Privacy Policy

Last updated: 20 August 2026

This Privacy Policy explains how Gareth Thomas Hypnotherapy collects, uses, stores and protects your personal information.

Gareth Thomas, trading as Gareth Thomas Hypnotherapy, is the data controller responsible for the personal information covered by this policy.

1. Information collected

Information may be collected when you:

  • Complete the website contact form
  • Contact Gareth by email, telephone, text message, WhatsApp or social media
  • Arrange or attend a hypnotherapy session
  • Make a payment
  • Visit and use the website

This information may include:

  • Your name
  • Your email address and telephone number
  • Your preferred method of contact
  • Information included in your enquiry or correspondence
  • Appointment and session information
  • Payment and invoicing records
  • Technical information such as your IP address, browser type and cookie preferences

Please only provide information that is relevant to your enquiry.

2. Contact-form enquiries

When you submit the contact form, the information you provide is used to:

  • Respond to your enquiry
  • Answer your questions
  • Consider whether Gareth’s services may be suitable for you
  • Arrange an initial conversation or session
  • Maintain appropriate records of correspondence

Contact-form submissions may be stored securely within the website database and sent to Gareth by email.

The lawful basis for processing ordinary contact information is taking steps at your request before entering into a contract and, where appropriate, Gareth’s legitimate interest in responding to and administering enquiries.

3. Health and other sensitive information

You may voluntarily include information about your physical or mental health in your enquiry. Health information is classed as special-category personal data and requires additional protection.

Where health information is provided through the contact form, it will only be used to understand and respond to your enquiry, consider the suitability of the requested service and, where applicable, prepare for or provide hypnotherapy services.

The lawful basis for using this information is taking steps at your request before entering into a contract or performing the contract between you and Gareth. The additional condition relied upon for processing health information is your explicit consent.

You may withdraw your consent at any time by contacting Gareth. Withdrawing consent will not affect processing that has already taken place, but it may mean that Gareth cannot continue considering or providing a service where the information is necessary.

Please do not use the contact form for emergencies or provide more health information than is reasonably necessary at the enquiry stage.

4. How your information is used

Your personal information may be used to:

  • Respond to enquiries
  • Arrange and manage appointments
  • Provide hypnotherapy services
  • Maintain appropriate client and business records
  • Process payments and maintain financial records
  • Meet legal, professional, insurance and safeguarding obligations
  • Protect the website and prevent misuse
  • Establish, exercise or defend legal claims

Personal information will not be sold or rented to other organisations.

Gareth will not use your information for email marketing unless you have separately and expressly agreed to receive it.

5. Who may receive or process your information

Access to your information is restricted to Gareth and trusted service providers where access is necessary.

These may include:

  • HealthHosts/Webspeed Ltd, which provides website hosting, maintenance and technical support
  • Email, telephone and communications providers
  • PayPal and banking providers where you make a payment
  • Accountants, insurers, legal advisers or professional bodies where reasonably necessary
  • Public authorities, regulators or emergency services where disclosure is required by law or necessary to protect someone’s vital interests

These providers are only given the information required to perform their services and are expected to protect it appropriately.

6. International data transfers

Some technology, communications or payment providers may process information outside the United Kingdom. Where this happens, reasonable steps will be taken to ensure that appropriate legal safeguards are in place.

7. How long information is retained

Information is only retained for as long as it is reasonably required.

Unless a longer period is required for legal, insurance or professional reasons:

  • Enquiries that do not lead to a client relationship will normally be deleted within 12 months of the last contact
  • Client correspondence and session records will normally be retained for seven years following the final session
  • Financial and transaction records will normally be retained for six years
  • Cookie information is retained for the periods shown in the Cookie Policy

Information may be retained for longer where necessary to meet a legal obligation, respond to a complaint or establish, exercise or defend a legal claim.

8. Security

Reasonable technical and organisational measures are used to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

No method of sending information over the internet is completely secure. You should therefore avoid including unnecessary sensitive information in an initial email, text message or contact-form enquiry.

9. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • Ask for a copy of your personal information
  • Ask for inaccurate or incomplete information to be corrected
  • Ask for your information to be deleted
  • Ask for the use of your information to be restricted
  • Object to certain uses of your information
  • Receive information you provided in a portable format
  • Withdraw consent where consent is being relied upon

These rights are not absolute and may be subject to legal or professional record-keeping requirements.

To exercise a right or raise a concern, email gareththomashypno@btinternet.com.

There is normally no fee for exercising your data-protection rights.

10. Complaints

If you are concerned about how your information has been handled, please contact Gareth first so that the matter can be investigated.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

11. Cookies

The website uses cookies and similar technologies. Further information about the cookies used and how to control them is available in the Cookie Policy.

12. Changes to this policy

This policy may be updated when the website, services or legal requirements change. The latest version will always be published on this website with its revision date.