Privacy notice

Version 2.13 · Last updated: 26 September 2026.

This explains what personal information Rugby Hypnotherapy holds, why, who else may see it, how long it is kept and what rights you have. Clients also receive a one-page summary. This page is the full notice for clients and everyone else.

Your privacy in brief

I use the details you share to reply, arrange appointments, plan safely and keep a clear record of our work. Clinical records stay in a separately encrypted local store with an encrypted external backup. Booking, email and call providers handle the information needed for their services; Zoom carries our live conversation.

I share only what is necessary, for example for serious safety concerns, legal requirements or professional advice. Adult client records are normally kept for seven years after the last session; non-client enquiry content is normally deleted within twelve months. You can ask to see or correct your information and exercise other rights where they apply. This notice is information, not a consent form. Optional offline AI is a separate choice, explained below. The full notice below explains the details, providers, retention periods and how to contact me or the ICO.

Who is responsible

Adel Moin, trading as Rugby Hypnotherapy, Rugby, Warwickshire, is the data controller. I am registered with the Information Commissioner’s Office, reference ZC082156. My correspondence address is 27 Old Gloucester Street, Holborn, London WC1N 3AX, United Kingdom. This is not a treatment location. For any privacy question, email hello@rugbyhypnotherapy.co.uk.

What I collect

• If you enquire: your first or preferred name, email address or phone number and the practical details needed to reply. Cal.com receives your name, email and any booking notes. Telephone and voicemail may include your name, number, callback time and anything you choose to leave in a message.
• Free consultation: brief notes of what you would like help with, practical and accessibility arrangements, and health information only where relevant to whether hypnotherapy suits you.
• If you become a client: contact details, relevant medical and mental-health history, medication, lifestyle information, safety answers, and notes of sessions including goals, progress and any referral. A full date of birth is optional for adults and required for anyone under 18. For remote work, the client’s home address, GP details and an emergency contact are required under my documented Remote Working Safety Policy; for in-person work they are collected only where relevant and necessary.
• Information about other people: you may give an emergency contact, GP details or mention another person in a session. Please tell an emergency contact that you have given me their details. I record third-party information only where it is relevant and necessary.
• Administration: appointment and payment records, including the date, amount and reference for each payment. Payment is by PayPal, bank transfer or cash. Card payments are not taken and card or bank account details are not held.
• If you join the newsletter: your email address, newsletter consent and confirmation records, the date and source of your request, the wording you agreed to, and delivery, bounce and unsubscribe records. Brevo may also record technical information, such as the IP address used to submit the form. Questionnaire answers and results are not included.
• Events and media: if you volunteer for a demonstration, I collect a short safety screen and signed participation consent. Photography, video and each publication channel require separate optional choices.

What is required and what is optional

For an email enquiry, please give your first or preferred name and a way for me to reply. The current website uses direct email and consultation booking. Joining the newsletter requires an email address and an affirmative, initially unticked choice to subscribe, then confirmation from your email. Please leave health details out of enquiry messages and booking notes. If we agree to work together, identity, contact, consent and relevant safety information are required to decide whether the work can proceed safely and to deliver it; other intake fields are marked or treated as optional unless they become relevant. If I need information to decide whether sessions can go ahead, I’ll explain why. Without it, I may need to postpone or decline the work.

Why I am allowed to hold it

Data protection law requires a lawful basis for using your information, and a further condition for health information specifically.

