1. Introduction

EDV Hypnotherapy is a sole-practitioner therapy practice operated by Elise De Viell, providing Solution Focused Hypnotherapy, EMDR, and trauma therapy services to clients in Somerset and online. The practice operates from the Prometheus Therapy Centre in Taunton, The Castle Clinic in Bridgwater, and Highbridge Road in Burnham-on-Sea.

This policy sets out how EDV Hypnotherapy collects, uses, stores, and protects personal data in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018 (DPA 2018)
• Data (Use and Access) Act 2025 (DUAA 2025)
• Relevant professional standards including those of the CNHC and the BACP Ethical Framework

2. Data Controller

Name: Elise De Viell

Trading as: EDV Hypnotherapy

Address: 41 Highbridge Road, Burnham-on-Sea, Somerset, TA8 1LL

Website: edvhypnotherapy.co.uk

Email: edvhypnotherapy@gmail.com

Telephone: 07795 561905

ICO Registration Number: A8264320

Clinic locations: Prometheus Therapy Centre, Taunton; The Castle Clinic, Bridgwater; Highbridge Road, Burnham-on-Sea; online sessions available

3. What Personal Data I Collect

3.1 Client Data

I collect the following categories of personal data from clients or their representatives:

• Full name, date of birth, and contact details (address, telephone, email)
• GP name and surgery details
• Medical and mental health history, including diagnoses, medications, and previous treatments
• Presenting concerns, therapeutic goals, and session notes
• Emergency contact information
• Payment records (amount, method, date — not full card details)
• Communications sent to the practice by email, telephone, or contact form

3.2 Website and Enquiry Data

When you visit my website or make an enquiry, I may collect:

• Name and email address submitted via the website contact form
• Email messages and correspondence, including your email address and my responses
• Technical data including date and time of visits, pages viewed, time spent on the site, referring websites, and IP address — collected via cookies and web server logs
• Analytical data to assess visitor numbers and site performance (see Section 9: Cookies)

3.3 Newsletter / Mailing List

If you opt in to my newsletter, your name and email address will be held on a private, password-protected mailing list via Mailchimp, secured with two-factor authentication for my sole use. Every newsletter includes an unsubscribe link, and you may also request removal at any time by emailing edvhypnotherapy@gmail.com.

4. Legal Basis for Processing

I process personal data on the following lawful bases under UK GDPR Article 6 and Article 9:

• Article 6(1)(b) — Processing necessary for the performance of a contract (therapeutic agreement with clients)
• Article 6(1)(c) — Compliance with legal obligations (e.g. safeguarding, insurance requirements)
• Article 6(1)(f) — Legitimate interests (e.g. record-keeping, practice management, website security)
• Article 9(2)(h) — Processing of health data necessary for the provision of health or social care
• Article 6(1)(a) / Article 9(2)(a) — Explicit consent, where sought (e.g. newsletter sign-up)

5. How I Use Your Data

Personal data collected is used solely for the following purposes:

• Providing therapeutic services and maintaining clinical records
• Booking, rescheduling, and communicating about appointments
• Clinical risk assessment and safeguarding
• Referral to other professionals where clinically appropriate and with your agreement
• Processing payments and maintaining financial records
• Responding to complaints or enquiries
• Meeting insurance requirements and professional supervision obligations (anonymised where possible)
• Administering my business activities and improving my website and services
• Sending newsletters to those who have opted in
• Legal and regulatory compliance

I do not obtain personally identifying information about you when you visit my website unless you choose to provide it. I do not use personal data for marketing purposes without explicit consent, and I do not sell or transfer data to unaffiliated third parties without your approval.

I may use software programmes to create summary statistics — for example, to assess visitor numbers and site performance — and to monitor network traffic for security purposes. I may also disclose information when legally compelled to do so, or in good faith where I believe the law requires it or to protect my legal rights.

6. Data Sharing

I will only share personal data in the following limited circumstances:

• With your GP or another healthcare professional, where you have given consent or where there is a clinical or legal necessity
• With my clinical supervisor — only in anonymised form to protect your identity. In order to ensure continued best practice, I receive regular clinical supervision of my work with clients. During supervision it may be necessary to review your therapy, but any reference that could allow you to be identified is removed.
• With emergency services or safeguarding authorities, where there is a serious and immediate risk of harm to yourself or others (this may occur without your consent where necessary to protect life)
• With my professional indemnity insurer, in the event of a complaint or legal claim
• With third-party processors used in the operation of the practice (see section 8)
• When legally compelled to do so

It is my policy not to transfer data to any other organisation. I will not sell or otherwise transfer personally identifying information to unaffiliated third parties without your approval at the time of collection.

7. Professional Will

I hold a professional will with my clinical supervisor. This means that if anything should happen to me, your personal data is safe and will be disposed of correctly, in accordance with the retention periods set out in section 8 and in compliance with UK GDPR.

