Privacy Policy
Last updated: 1 October 2026
I respect your privacy and handle your personal information with care. This policy explains how I collect, use, store and share information when you visit my website, contact me or use my services.
Who is responsible for your information?
I am Clare Barton-Knott, a sole trader trading as CBK. I am the data controller responsible for your personal information.
Email: clare@cbkhypnotherapy.co.uk
Website: www.cbkhypnotherapy.co.uk
Please contact me if you have questions about this policy or wish to exercise your data protection rights.
What information I collect
Depending on your contact with CBK, I may collect:
Your name, contact details and how you heard about me.
Enquiry, booking and payment information.
Relevant information about your health, wellbeing, circumstances and goals.
Assessment information, session notes and communications relating to our work.
Your location and relevant emergency contact information where needed for safety.
Records of consent and the materials or personalised recordings provided to you.
Newsletter preferences and basic website usage information.
I collect only information reasonably needed for the purpose. Booking an Initial Conversation does not require you to submit health information. If we discuss relevant health information during the conversation, I will explain its use and ask for your explicit consent first.
You may choose not to provide information. However, without information reasonably needed to assess suitability or provide a service safely, I may be unable to proceed.
How I obtain and use your information
Most information comes directly from you through forms, appointments, emails and other communications. If another professional provides information about you, I will normally obtain your permission first, unless an applicable legal requirement or confidentiality exception permits otherwise.
I use information to:
Respond to enquiries and arrange appointments.
Assess suitability and provide the services you request.
Prepare agreed exercises, resources or personalised recordings.
Keep appropriate records and review our work.
Support professional supervision.
Manage payments, accounting and practice administration.
Address safety concerns, complaints or legal claims.
Send marketing emails where you have opted in.
Operate and improve the website.
My legal reasons for using information
Under UK data protection law, I rely on the following lawful bases, depending on the purpose:
Contract: to provide services you have booked or take steps you request before entering into an agreement.
Legitimate interests: to manage enquiries, administer and protect my practice, maintain appropriate professional records, support supervision, and establish, exercise or defend legal claims. I balance these interests against your rights and privacy.
Consent: for optional activities such as marketing emails, recording hypnotherapy during an appointment, and non-essential cookies.
Legal obligation: to meet applicable legal requirements, including tax and accounting requirements.
Health information requires an additional legal condition. I rely on your explicit consent to use relevant health information for suitability assessment, providing the agreed service and maintaining associated records. Where relevant health information is necessary for legal claims, I may rely on Article 9(2)(f) of the UK GDPR. Other conditions may apply where necessary and lawful for emergency or safeguarding purposes.
Confidentiality and sharing information
I do not sell your personal information.
I may share relevant information:
With service providers supporting website hosting, booking, payments, video appointments, email, secure storage and email marketing.
With a professional involved in your care, normally with your permission.
With a suitably qualified supervisor, using anonymised information wherever possible and limiting any identifiable information to what is necessary.
Where disclosure is necessary and lawful to address a serious risk of harm, meet safeguarding responsibilities or comply with the law.
With insurers or professional advisers where necessary to address a complaint or legal claim.
Where appropriate and safe, I will aim to discuss disclosure with you beforehand. I limit what is shared to information needed for the purpose.
Some service providers process information outside the UK. Where this involves a restricted international transfer, appropriate safeguards are required, such as UK adequacy arrangements or approved contractual safeguards. You can contact me for information about the providers and safeguards relevant to your data.
Hypnotherapy recordings
I do not record whole therapy or coaching sessions.
With your prior agreement, I may record the hypnotherapy portion of an appointment for you to use between sessions. You may decline this without affecting the service you receive. I may also provide recordings prepared separately from appointments.
Where a recording contains your voice or personal information, I handle it securely. I may retain a personalised recording within your client record to document the material provided and address potential complaints or legal claims. It follows the client-record retention period below.
How I protect and retain information
I use appropriate security measures to protect your information. Paper records are kept securely, and electronic records are held on protected devices or services with access restricted to those who need it.
Appointment and client records: retained for seven years after your final appointment to document the services provided and address potential complaints or legal claims.
Enquiries that do not lead to appointments: retained only for as long as reasonably necessary to respond and manage the enquiry.
Tax and accounting records: retained for at least five years after the 31 January submission deadline for the relevant tax year, or longer where HMRC requires it.
Marketing information: retained while you subscribe. If you unsubscribe, I may keep a minimal record of that preference to prevent further marketing.
Records may be retained longer where necessary for an ongoing complaint, claim or legal requirement. When no longer needed, electronic information is securely deleted and paper records are shredded.
Marketing and cookies
You receive CBK marketing emails only if you opt in. You can unsubscribe using the link in an email or by contacting me.
The website uses necessary cookies and may, with your permission, use analytics or other non-essential cookies. Further information and options for managing preferences are available in the Cookie Policy and website cookie settings.
Your rights
Depending on the circumstances, you can ask to:
Access your personal information.
Correct inaccurate or incomplete information.
Delete information.
Restrict its use.
Transfer information to you or another organisation.
You also have the right to object to processing based on legitimate interests, and to object to direct marketing at any time.
Where I rely on consent, you can withdraw it by emailing clare@cbkhypnotherapy.co.uk. Withdrawal does not affect processing already carried out lawfully. It may affect whether I can continue providing a service that requires the information. Some records may still need to be retained under another applicable legal basis.
Requests are normally free of charge. I will usually respond within one month. If a lawful extension is needed, I will explain this within that period.
Concerns or complaints
Please contact clare@cbkhypnotherapy.co.uk if you have concerns about how I handle your information. I will acknowledge your complaint within 30 days, investigate without undue delay and inform you of the outcome.
You also have the right to complain to the Information Commissioner’s Office:
Website: https://ico.org.uk
Telephone: 0303 123 1113
Changes to this policy
I review this policy and update it when necessary. The current version is published here. If I introduce a materially different use of your information, I will bring it to your attention as appropriate before that use begins.