• Delivering sessions you have booked: UK GDPR Article 6(1)(b), performance of our contract.
• Health and mental health information: UK GDPR Article 9(2)(h) together with Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018, the provision of health or social care. This condition is used only where the processing is necessary for a qualifying health or care purpose and the legal duty-of-confidence safeguard in Article 9(3) and section 11(1) applies. It is not blanket authority for every activity.
• Replying to an enquiry: Article 6(1)(f), my legitimate interest in responding to people who contact me. Enquiry routes ask you not to send detailed health information. If health information is nevertheless volunteered as part of a request for care, Article 9(2)(h) is relied on only where its qualifying purpose and confidentiality conditions apply, and Article 9(2)(f) applies if it later becomes relevant to a legal claim.
• Free consultation: Article 6(1)(b), steps you have asked me to take before we decide whether to enter a contract. Health information needed to decide suitability is processed under Article 9(2)(h) only where its qualifying purpose and confidentiality conditions apply.
• Safeguarding or emergency action: Article 6(1)(d) or 6(1)(f), with 9(2)(c) where the person cannot consent or 9(2)(h) where care is arranged.
• Keeping clinical records afterwards: Article 6(1)(f), my legitimate interests in maintaining an accurate professional record, continuity, responding to questions and establishing, exercising or defending legal claims. Article 6(1)(c) is used only where a specific UK legal obligation applies, such as tax law or a court order.
• Optional offline AI for notes: Article 6(1)(a) and, where health information is included, Article 9(2)(a), your separate explicit consent. This choice does not change the legal bases for ordinary care and record keeping.
• Event safety screening and media: Article 6(1)(a) and, for health answers, Article 9(2)(a), your explicit consent. Participation is voluntary and media consent is not required to take part.
• Any marketing email, if you ask for it: Article 6(1)(a), your consent, which you can withdraw at any time.

Where records are lawfully held on a basis other than consent, withdrawal of consent does not automatically require deletion. You may ask for deletion, restriction or object to processing, and I will explain the applicable legal basis and decision.

Who else sees it

Your information is not sold or passed to other organisations for their own marketing. Providers help me deliver services, including emails you have asked to receive. Information may be shared in these circumstances:

• Safe practice requires me to review my work with a professional supervisor or with a peer practitioner. Cases are de-identified as far as reasonably possible, and anyone I discuss work with is bound by the same duty of confidence.
• Where there is a serious risk to your life or safety, or someone else’s, including a child or an adult at risk.
• Where the law requires it, for example a court order.
• My insurer, legal advisers and current professional body, IPHM, if a complaint or claim is made.
• A designated records custodian, but only if a written appointment is completed, I die or become unable to practise, and the access is needed to carry out the appointment under its confidentiality, access and disposal instructions.
• Service providers who help run the practice: Zoom for video consultations and online sessions; Virtual Landline for telephone and voicemail; Apple (iCloud), for syncing contact names and phone numbers between my devices; Microsoft 365 for business email, Web3Forms for records from earlier website forms, Cal.com for consultation booking, Brevo (Sendinblue, France) for newsletter sign-up and email delivery, the website host and my accounting provider. Each is used only for its stated purpose. If you choose to include more in an email, booking note or voicemail, I move anything needed into the protected record and delete the original. These links were correct at the date of this policy.
• Where you pay by PayPal or bank transfer, the payment provider and my bank receive the information needed to complete the payment. They act under their own privacy terms as data controllers in their own right, not on my instructions. Payments show the trading name Rugby Hypnotherapy. Please keep payment references neutral and do not include anything about the work we do.
• Telephone enquiries may be answered by a family member assisting the practice when I am unavailable, but only while a signed written confidentiality undertaking is in force. They take only your first or preferred name, contact number and preferred callback time, then ask me to call you back. They do not ask why you are calling and have no access to client records.

How it is protected

• Your clinical records are held on a single computer in the United Kingdom. The computer has full-disk encryption and a strong password, and is set to lock automatically when left unattended. Within that, the clinical-record store sits in a second, separately encrypted location that only I can unlock.
• The clinical-record store is not held in a cloud service and is excluded from internet and cloud synchronisation. It is kept separately from ordinary business and website working files, and is normally left locked and unmounted.
• A recovery copy is kept on a separate encrypted external drive. The drive is disconnected after each backup and stored in locked, fire- and water-resistant storage away from the computer. Only I hold routine access to it. Arrangements for a records custodian to obtain access are held separately and take effect only on my death or incapacity.
• Paper forms are scanned directly with a scanner. Every page, signature and reverse side is checked against the paper before the digital file is accepted. Paper is then cross-cut shredded or placed in confidential waste, unless an original must exceptionally be retained in locked storage.
• Client notes are never kept in ordinary email or messaging apps, and client information is never put into online or cloud AI services. Optional offline AI may be used only after the tool has passed its assessment and you have given separate explicit consent, as explained below.
• Administrative information passes through Microsoft 365 email, Cal.com, Zoom, Virtual Landline, Apple iCloud and Brevo; earlier form records may remain with Web3Forms and my accounting and website services. These providers are not sent the stored clinical record or session notes. Zoom carries the live conversation, including relevant health information; email, booking notes and voicemail may contain details you choose to share. Some process information outside the UK, so their data-processing and international-transfer terms are reviewed and recorded.