8. Data Retention

I retain personal data for the following periods, in line with professional guidance:

• Adult client records: 7 years from the date of last contact, or from the date of the client’s 18th birthday if they were a minor when therapy ended
• Records relating to deceased clients: 7 years from the date of death
• Financial records: 6 years, in accordance with HMRC requirements
• Enquiry and contact form data (non-clients): 12 months from last contact, unless therapy commences
• Newsletter / mailing list data: retained until you unsubscribe or request removal
• Social media messages: held until the query has been resolved, then deleted

After the applicable retention period, paper records are shredded securely and digital records are permanently deleted. I do not retain data for longer than is necessary for its purpose.

9. Cookies

My website uses cookies and web server logs to collect information about how the site is used. Information gathered may include the date and time of visits, pages viewed, time spent on the site, websites visited before and after, and your IP address.

I also use analytical cookies to provide meaningful reports about site visitors. These cookies allow me to recognise and count visitors and see how they move around the site, helping me to improve the way my website works. These analytical cookies do not collect personal data about you.

You can turn off cookies by blocking them in your browser privacy settings.

10. Third-Party Data Processors

I use the following third-party services that may process personal data on my behalf:

• Mailchimp — newsletter and mailing list management (password-protected, two-factor authentication)
• Practice management / scheduling software — appointment booking and records
• Website hosting — edvhypnotherapy.co.uk
• Bookkeeping / accounting software — payment records
• Social media platforms (e.g. Facebook) — I use social media to post articles of interest and to respond to messages. Social media platforms hold their own data protection policies. Messages are stored until a query is resolved and then deleted.

Where any processor is based outside the UK, I ensure appropriate transfer mechanisms are in place in accordance with UK GDPR Chapter V.

11. Links to Other Websites

My website may contain links to other websites of interest. Once you use these links, please be aware that you have left my website and I do not have any control over other sites. I cannot be held responsible for the protection and privacy of any information you provide when visiting such sites, as they are not governed by this policy. I advise you to exercise caution and review the privacy statement of any website you visit.

12. Email Communications

Email is not recognised as a secure medium of communication. For this reason, I request that you do not send private or sensitive information to me by email. However, doing so is permitted at your own risk.

Some information entered on my website may be transmitted securely via Secure Sockets Layer (SSL). If you choose to correspond with me by email, I may retain the content of your messages together with your email address and my responses, and provide the same protections for these communications as I do for other information received.

13. Data Security

I take appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, or destruction. These measures include:

• Password-protected devices with up-to-date security software
• Encrypted email for sharing sensitive information where required
• Paper records stored in a locked cabinet, accessible only to me
• Secure destruction of paper records at end of retention period
• Access to electronic records limited to me only
• Regular review of security measures

In the event of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, I will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, and affected individuals where required.

14. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data I hold about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure — to request deletion of your data, subject to legal and professional obligations
• Right to restriction — to request that I limit processing of your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Rights related to automated decision-making — I do not use automated decision-making or profiling

To exercise any of these rights, please submit your request in writing to edvhypnotherapy@gmail.com or to the address in section 2. I will respond within one month of receiving your request. There is no charge for this, unless requests are manifestly unfounded or excessive.

15. Special Category Data

Health and mental health information is classified as special category data under UK GDPR Article 9. I process this data only where necessary for the provision of therapy and where the appropriate legal basis applies. All special category data is handled with the highest level of care, stored securely, and never shared without necessity or your explicit consent, except where required by law.

16. Children and Young People

I am happy to work with children from 10 years old and above, subject to the following conditions. I ask that minors under the age of 16 do not submit any personal information to me directly via my website. If you are a minor, you may use this site only with the permission and guidance of a parent or guardian.

Any consultations with a minor must be carried out with a parent or guardian present, and any subsequent sessions will be conducted with the parent or guardian on the premises. I hold an up-to-date enhanced DBS certificate.

Where I work with clients under the age of 16, I obtain written consent from a parent or legal guardian prior to commencing therapy, and records are retained in accordance with the extended retention period noted in section 8. I take particular care with data relating to children and am mindful of my safeguarding responsibilities at all times.

17. Complaints

Most concerns can be resolved quickly by discussing them with me directly, and I ask that you do this in the first instance. I aim to respond to all complaints within 30 days. If you have a concern about how I handle your personal data and are not satisfied with my response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

18. Policy Changes

I reserve the right to amend this policy at any time. However, if this policy changes in the future, I will not use the personal information you have previously submitted in a manner that is materially inconsistent with this policy without your prior consent. I am committed to conducting my business in accordance with these principles to ensure the confidentiality of personal information is protected and maintained.

This policy is reviewed annually, or sooner if there are significant changes in law, professional guidance, or the way the practice operates.

Date: 24 June 2026

Next scheduled review: June 2027

Version: 2.0