

7 years after your last session, as required by my insurer and professional body

Enquiries that do not lead to a booking

12 months

Financial records

6 years after the end of the tax year, as required by HMRC

Mailing list details

Until you unsubscribe

After these periods I securely delete or destroy the information.

8. How I keep your information secure

Electronic records are kept on password-protected and encrypted devices and services, with two-step login where available
Paper records are kept in a locked cabinet that only I can access
I am the only person with access to client records

If a data breach occurs that is likely to put your rights at risk, I will tell you and the ICO as the law requires.

9. Marketing emails and cookies

Emails. I will only send you marketing emails if you have opted in, or if you are a client and did not opt out when I collected your details. Every email includes an unsubscribe link, and you can also ask me to remove you at any time.

Cookies. My website uses essential cookies that it needs to work. It uses non-essential cookies, such as analytics cookies, only if you accept them in the cookie banner. You can change your choice at any time through the cookie banner or your browser settings.

My website may link to other sites. I am not responsible for their privacy practices, so please read their policies.

10. Children and young people

My services are for adults aged 18 and over. I do not work with anyone under 18 and do not knowingly collect their information. If I learn that I hold information about someone under 18, I will delete it.

11. Your rights

Under data protection law you have the right to:

Access the information I hold about you
Correct information that is inaccurate or incomplete
Erase your information in certain circumstances
Restrict how I use your information in certain circumstances
Object to my use of your information where I rely on legitimate interests, and to direct marketing at any time
Receive a copy of information you gave me in a portable format, where I hold it electronically on the basis of consent or contract
Withdraw consent at any time, where I rely on your consent

To use any of these rights, contact me using the details in section 1. There is normally no charge, and I will reply within one month. I may need to confirm your identity first.

Some rights are limited where I must keep records by law or for insurance purposes. If that applies, I will explain why.

12. Complaints

If you are unhappy with how I have handled your information, please contact me first so I can try to put it right.

You also have the right to complain to the Information Commissioner's Office:

Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Changes to this policy

I review this policy at least once a year and update it when my practice or the law changes. The date at the top shows when it was last updated. If I make a significant change, I will tell current clients directly.