Last updated: August 2026.
This explains what personal information Rugby Hypnotherapy holds, why, who else may see it, how long it is kept and what rights you have. Clients also receive this as a separate Privacy Notice before their first session.
Who is responsible
Adel Moin, trading as Rugby Hypnotherapy, Rugby, Warwickshire, is the data controller. I am registered with the Information Commissioner’s Office, reference ZC082156. For any privacy question, email hello@rugbyhypnotherapy.co.uk.
What I collect
- If you enquire: your name, contact details and whatever you choose to write in your message.
- If you become a client: contact and next-of-kin details, your GP’s details, medical and mental health history, medication, lifestyle information, your answers to safety questions, and notes of our sessions including goals, progress and any referral.
- Administration: appointment and payment records. Card details are not stored.
Why I am allowed to hold it
Data protection law requires a lawful basis for using your information, and a further condition for health information specifically.
- Delivering sessions you have booked: UK GDPR Article 6(1)(b), performance of our contract.
- Health and mental health information: UK GDPR Article 9(2)(h) together with Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018, the provision of health or social care. This condition is available because I owe you a duty of confidence in law, which is the safeguard Article 9(3) and section 11(1) of the Act require.
- Replying to an enquiry: Article 6(1)(f), my legitimate interest in responding to people who contact me.
- Keeping records afterwards: Articles 6(1)(c) and 6(1)(f), meeting professional and insurance obligations.
- Any marketing email, if you ask for it: Article 6(1)(a), your consent, which you can withdraw at any time.
Because clinical records rest on the health and social care condition rather than consent, withdrawing consent does not by itself require your notes to be deleted. That keeps your records intact and available to you for the retention period. You can still object, and I will always explain my reasoning.
Who else sees it
Normally nobody. Your information is never sold or shared for marketing. The limited exceptions are:
- Professional supervision, a normal requirement of safe practice. Cases are discussed without identifying you by name, and my supervisor is bound by the same duty of confidence.
- Where there is a serious risk to your life or safety, or someone else’s, including a child or an adult at risk.
- Where the law requires it, for example a court order.
- My insurer and professional body, if a complaint or claim is made.
- Service providers who help run the practice, such as secure file storage, email, booking and accounting. They act on my instructions under contract and cannot use your information for their own purposes.
How it is protected
- Records are held in secure, access-controlled business accounts with strong passwords and two-factor authentication, on encrypted devices.
- Paper forms are scanned and destroyed where practical, so there is a single secure record. Anything kept on paper is locked away.
- Client notes are never kept in ordinary email or messaging apps.
- Where a provider stores data outside the UK, the transfer is covered by the safeguards required under UK data protection law.
How long it is kept
- Client records: seven years from our last session, unless a longer period is required by my insurer or by law, then securely destroyed.
- Enquiries that do not become sessions: up to twelve months.
- Financial records: six years. HMRC requires at least five years after the relevant 31 January filing deadline; six aligns with the period for contract claims.
Your rights
You can ask for a copy of the information held about you, have inaccurate information corrected, ask for deletion or restriction in certain circumstances, object to how your information is used, ask for it to be transferred, and withdraw consent where consent is what I rely on. Requests are normally answered within one month and free of charge. Some rights do not apply where records must be kept for insurance or professional reasons, and I will explain if that is the case.
To exercise any right, email hello@rugbyhypnotherapy.co.uk.
Complaints
If you are unhappy with how your information has been handled, please tell me first so I can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
This website
The site uses only what is needed to work and to deliver enquiries sent through the contact form, which is handled by Web3Forms. Please do not use the form for emergencies. There is no advertising or behavioural tracking. If analytics or other non-essential tools are added, this policy will be updated and consent obtained where required.