No decisions about you are made automatically, and your information is not used for profiling.

Optional offline AI for notes

If I propose an offline AI tool to help organise and review relevant session and health notes, I explain the named tool, the information it would process and the purpose before asking for your separate explicit consent in the optional section of Core Intake and Consent. The tool must pass its assessment before first use. It runs only on the practice computer, with its files inside the encrypted store; nothing is sent to an outside AI service.

Choosing No or leaving the choice blank means I keep notes manually, with no penalty and no effect on your care. I review everything the tool produces. It makes no decisions about suitability, risk, diagnosis, referral or care. I never use AI to process age-regression or past-life regression records.

You can withdraw your choice at any time by telling me, emailing hello@rugbyhypnotherapy.co.uk or calling 01788 486 111. I then stop future AI use for your information without affecting your care. Necessary clinical notes that I have reviewed remain subject to the normal record-retention rules below. Working AI copies are deleted under the tool’s assessed deletion arrangements. A material change to the tool, information used or purpose requires fresh consent before it takes effect.

For a client under 18, this can be offered only after the children’s data protection assessment has been approved, I have assessed and recorded who can validly give consent, and the young person has been involved and their own agreement recorded. A parent’s contract does not automatically authorise optional AI use.

Online consultations and sessions

Free consultations may be by phone or Zoom. Online sessions use Zoom. I do not record these calls, and Zoom’s AI transcription and summary features are switched off. Zoom carries the call but does not receive your clinical record. Zoom Communications, Inc. is based in the United States and processes data there and internationally. Its safeguards include the UK Extension to the EU–US Data Privacy Framework and the UK Addendum to the Standard Contractual Clauses.

Telephone and voicemail

Calls to 01788 486 111 are handled by Virtual Landline (Buzz Networks Limited, UK), which stores data in the European Economic Area. Voicemails arrive in my Microsoft 365 business mailbox. I note any callback details, then delete the voicemail from the mailbox, normally within 7 days. Virtual Landline may also keep a copy for a period set by its own terms.

Client phone contacts

Apple’s service provider for UK iCloud users is Apple Distribution International Ltd., Ireland. Apple says personal data is generally stored in the United States and may be processed internationally, using contractual safeguards for UK transfers. I use consumer iCloud under Apple’s own terms, with no separate data processing agreement, for contact names and phone numbers only.

Arriving at the practice

A doorbell camera covers the entrance to my home practice. I switch it to privacy mode before client appointments, so client arrivals and departures are not recorded. A camera inside the house is unplugged while clients are here.

Social media, WhatsApp and text messages

I do not take enquiries through social media, WhatsApp or text messages. If you message me that way, I will reply once asking you to email or call instead, and then delete the conversation from my side. The platform keeps its own copy under its own terms.

Clients under 18

If the client is under 18, a parent or guardian gives me information about them as well as the young person. I use it for the same purposes, and on the same legal basis, as for adults. The young person’s information is assessed separately where the parent or guardian holds the contract; it is not automatically covered by the parent’s contract. What I share with the parent or guardian is agreed with the young person at the start and recorded, apart from safety concerns, which are always shared. A young person who understands their information rights can exercise them directly. A parent or guardian may act on their behalf where authorised or otherwise legally entitled; access is assessed in the young person’s interests and is not automatic.

