Privacy Policy

Katie Higgins Hypnotherapy

Last updated: 3 November 2026

1. Introduction
 

At Katie Higgins Hypnotherapy, your privacy, confidentiality and trust are extremely important to me. I understand that seeking Hypnotherapy can involve sharing personal, private and sometimes sensitive information, and I am committed to treating that information with care, respect and professionalism.

This Privacy Policy explains how I collect, use, store and protect your personal information when you visit my website, make an enquiry, book an appointment or receive Hypnotherapy services.

I am committed to handling your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
 

2. Who Is Responsible for Your Information?
 

Katie Higgins Hypnotherapy is operated by Katie Higgins, an independent, self-employed Hypnotherapist registered with the General Hypnotherapy Register (GHR) and the Complementary and Natural Healthcare Council (CNHC).

I am the Data Controller for personal information collected and processed in connection with my private Hypnotherapy practice. This means I am responsible for deciding how and why your information is used and ensuring it is handled appropriately.

Business name: Katie Higgins Hypnotherapy

Data Controller: Katie Higgins

Website: www.katiehigginshypnotherapy.com

Email: katie@katiehiggins.biz

Business contact address: 9 Orchard Way, Send, Woking, GU23 7HS

ICO Registration Number: CSN0973286

If you have any questions about how your personal information is used, please contact me using the details above.

​

3. What Personal Information Do I Collect?
 

When you contact me or begin Hypnotherapy, I may collect information relevant to your enquiry, appointments and therapeutic needs.

This may include:

• Your name, address, telephone number and email address.

• Your date of birth or age.

• Information provided through website enquiries, emails or telephone conversations.

• Appointment details and relevant correspondence.

• Information about your physical and emotional wellbeing, medical history, medication, symptoms or previous therapeutic experiences, where relevant.

• Information about the difficulties you are experiencing, your personal circumstances and your goals for Hypnotherapy.

• Information recorded on pre-session questionnaires, consultation forms and client agreements.

• Confidential notes made during or following Hypnotherapy sessions.

• Information required for invoicing, payment records and business administration.

• Relevant information about parents or guardians when working with children or young people.

• Limited technical information associated with website visits, cookies and online enquiries, as described in Section 12.

I aim to collect only the information necessary and relevant to providing appropriate Hypnotherapy services and managing my practice.

You are welcome to ask why particular information is requested.
 

4. Why Do I Collect and Use Your Information?
 

I use personal information for the following purposes:

Responding to enquiries: To answer your questions, discuss whether Hypnotherapy may be suitable and provide information about my services.

Providing Hypnotherapy: To understand your individual circumstances, establish therapeutic goals, plan sessions and support continuity of care.

Maintaining appropriate client records: To keep accurate, relevant and confidential records of consultations, sessions and therapeutic progress.

Managing appointments: To arrange sessions, communicate about bookings, manage cancellations and provide appointment-related information.

Business administration: To maintain necessary financial, accounting and administrative records.

Legal and professional responsibilities: To comply with applicable legal requirements, manage complaints, respond to legal claims and maintain appropriate professional standards.

Website administration and advertising: To maintain website functionality, understand relevant website interactions and measure the effectiveness of advertising, subject to applicable data protection and cookie consent requirements.

I do not sell your personal information.

Your personal information will not be used for unrelated direct marketing without an appropriate legal basis and compliance with applicable marketing rules.
 

5. Legal Basis for Processing Your Information

​

Under UK GDPR, personal information must be processed on an appropriate lawful basis.

Depending on the purpose and circumstances, I may rely on:

Contract — Article 6(1)(b): Where processing is necessary to provide the Hypnotherapy services you have requested or to take steps towards entering into a therapeutic agreement with you.

Legitimate Interests — Article 6(1)(f): Where processing is necessary for the reasonable operation and administration of my practice, such as responding to general enquiries, maintaining appropriate business communications, securing information and managing legitimate professional interests, provided these interests are not overridden by your rights.

Legal Obligation — Article 6(1)(c): Where I am required to retain or disclose information to comply with applicable legal obligations, including relevant financial and tax requirements.

Consent — Article 6(1)(a): Where I specifically ask for your permission to process personal information for a particular purpose for which consent is the appropriate lawful basis, including certain optional website tracking activities.

​

Sensitive Personal and Health Information

​

As a registered Hypnotherapist with the General Hypnotherapy Register (GHR) and the Complementary and Natural Healthcare Council (CNHC), I recognise the importance of protecting sensitive information shared during the therapeutic process.

