Privacy Policy

 

1. Statement of Intent

This policy sets out how I will use and protect the information you provide when using my services and accessing this website.

I intend to ensure any data you provide is kept secure, managed respectfully and only used for the purposes for which it has been provided.

This policy will be updated periodically in line with current legislation.

When you contact me via phone or email I will collect your:

• Name
• Email Address
• Telephone Number
• Any information you choose to supply regarding the purpose of your enquiry

 

I process personal data only where I have a lawful basis under Article 6 UK GDPR and, where health information is involved, an additional condition under Article 9 UK GDPR.

 

Processing Activity	Lawful Basis	Special Category Condition
Enquiries via phone/email	Article 6(1)(f) Legitimate Interests	N/A
Booking and administering appointments	Article 6(1)(b) Contract	N/A
Clinical records and treatment notes	Article 6(1)(b) Contract and/or Article 6(1)(f) Legitimate Interests	Article 9(2)(h) Preventive or occupational medicine, assessment of working capacity, medical diagnosis, provision of health or social care or treatment
Contacting GP where clinically necessary	Article 6(1)(d) Vital Interests and/or Article 6(1)(f) Legitimate Interests	Article 9(2)(h)
Emergency contact/next of kin	Article 6(1)(d) Vital Interests	Article 9(2)(c)
Marketing emails/newsletters	Article 6(1)(a) Consent	N/A

 

Where I rely on legitimate interests as my lawful basis, these interests include managing my practice, communicating with clients, maintaining accurate clinical records, ensuring client safety and improving my services. I ensure that such processing is balanced against your rights and freedoms.

 

2. How is this information used?

I use this information in order to make contact with you to discuss your requirements. I may use anonymised or aggregated information, or where appropriate my legitimate interests under Article 6(1)(f), to evaluate and improve my services.

If you choose to proceed with making an appointment to see me, I will send you a copy of this Privacy Policy so that you are aware in advance how I will use information provided in the course of our sessions together.

I use your name, address, telephone number and email address to make and rearrange appointments and to follow up on treatment progress or referral requests. I am unable to send or receive encrypted emails so you should be aware that any emails I send or receive may not be protected in transit. I will also monitor any emails sent to me, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send me is within the bounds of the law.

I may use your date of birth to help identify clients with the same name to avoid mistakes being made as to safe and appropriate treatment, for identification purposes if referring a client to another health practitioner, and for identification purposes if writing to a registered medical practitioner so that they correctly identify the client.

I will ask you for your GP contact details and some basic health information: there are some conditions that are contra indicated for hypnotherapy and acupuncture, and sometimes there are circumstances where it may be necessary to contact your GP before commencing therapy. I will inform you of this at our appointment should this appear appropriate.

I may ask you for details of your next of kin: this is used very rarely and only in emergency situations.

You do not have to consent to the collection of information, however, if you choose not to provide it, I may not be able to work with you.

In the course of our sessions: I will ask for your email address for the purposes of sending you a recording to listen to as part of hypnotherapy. It may also be necessary to send emails to confirm or rearrange appointments.

I will make a note of information you provide me in order that we can plan bespoke therapy sessions and/or identify/produce bespoke hypnotherapy scripts which will be used in session and/or which can be sent to you to listen to between sessions.

For the purposes of clarity, I do not receive or retain your bank details.

Under the General Data Protection Regulations which are effective from May 2018, you have the following rights:

• the right to be informed (which is why we have produced this policy)
• the right of access: if you wish to see your file then please make a request in writing to Sandry Koo (Sandry@TheResetRoom.uk), the Data Controller and Data Processor. I will normally respond within one month of receiving your request. In certain circumstances, the response period may be paused where clarification or identity verification is reasonably required.
• the right to rectification: this is your right to request changes to any information I hold that is factually inaccurate. If you believe any of the information I hold on you is incorrect then please let me know as soon as possible and I will make the relevant changes.
• the right to erasure: given the nature of our work I am required to hold your details for a period of 8 years. At the end of the retention period, records are securely destroyed or permanently deleted.
• the right to restrict processing: I will only use the information for the purposes that I have stated above. I uphold the common law principles of confidentiality where the duty to keep confidence is measured against the concept of ‘greater good’. If in my opinion as a therapist there is good reason to believe not to disclose would cause danger or serious harm to self, the therapist or others then your GP or other appropriate agencies may be contacted. Only information required to ensure safety of relevant parties would be disclosed.
• Information may have to be disclosed without consent for the prevention, detection or prosecution of a crime. The sharing of anonymous case histories with supervisors and peer support groups is not a breach of professional confidentiality.
• the right to object: I will not contact you for marketing purposes unless you have given me specific consent to do so.
• the right not to be subject to automated decision-making including profiling: I will not use your information for profiling purposes.
• the right to withdraw your consent: where I rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

 

 

3. How will my data be stored?

In May 2018 the Data Protection Act was replaced by the General Data Protection Regulations (GDPR). The changes to the Data Protection Act are aimed at ensuring that your personal, confidential and sometimes sensitive data, is held privately and securely. The information I collect will be stored securely in a locked cabinet in my secure clinic, and/or in a password protected and encrypted drive or cloud-based server.