How long it is kept

• Client records: seven years from our last session, unless a longer period is required by law, then securely destroyed.
• Records about clients under 18: Until the young person’s 25th birthday, or seven years after the last session, whichever is later.
• Voicemails: deleted from my mailbox once any callback details are noted, normally within 7 days.
• Phone contacts: deleted when our work ends.
• Enquiries that do not become sessions: the content of your enquiry, including free consultation notes if you do not become a client, is deleted within twelve months. After that a minimal note of your name, the date and the channel of contact, and that the enquiry did not proceed, may be kept for up to three years. Web3Forms holds its own copy for up to three years from the date you send it, under a data processing agreement I hold. If I stop using the service, that copy is deleted or returned within ninety days, apart from routine backups which are overwritten in the ordinary course.
• Consultation bookings: bookings that do not become client work are reviewed and deleted after twelve months. Cal.com’s privacy policy says account and booking data is held while the account remains active unless it is deleted earlier.
• Newsletter records: I review the list annually and stop newsletter mailings within two years of your confirmation unless you actively renew your choice. Newsletter contact and consent records are reviewed for deletion at that point. Confirmation links expire after 30 days; unconfirmed requests do not join the newsletter list. Confirmation and delivery logs and email previews in Brevo are kept for up to 24 months from the event, with deletion normally completed within a further day. Form-event records are reviewed monthly and deleted when no longer needed, including unconfirmed requests after their confirmation link has expired. A minimal email address and opt-out record may be kept for as long as needed to prevent accidental re-subscription, with an annual review. These periods are separate from clinical-record retention.
• Financial records: Six years after the end of the tax year the records relate to, and never less than five years after the 31 January filing deadline (or 15 months after a very late return); longer if an HMRC enquiry or legal claim requires it.
• Event safety and participation forms: three years from the event, or seven years after closure where there is an incident, complaint or claim.
• Media-consent records: while the material is in use and for six years afterwards. Withdrawal stops future controlled use and removal is made where reasonably possible.

Optional feedback

Optional ratings and comments are used to evaluate and improve the service. Please do not include health or session details unless necessary. If a response is identifiable, it is kept for up to 12 months and then deleted or made anonymous. Truly anonymous feedback is not personal data. If the message is a complaint, it follows the complaints process and seven-year retention period instead.

Your rights

You can ask for a copy of the information held about you, have inaccurate information corrected, ask for deletion or restriction in certain circumstances, object to how your information is used, ask for it to be transferred where that right applies, and withdraw consent where consent is the basis. Requests are normally answered within one month and free of charge. For an access request, the period starts once any reasonably required identity information and any fee lawfully charged have been received; if clarification is reasonably required, the period may pause while I wait for it. I will carry out reasonable and proportionate searches. These rights are not absolute; if a request cannot be met in full, I will identify the specific legal reason and explain your right to complain.

To exercise any right, email hello@rugbyhypnotherapy.co.uk.

Complaints

If you are unhappy with how your information has been handled, email me at hello@rugbyhypnotherapy.co.uk. I will acknowledge a data-protection complaint within 30 days, which is the maximum the law allows, and I aim to do it within five working days. I will take appropriate steps to investigate it without undue delay, keep you informed and provide the outcome without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. A service or professional-conduct complaint can be raised under my complaints procedure and, if unresolved after 28 days, with IPHM.

This website

This release uses direct email and Cal.com booking for enquiries. The Web3Forms information below applies to messages submitted through the previous website form.

Website hosting

The website uses GoDaddy-managed domain services and Host Europe infrastructure in Germany. Technical server logs may include an IP address, browser information and access time; these logs are kept by the host for a limited period for security and troubleshooting, then deleted.

Contact-form messages

Earlier website forms used Web3Forms, operated by Web3Creative from India, to deliver messages to Microsoft 365 using infrastructure in the United States and the European Union. Its Data Processing Agreement version 1.0, last updated 13 July 2026, applies where Web3Forms processes personal data for the practice and incorporates the UK Addendum and Standard Contractual Clauses for relevant international transfers. Under that agreement, submissions have a maximum lifetime of three years, and on ending the service data is deleted or returned within ninety days, subject to routine backup cycles. Web3Creative must notify me of a personal data breach within seventy-two hours. Web3Forms states that Microsoft Clarity may be used inside its provider dashboard; I do not open or use the submissions dashboard to read enquiries. I only access account settings, access keys, redirect URLs or billing where no client information renders.

