Two Chairs Therapy Privacy Policy

This privacy notice explains how Two Chairs Therapy Practice collects, uses, stores, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a member of the National Hypnotherapy Society, I am committed to safeguarding your privacy and maintaining strict client confidentiality.
 

1. Data Controller and Contact Details
 

I am the Data Controller for this practice. If you have any questions about this privacy notice or how your data is handled, please contact me:
​

• Practice Name: Two Chairs Therapy

• Address: Oxford Street Therapy Centre, Wellingborough

• Email Address: two_chairs_therapy@outlook.com

• Phone Number: 07404 101129
   

2. The Type of Personal Data Collected
 

I collect and process the following information:

• Personal Identifiers: Name, date of birth, address, email address, and phone number.

• Emergency Contact: Name and contact details of a trusted person or your GP.

• Special Category Data: Health history, lifestyle details, medical conditions, psychological history, and clinical session notes detailing your treatment and progress.
   

3. How Data is Collected and Stored (Cliniko)
 

Your data is collected directly from you via intake forms, emails, phone calls, and during our therapy sessions.

All electronic records—including your contact details, appointment history, medical questionnaires, and clinical session notes—are securely stored on Cliniko, a cloud-based practice management system.

• Cliniko complies with the UK GDPR and utilizes bank-grade, data encryption both in transit and at rest.

• Access to your Cliniko account is securely locked behind two-factor authentication (2FA) and is strictly restricted to authorized practice personnel.
  
   

4. Lawful Basis for Processing
 

Under the UK GDPR, the lawful bases I rely on for processing this information are:

• Consent: You explicitly agree to the processing of your data for hypnotherapy treatment when completing the client intake process.

• Legitimate Interests: Processing your data is necessary to provide safe, effective, and professional hypnotherapy services.

• Special Category Data Condition: I process health and therapy data under Article 9(2)(h) of the UK GDPR (the provision of health or social care or treatment).
   

5. Confidentiality and Data Sharing
 

Your session details and personal data are kept strictly confidential. I will never sell or share your data with third parties for marketing purposes. Your information will only be shared under the following exceptional circumstances:

• Safeguarding & Legal Duty: If I believe there is a significant risk of serious harm to yourself or others, or if I am legally compelled to do so by a court of law.

• Clinical Supervision: As required by the National Hypnotherapy Society, I regularly discuss cases with a clinical supervisor to ensure best practice. Your identity is always anonymised or kept strictly confidential during these sessions.

• Professional Referrals: With your explicit, written consent, I may share relevant notes with your GP or another medical specialist.
  
   

6. Data Retention
 

I retain your personal data and clinical session notes for a period of 7 years following the date of your last session, which aligns with standard professional indemnity insurance requirements and healthcare guidelines in the UK. For minors, records are retained for 7 years after they reach the age of majority (18). Once this period has elapsed, your data will be permanently and securely deleted from Cliniko.

 

7. Your Data Protection Rights
 

Under data protection law, you have several rights, including the right to:

• Access: Ask for copies of your personal information (Subject Access Request).

• Rectification: Request the correction of inaccurate or incomplete information.

• Erasure: Ask to erase your personal data in certain circumstances (please note this may be limited by my legal and insurance obligations to retain clinical records).

• Restriction: Request that I restrict the processing of your data.
   

8. How to Complain
 

If you have any concerns about how your data is handled, please contact me directly using the details above so I can resolve it. You also have the right to lodge a formal complaint with the UK data protection regulator:

• Information Commissioner’s Office (ICO)

• Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

• Helpline: 0303 123 1113 / Website: www.ico.org.uk