​

Hypnotherapy may involve the collection and processing of information concerning your physical health, mental health, emotional wellbeing, medical history, medication and personal circumstances.

​

Some of this information is classified as special category personal data under UK GDPR and receives additional protection.

​

For the routine processing of relevant health-related and other special category information necessary to provide Hypnotherapy services, I rely on Article 9(2)(a) of UK GDPR — Explicit Consent, alongside an appropriate Article 6 lawful basis.

I seek and record your explicit consent through the initial consultation and client agreement process, before undertaking processing that relies on this condition.

This information is used for specified therapeutic purposes, including assessment, planning and providing Hypnotherapy, maintaining appropriate treatment records and supporting continuity of care.

​

You have the right to withdraw your explicit consent at any time by contacting me using the details in Section 2. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

​

If you withdraw consent for the processing of information essential to providing Hypnotherapy safely and appropriately, I may be unable to continue providing treatment.

​

Where consent is withdrawn, I will stop processing that depends on that consent. Certain records may be retained or processed for a distinct lawful purpose where another applicable legal basis and special category condition genuinely apply, including where necessary for establishing, exercising or defending legal claims.

All sensitive information is treated confidentially and protected through appropriate security and data protection measures.

​

6. How Is Your Personal Information Stored and Protected?

​

I take the security and confidentiality of client information seriously and use appropriate organisational and technical measures to protect it against unauthorised access, disclosure, loss, alteration or misuse.

Depending on how information is received and used, client records may be stored electronically, in secure cloud storage or as paper records.

Electronic records are protected using appropriate security controls, including password-protected access and safeguards relevant to the systems in use.

Paper records are stored securely with access restricted to authorised individuals.

I aim to ensure that personal information is accessible only when necessary for legitimate therapeutic, administrative or legal purposes.

​

Where third-party technology providers are used, I assess relevant privacy and security arrangements and ensure appropriate data protection measures are in place.

​

Although no storage or communication system can be guaranteed completely secure, I take reasonable steps appropriate to the sensitivity of the information held.

7. Confidentiality and Sharing Your Information

​

Confidentiality is a fundamental part of my Hypnotherapy practice.

Information shared during your consultations and therapy sessions is treated as private and confidential.

​

I will not routinely disclose personal details of your sessions to family members, employers or other third parties.

​

There may, however, be limited circumstances where information needs to be shared, including:

• Where you have specifically authorised disclosure to another professional or organisation.

• Where information is processed by trusted service providers supporting my practice, subject to appropriate data protection arrangements.

• Where disclosure is required by law, a court order or another applicable legal obligation.

• Where disclosure is necessary and legally justified to address a serious safeguarding concern or protect someone's vital interests.

• Where information is relevant to a professional complaint, insurance matter or legal claim, and disclosure is lawful and necessary.

Where I seek professional supervision or consultation, information will be anonymised wherever reasonably possible.

Any disclosure will be limited to what is necessary and appropriate in the circumstances.

​

8. Online Hypnotherapy Sessions

​

Some Hypnotherapy sessions are delivered remotely using Zoom or another agreed online communication service.

​

When attending an online session, certain technical and account information may be processed by the platform provider to enable the session to take place.

I take reasonable steps to protect the privacy of online consultations, including using appropriate meeting security settings and conducting sessions in a private environment.

​

You are encouraged to attend online sessions in a private and comfortable space where your conversation cannot easily be overheard.

If a session is to be recorded, the purpose, arrangements for storing and retaining the recording, and any consent required will be explained separately in advance.

​

9. How Long Do I Keep Your Information?

​

I retain personal information only for as long as necessary for the purposes for which it was collected, taking account of relevant legal requirements, professional guidance, insurance conditions and the need to maintain appropriate therapeutic records.

​

Different types of information may need to be retained for different periods.

My current record-retention arrangements are:

Client questionnaires, consultation forms and Hypnotherapy session notes: A minimum of eight years following the final appointment, subject to applicable professional, insurance and legal requirements.

Client enquiries: A minimum of eight years under my current retention arrangements, subject to review to ensure continued retention is necessary and proportionate.

Email correspondence, including contact forms: A minimum of eight years under my current retention arrangements, subject to review of the purpose and necessity of retention.

Financial and accounting records: Retained in accordance with applicable HMRC requirements.

