Privacy Notice
How Mind Beyond Hypnotherapy collects, uses, and protects your personal information.
Last updated: August 2026
About this notice
Mind Beyond Hypnotherapy is operated by Maria, a student hypnotherapy practitioner currently completing her professional training, based in the UK. For the purposes of UK data protection law, I am the data controller for personal information collected through this website and in connection with hypnotherapy sessions. You can contact me at [email protected].
What information I collect
I may collect the following types of personal information: your name, email address, and telephone number when you make an enquiry or book a session; information you provide in a client intake form, which may include details about your physical or mental health, your reasons for seeking hypnotherapy, and relevant personal history; correspondence you send by email or through the contact form on this website; and technical data such as your IP address and browser type, collected automatically when you visit the site.
Special-category data
Information about your physical or mental health is special-category personal data under UK GDPR and receives additional protection. I collect this information only where it is necessary to provide hypnotherapy services to you. The lawful basis for processing this data is Article 9(2)(h) UK GDPR — processing necessary for the provision of health or social care — and, where applicable, your explicit consent. You will be asked to confirm your consent before completing an intake form.
How I use your information
I use your personal information to: respond to your enquiries and arrange sessions; prepare for and conduct hypnotherapy sessions tailored to your needs; maintain confidential client records as required by professional practice standards; comply with my legal and safeguarding obligations; and improve this website. I do not use your information for automated decision-making or profiling.
Lawful basis for processing
For general enquiry and contact data, my lawful basis is legitimate interests (responding to your request). For session and health-related data, my lawful basis is the performance of a contract (providing hypnotherapy services) and, for special-category health data, Article 9(2)(h) UK GDPR. Where I rely on consent, you may withdraw it at any time by contacting me.
How long I keep your information
I keep different types of information for different periods, depending on why it was collected and what I am required to retain. Client and case-study records — including intake forms, session notes, and related correspondence — are retained securely for a minimum of five years, in accordance with my professional insurance requirements. Records may be kept for longer where there is a lawful, regulatory, professional, insurance-related, or other justified reason to do so. General enquiry and contact-form data — where you have made an enquiry but have not proceeded to a session — is retained for up to 12 months from the date of your last contact, after which it is securely deleted where there is no continuing lawful or legitimate reason to retain it. This website is hosted on a third-party platform (GoDaddy Airo). Where you have given your consent through the cookie banner on this site, the platform may collect analytics data about your visit — such as pages viewed, links clicked, and general device and browser information — to help understand how the site is used. This data is processed by GoDaddy in accordance with their privacy policy. No analytics data is collected unless you have accepted cookies. You can change or withdraw your analytics consent at any time using the Cookie Preferences control on this website.
Who I share your information with
Your information is treated as confidential, subject to the limited exceptions explained in this notice. I do not sell, rent, or share your personal data with third parties for marketing purposes. I may share information in the following limited circumstances: with my training provider or tutor, where this is necessary for the purposes of professional oversight of my practice (they are bound by the same confidentiality obligations); where I am required to do so by law; or where there is a risk of serious harm to you or another person, in which case I may share information with appropriate authorities. I will always explain these limits to confidentiality before therapy begins.
Cookies
This website uses a cookie consent banner. When you first visit, you will be asked whether you accept or decline analytics cookies. If you accept, the GoDaddy Airo platform loads analytics tools that record information about your visit — such as pages viewed, links clicked, and general device and browser information. Your consent preference is stored in your browser's local storage for up to 12 months. If you decline, no analytics tools are loaded. This website does not currently use Google Analytics or third-party advertising cookies. The analytics currently used are provided through the GoDaddy Airo platform and only operate after you have given consent. If this changes, this notice will be updated and your consent will be sought before any new tracking begins. You can change or withdraw your analytics consent at any time using the Cookie Preferences control in the footer of this website.
Your rights
Under UK GDPR you have the right to: access the personal data I hold about you; request correction of inaccurate data; request erasure of your data (see below); object to or restrict certain processing; and lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. To exercise any of these rights, please contact me at [email protected]. Regarding erasure: you have the right to ask me to delete your personal information, and I will always take such requests seriously. However, this right is not absolute. Where I have a lawful, professional, insurance-related, or regulatory reason to retain particular records — for example, to meet my minimum five-year retention obligation under my professional insurance — I may not be able to delete those records immediately or in full. I will always explain my reasons clearly if this applies to your request.
Data security
I take reasonable steps to protect your personal information from unauthorised access, loss, or disclosure. Client intake forms returned by email are stored securely and access is restricted to me and, where necessary for professional oversight, my training supervisor. I recommend that you do not include highly sensitive information in unencrypted email; if you have concerns, please contact me to discuss alternative arrangements.
Changes to this notice
I may update this Privacy Notice from time to time. The current version will always be available on this page, with the date it was last updated shown at the top. If I make significant changes, I will take reasonable steps to bring them to your attention.
Questions or concerns?
If you have any questions about this Privacy Notice or how I handle your personal data, please get in touch.
[email protected]