Last updated: June 2026

Introduction

Caroline Sutton Hypnotherapy Services Ltd is committed to protecting your privacy and ensuring that your personal information is handled safely, securely and transparently.

This Privacy Notice explains how personal information is collected, used, stored and protected in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

By engaging in therapy services, you acknowledge that you have read and understood this Privacy Notice.

Who We Are

Caroline Sutton Hypnotherapy Services Ltd provides psychotherapy, counselling, hypnotherapy and therapeutic support services.

The practitioners currently working within the practice are:

Caroline Sutton
Psychotherapist and Solution Focused Hypnotherapist

Emily Sutton
Psychotherapist and Solution Focused Hypnotherapist

Debs Blue
Qualified Therapeutic Counsellor and Registered Member of the British Association for Counselling and Psychotherapy (BACP). Debs works from a person-centred perspective and may integrate play and art-based approaches where appropriate to the client’s age, needs and therapeutic goals.

Mark Lyles
Psychotherapist and Solution Focused Hypnotherapist

Data Controllers

Each practitioner works as an independent practitioner and is responsible for the personal information they collect and process in relation to their own clients.

Each therapist maintains their own professional registration, insurance arrangements, supervision requirements and clinical records and acts as an independent Data Controller for the clients they work with.

Client contact details, appointment information and booking records may be stored within shared practice systems to facilitate appointment scheduling, communication and administration.

Clinical records remain the responsibility of the therapist providing your care.

What Information We Collect

Depending on the services provided, your therapist may collect and process:

• Name
• Address
• Date of birth
• Telephone number
• Email address
• Emergency contact details
• GP details
• Relevant medical and health information
• Information relating to your wellbeing and therapeutic goals
• Appointment records
• Clinical notes
• Payment and invoicing information

Only information that is relevant and necessary for providing therapeutic services is collected.

Why We Collect Information

Personal information is collected to:

• Provide safe and effective therapeutic services
• Assess suitability for therapy
• Maintain accurate clinical records
• Arrange and manage appointments
• Process payments and invoices
• Meet professional and legal obligations
• Protect the welfare and safety of clients
• Communicate regarding therapy services

Lawful Basis for Processing

Personal information is processed under the lawful basis of Legitimate Interests.

Purpose

The purpose of processing personal information is to provide professional therapeutic services, maintain clinical records, manage appointments, fulfil professional obligations and ensure client safety.

Necessity

Only information necessary for the provision of therapy and related services is collected and processed.

Balance

We recognise your right to privacy and ensure that any information collected is proportionate, relevant and necessary. Appropriate safeguards are in place to protect personal information and prevent unauthorised access.

Where health information is processed, this constitutes special category data and is processed under Article 9(2)(h) UK GDPR for the provision of health and therapeutic services.

How Your Information Is Stored

Personal information is stored securely using appropriate technical and organisational measures.

These may include:

• Password-protected devices
• Secure cloud-based systems
• Encrypted software platforms
• Secure email systems
• Locked storage for paper records where applicable
• Secure destruction procedures when records reach the end of their retention period

Access is restricted to authorised individuals who require access for legitimate professional or administrative purposes.

Practice Management Systems

The practice uses secure third-party systems to support the delivery of services, including:

• Ovatu for appointment scheduling and client management
• Stripe for payment processing
• Secure email and communication systems

These providers act as data processors and are required to comply with applicable data protection legislation.

Clients are encouraged to review the privacy policies of any third-party services used in connection with their care.

Administrative Support

Authorised administrative personnel may have access to contact information, appointment details and payment records where necessary for:

• Scheduling appointments
• Responding to enquiries
• Processing payments
• Managing practice systems
• Providing administrative support

Administrative personnel are required to maintain confidentiality and comply with applicable data protection legislation.

Administrative staff do not routinely access clinical notes.

Clinical Supervision

All therapists undertake regular professional supervision in accordance with the requirements of their professional bodies and insurers.

Supervision helps ensure that therapy services remain safe, ethical and effective.

Client information may be discussed within supervision for professional purposes. Wherever possible, identifying details are minimised and supervisors are bound by confidentiality and professional standards.

Confidentiality

Information shared during therapy is treated as confidential.

However, confidentiality may be limited where:

• There is a serious risk of harm to yourself
• There is a serious risk of harm to another person
• There are safeguarding concerns involving a child or vulnerable adult
• Disclosure is required by law
• A court order requires disclosure
• Disclosure is necessary for the prevention or detection of serious crime

Where appropriate and safe to do so, any disclosure will usually be discussed with you first.

Sharing Information

Personal information will not be shared with third parties without your knowledge unless:

• You have provided consent
• There is a safeguarding concern
• There is a legal obligation to disclose information
• Disclosure is required by a court order
• Disclosure is necessary to prevent serious harm

Information may be shared with healthcare professionals where appropriate and with your consent unless safeguarding or legal considerations require otherwise.

Retention of Records

Records are retained in accordance with professional, legal and insurance requirements.

As a general guide:

• Adult client records are retained for a minimum of eight years following the end of therapy.
• Records relating to children and young people are normally retained until the client’s 25th birthday, or 26th birthday where therapy ended when the client was aged 17.

Following the retention period, records are securely destroyed.

Your Rights

Under UK GDPR you have the right to:

• Access your personal information
• Request correction of inaccurate information
• Request restriction of processing in certain circumstances
• Object to processing where applicable
• Request data portability where relevant
• Lodge a complaint regarding the processing of your personal information

Please note that the right to erasure is not absolute and may not apply where therapists are required to retain records for legal, professional or insurance purposes.

Subject Access Requests

You have the right to request a copy of the personal information held about you.

Requests should be made in writing to the therapist providing your care.

Requests will normally be responded to within one calendar month in accordance with UK GDPR requirements.

Data Protection Complaints

If you have concerns about how your personal information has been collected, stored, used or shared, you have the right to make a complaint.

Complaints relating specifically to the handling of personal data should be submitted in writing to the therapist providing your care or to Caroline Sutton Hypnotherapy Services Ltd.

We will:

• Acknowledge receipt of your complaint within 30 days
• Investigate the matters raised
• Keep you informed of progress where appropriate
• Provide a written outcome without undue delay

Data protection complaints relate specifically to the use of personal information and are separate from complaints relating to therapy outcomes, clinical decisions or professional conduct.

Information Commissioner’s Office

If you remain dissatisfied following the outcome of a complaint, you have the right to contact the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection.

Website: ico.org.uk

Contact Us

If you have any questions about this Privacy Notice or how your information is processed, please contact the therapist providing your care or Caroline Sutton Hypnotherapy Services Ltd.

This Privacy Notice may be updated periodically to reflect changes in legal requirements, professional guidance or practice procedures.