Records relating to children and young people may need to be kept for longer, taking account of their age at the end of treatment and relevant professional or insurance requirements.

​

When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

​

If you would like further information about the retention period applicable to your records, you may contact me.

​

10. Your Rights Under UK GDPR
 

You have rights concerning the personal information held about you. Depending on the circumstances and applicable law, these may include:

The right to be informed: To understand how and why your information is used.

The right of access: To request a copy of personal information held about you.

The right to rectification: To request the correction of inaccurate or incomplete personal information.

The right to erasure: To request deletion of personal information in circumstances where the law provides this right.

The right to restrict processing: To request that the use of your information is limited in certain circumstances.

The right to data portability: To receive certain personal information in a portable format where the relevant legal conditions are met.

The right to object: To object to certain types of processing, including processing based on legitimate interests.

Rights relating to automated decision-making: To receive applicable protections in relation to certain significant decisions made solely by automated means.

These rights are not absolute and may be subject to legal exemptions or restrictions.

If you would like to exercise any of your rights, please contact me using the details in Section 2.

I will respond within the timeframes required by applicable data protection legislation, normally within one calendar month, subject to any permitted extension.

11. Children and Young People

​

When providing Hypnotherapy to children or young people, I take particular care in handling their personal information and safeguarding their privacy.

Only information necessary for enquiries, therapeutic assessment, appointments and the provision of Hypnotherapy is collected.

Where appropriate, parental or guardian involvement and consent are sought, taking account of the child's age, maturity, understanding, capacity and applicable legal requirements.

Children and young people are provided with clear, age-appropriate explanations of how their information will be used, stored and protected.

The confidentiality and privacy of young clients are respected. Information is shared with parents, guardians or other professionals only where appropriate, lawful or necessary for safeguarding purposes.

Records relating to children and young people are handled with particular care and retained in accordance with appropriate professional, insurance and legal requirements.

12. Website Enquiries and Cookies

When you visit my website or submit an enquiry, certain personal information may be collected, including the contact details you choose to provide.

My website is hosted by Wix and uses cookies and similar technologies to support website security, essential functionality, website performance and user preferences.

I also use Google Ads to promote my Hypnotherapy services. Google advertising technologies, including Google Tag Services and Google Advertising Services, may use cookies or similar technologies to measure advertising effectiveness, understand relevant website interactions and support advertising activities.

Where legally required, advertising technologies and other non-essential cookies are only activated after you have provided the appropriate consent through the website's cookie consent system.

The website uses Usercentrics for Wix to manage cookie preferences.

When you visit the website, you can accept or reject optional cookies and review your preferences through the cookie consent banner.

You can also change or withdraw your consent through the cookie settings available on the website.

Essential cookies may remain active where necessary for website functionality or where another applicable exemption applies.

Further information about the cookies used, their providers, purposes and how to manage your preferences can be found in my separate Cookie Policy, available on this website.

For security and confidentiality, please avoid submitting detailed or highly sensitive medical information through general website enquiry forms unless specifically requested through an appropriate secure process.

​

13. Third-Party Services and International Data Transfers

I may use third-party services to support the administration and delivery of my practice.

These may include:

• Wix for website hosting and website functionality.

• Usercentrics for cookie consent management.

• Google Ads and associated Google technologies for advertising and campaign measurement.

• Zoom for online Hypnotherapy consultations.

• Email and cloud storage providers for business communications and secure record keeping.

These providers may process limited personal information on my behalf or in connection with their services.

Some providers may process or store personal information outside the United Kingdom.

Where personal data is transferred internationally, I will ensure that an appropriate lawful transfer mechanism or other applicable protection is in place, such as UK adequacy regulations or appropriate contractual safeguards, depending on the circumstances.

You can contact me if you would like further information about relevant service providers or international data transfer arrangements.
 

14. Complaints and Concerns

If you have a concern about the way your personal information has been handled, I would welcome the opportunity to discuss it and resolve the matter.

Please contact me using the details provided in Section 2.

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection.

Information Commissioner's Office

Website: www.ico.org.uk

Telephone: 0303 123 1113

You can contact the ICO if you remain dissatisfied with the way your information has been handled.

​

15. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my professional practice, the services I provide, the technology I use or applicable data protection legislation.

The latest version will be available on my website, with the date of the most recent update shown at the beginning of the document.

Katie Higgins Hypnotherapy

www.katiehigginshypnotherapy.com

katie@katiehiggins.biz

ICO Registration Number: CSN0973286