Consultation bookings

Cal.com is a United States provider and supplies the consultation calendar; its code loads only when you choose to open the booking calendar. Cal.com’s privacy policy, effective 20 August 2026, says that the practice is controller and Cal.com is processor for booking data, that UK transfers use Standard Contractual Clauses or an adequacy mechanism, and that the service uses encryption and access controls. The practice Cal.com account is protected by a unique password and two-factor authentication. Booking fields are for appointment administration only; please do not enter health information or session notes. When you book, Cal.com creates a Zoom link and passes your name and email address to Zoom for that purpose.

Switching-off questionnaire

The optional switching-off questions run within your browser. Your selections are held only in the page’s memory while you use it. They are not submitted to the practice, added to a mailing list or stored in cookies or browser storage. Leaving or reloading the page clears the answers. The questionnaire and its complete summary are available without providing an email address. Switching Off After a Demanding Day is also sent as a welcome gift after you confirm a newsletter subscription.

The website host may still record the pages and files requested, along with technical information such as an IP address, as described above. These requests do not include questionnaire answers. Following a consultation link takes you to the separate contact and booking process.

Optional newsletter

The questionnaire and its complete summary are available without providing your email address. If you join the newsletter, Switching Off After a Demanding Day is sent as a welcome gift after you confirm. The separate newsletter form asks for your email address and an unticked choice to receive occasional practical ideas and news about Rugby Hypnotherapy workshops and services. I use your consent for these emails, under UK GDPR Article 6(1)(a). Making an enquiry or becoming a client does not automatically subscribe you.

You must confirm your email address before joining the newsletter list. After confirmation, a welcome email includes a link to the general guide. It is not personalised from your questionnaire answers. You can unsubscribe using the link in an email or by contacting hello@rugbyhypnotherapy.co.uk. You can keep the guide if you unsubscribe. Withdrawing consent does not affect the questionnaire or any services you receive.

Brevo provides the sign-up and email service on my instructions under its data processing agreement. The sign-up form sits on the newsletter page and submits straight to Brevo, so Brevo receives the details you enter and the practice website does not store them. It does not receive your questionnaire selections, results or session notes. The form carries no Brevo script or tracker. Brevo also processes technical information for service security and delivery. My Brevo account uses two-factor authentication.

Brevo is based in France. Transfers from the UK to France are covered by UK adequacy regulations. Brevo uses suppliers and support operations in other countries, including the United States and India. Its agreement requires safeguards for onward transfers, including contractual protections and supplementary measures where required. The supplier list and safeguards are in the agreement above; you can also contact me for information about the protections applying to your data.

Brevo emails can include an open-tracking pixel and rewritten links that record clicks. I cannot currently turn those measurement features off on this account. I do not use opens or clicks to infer a health condition, to personalise clinical work, or to decide who receives the newsletter. This sign-up form does not request tracking consent. Necessary confirmation, delivery, bounce and unsubscribe records are kept to administer your choice.

Remembering whether to show the newsletter invitation

You can hide the newsletter invitation if you have already subscribed or do not want to see it. By default, this only changes the current page and saves nothing for another visit. If you tick “Remember my choice on this browser for 90 days” before hiding it, you consent to a small local-storage record named rh_newsletter_invitation_v1. It contains only the preference version and its expiry time. It does not contain your email, subscription status, reason for hiding the invitation or questionnaire answers, and it is not sent to the practice or Brevo.

The saved choice applies to the newsletter invitation on this website in the same browser. It is used for up to 90 days and removed when you next visit after it expires. You can remove it sooner using the button below, the “Show invitation and forget preference” control beside the hidden invitation, or your browser’s website-data settings. If browser storage is blocked, hiding the invitation still works for the current page. This choice does not subscribe or unsubscribe you from emails, and the website does not look up whether you are a subscriber.

Advertising and analytics

Rugby Hypnotherapy does not deliberately use advertising or behavioural analytics on its own pages. If non-essential storage or tracking is added to the website, this notice will be updated and consent obtained where required.