 

I implement appropriate technical and organisational security measures including password protection, encryption where appropriate, secure storage, restricted access, secure disposal procedures and processes for managing personal data breaches

Some of my service providers may store or process information outside the United Kingdom. Where this occurs, appropriate safeguards will be implemented in accordance with UK GDPR requirements, including reliance on adequacy regulations or approved contractual safeguards where applicable.

 

Once your therapy has ended, any paper documents may be scanned and stored electronically and then shredded.

 

4. Who may receive my information?

Your information may be shared, where necessary, with:

• your GP or other healthcare professionals;
• clinical supervisors (using anonymised information where possible);
• insurers and legal advisers where required;
• IT and cloud-storage providers;
• email providers;
• payment providers (excluding your bank details, which we do not retain);
• regulatory bodies where legally required.

 

 

5. How long will you hold my information for?

Adult client records are retained for eight years following the end of treatment in accordance with our professional and insurance obligations.

 

Records relating to children are retained until age 25 (or age 26 where treatment ended when the young person was aged 17).

 

At the end of the retention period, records are securely destroyed or permanently deleted.

 

6. What if I would like my data to be destroyed before this date?

In some circumstances, I may be unable to erase information where there is a legal, regulatory, insurance or legitimate business requirement to retain records, including for professional indemnity purposes.

 

7. Am I able to see or get a copy of the information held by you?

You have the right to request access to your personal data. I will undertake reasonable and proportionate searches for your personal information in accordance with UK GDPR and the Data (Use and Access) Act 2025.

 

I will normally respond within one month. In some circumstances, the response period may be paused if we require clarification of your request or further information to confirm your identity. Before responding to requests relating to your personal data, I may ask for information to verify your identity to ensure personal information is disclosed only to the correct individual.

 

8. Data Protection Complaints

If you are concerned about how your personal information has been used, you have the right to make a data protection complaint directly to me.

 

Complaints may relate to:

• access to your information;
• accuracy of records;
• retention of your information;
• confidentiality;
• lawful basis for processing;
• direct marketing;
• security incidents; or
• any other concern regarding how your personal data has been processed.

 

 

Complaints can be submitted electronically by email to Sandry@TheResetRoom.uk.

 

I will acknowledge your complaint and investigate it fairly and promptly. I will inform you of the outcome and any actions taken. Records of complaints and outcomes will be retained in accordance with my data protection obligations.

 

If you remain dissatisfied with how I have handled your personal information or your data protection complaint, you have the right to complain to the Information Commissioner’s Office (ICO).

 

9. Cookies

My website uses essential cookies necessary for the operation of the website and may use analytics cookies to understand how visitors use the site. Where required by law, consent will be requested before non-essential cookies are placed on your device. You may withdraw your consent at any time by adjusting your browser or cookie preference settings.

Cookies are small files which ask your permission to be placed on your computer’s hard drive so that it can analyse web traffic to my website. Through this I can see which of my website’s pages are being viewed. Most web browsers automatically accept cookies but you can modify your setting to decline them if you prefer. If you choose to do this you may find that you cannot make full use of my website.

10. Links to other websites

My website may contain links to other websites of interest. However, once you use these links please be aware that you have left my website and I do not have any control over other websites. I cannot be held responsible for the protection and privacy of any information which you provide when visiting such sites and these sites are not governed by my privacy policy. Please exercise caution and look at the privacy statement applicable to the website you are visiting.

 

 

 

ICO Registration No: ZA420816

Data Controller and Data Processor: Sandry Koo (Sandry@TheResetRoom.uk)

Sandry Koo at The Reset Room – Acupuncture and Hypnotherapy

Acupuncture: Lic Ac, BSc Hons, ARA, AAC

Clinical Hypnotherapy: HPD, DSFH, MNCH (reg), AfSFH (reg), CNHC (reg)

 

 

 

Version	Date
2.0	170626 – Updated to reflect the Data (Use and Access) Act 2025 and UK GDPR amendments effective in 2026.

 

END OF PRIVACY NOTICE