Privacy notice

Version 2.6 · Last updated: 10 September 2026.

This explains what personal information Rugby Hypnotherapy holds, why, who else may see it, how long it is kept and what rights you have. Clients also receive this as a separate Privacy Notice before their first session.

Who is responsible

Adel Moin, trading as Rugby Hypnotherapy, Rugby, Warwickshire, is the data controller. I am registered with the Information Commissioner’s Office, reference ZC082156. My correspondence address is 27 Old Gloucester Street, Holborn, London WC1N 3AX, United Kingdom. This is not a treatment address. For any privacy question, email hello@rugbyhypnotherapy.co.uk.

What I collect

• If you enquire: your first or preferred name and email address, plus any optional phone number, location, neutral routing choice and general message you choose to provide.
• If you become a client: contact details, relevant medical and mental-health history, medication, lifestyle information, safety answers, and notes of sessions including goals, progress and any referral. A full date of birth is optional unless a specific legal, identity or safety need is explained. For remote work, the client’s home address, GP details and an emergency contact are required under my documented Remote Working Safety Policy; for in-person work they are collected only where relevant and necessary.
• Information about other people: you may give an emergency contact, GP details or mention another person in a session. Please tell an emergency contact that you have given me their details. I record third-party information only where it is relevant and necessary.
• Administration: appointment and payment records, including the date, amount and reference for each payment. Payment is by PayPal, bank transfer or cash. Card payments are not taken and card or bank account details are not held.
• Events and media: if you volunteer for a demonstration, I collect a short safety screen and signed participation consent. Photography, video and each publication channel require separate optional choices.

What is required and what is optional

The contact form requires only a first or preferred name and email address so I can reply. Joining the newsletter requires an email address and an affirmative choice to subscribe, sent from your own email account. Other enquiry fields are optional. If we agree to work together, identity, contact, consent and relevant safety information are required to decide whether the work can proceed safely and to deliver it; other intake fields are marked or treated as optional unless they become relevant. If information needed for safety or the agreement is not provided, I may have to postpone or decline the work.

Why I am allowed to hold it

Data protection law requires a lawful basis for using your information, and a further condition for health information specifically.

• Delivering sessions you have booked: UK GDPR Article 6(1)(b), performance of our contract.
• Health and mental health information: UK GDPR Article 9(2)(h) together with Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018, the provision of health or social care. This condition is available because I owe you a duty of confidence in law, which is the safeguard Article 9(3) and section 11(1) of the Act require.
• Replying to an enquiry: Article 6(1)(f), my legitimate interest in responding to people who contact me. The form asks you not to send detailed clinical information. If health information is nevertheless volunteered as part of a request for care, Article 9(2)(h) is relied on while I respond, and Article 9(2)(f) applies if it later becomes relevant to a legal claim.
• Keeping clinical records afterwards: Article 6(1)(f), my legitimate interests in maintaining an accurate professional record, continuity, responding to questions and establishing, exercising or defending legal claims. Article 6(1)(c) is used only where a specific UK legal obligation applies, such as tax law or a court order.
• Optional identifiable use of a locally installed offline AI tool: no identifiable client material is used unless you give separate explicit written consent. You may refuse or later withdraw that consent without affecting the service. Genuinely deidentified material may be used without identifying you.
• Event safety screening and media: Article 6(1)(a) and, for health answers, Article 9(2)(a), your explicit consent. Participation is voluntary and media consent is not required to take part.
• Any marketing email, if you ask for it: Article 6(1)(a), your consent, which you can withdraw at any time.

Because clinical records rest on the health and social care condition rather than consent, withdrawing consent does not by itself require your notes to be deleted. That keeps your records intact and available to you for the retention period. You can still object, and I will always explain my reasoning.

Who else sees it

Your information is never sold or passed to other organisations for their own marketing. Access is limited to the following situations and providers:

• Safe practice requires me to review my work with a professional supervisor or with a peer practitioner. Cases are de-identified as far as reasonably possible, and anyone I discuss work with is bound by the same duty of confidence.
• Where there is a serious risk to your life or safety, or someone else’s, including a child or an adult at risk.
• Where the law requires it, for example a court order.
• My insurer, legal advisers and current professional body, IPHM, if a complaint or claim is made.
• A designated records custodian, but only if a written appointment is completed, I die or become unable to practise, and the access is needed to carry out the appointment under its confidentiality, access and disposal instructions.
• Service providers who help run the practice: Microsoft 365 for business email, Web3Forms for the website contact form, Cal.com for consultation booking, the website host and my accounting provider. Each receives only the administrative information needed for the service, subject to its applicable contract and privacy terms. These links were correct at the date of this policy.
• Where you pay by PayPal or bank transfer, the payment provider and my bank receive the information needed to complete the payment. They act under their own privacy terms as data controllers in their own right, not on my instructions. Payments show the trading name Rugby Hypnotherapy. Please keep payment references neutral and do not include anything about the work we do.
• Telephone enquiries may be answered by a family member assisting the practice when I am unavailable, but only while a signed written confidentiality undertaking is in force. They take only your first or preferred name, contact number and preferred callback time, then ask me to call you back. They do not ask why you are calling and have no access to client records.

How it is protected

• Your clinical records are held on a single computer in the United Kingdom. The computer has full-disk encryption and a strong password, and is set to lock automatically when left unattended. Within that, the clinical-record store sits in a second, separately encrypted location that only I can unlock.
• The clinical-record store is not held in a cloud service and is excluded from internet and cloud synchronisation. It is kept separately from ordinary business and website working files, and is normally left locked and unmounted.
• A recovery copy is kept on a separate encrypted external drive. The drive is disconnected after each backup and stored in locked, fire- and water-resistant storage away from the computer. Only I hold routine access to it. Arrangements for a records custodian to obtain access are held separately and take effect only on my death or incapacity. Backup restoration is tested and recorded.
• Paper forms are scanned directly with a scanner. Every page, signature and reverse side is checked against the paper before the digital file is accepted. Paper is then cross-cut shredded or placed in confidential waste, unless an original must exceptionally be retained in locked storage.
• Client notes are never kept in ordinary email, messaging apps or external or cloud AI services. Identifiable material is used with a locally installed offline AI tool only after separate explicit written consent. The tool has no cloud connection or telemetry, I review every output, and no automated decision is made about you.
• Administrative information does pass through Microsoft 365 email, Web3Forms, Cal.com and my accounting and website services. These providers do not receive the clinical record or session notes. Some process information outside the UK, so their data-processing and international-transfer terms are reviewed and recorded.

How long it is kept

• Client records: seven years from our last session, unless a longer period is required by law, then securely destroyed.
• Enquiries that do not become sessions: the content of your enquiry is deleted within twelve months. After that a minimal note of your name, the date and the channel of contact, and that the enquiry did not proceed, may be kept for up to three years. Web3Forms holds its own copy for up to three years from the date you send it, under a data processing agreement I hold. If I stop using the service, that copy is deleted or returned within ninety days, apart from routine backups which are overwritten in the ordinary course.
• Consultation bookings: bookings that do not become client work are reviewed and deleted after twelve months. Cal.com’s privacy policy says account and booking data is held while the account remains active unless it is deleted earlier.
• Financial records: six years. HMRC requires at least five years after the relevant 31 January filing deadline; six aligns with the period for contract claims.
• Event safety and participation forms: three years from the event, or seven years after closure where there is an incident, complaint or claim.
• Media-consent records: while the material is in use and for six years afterwards. Withdrawal stops future controlled use and removal is made where reasonably possible.

Your rights

You can ask for a copy of the information held about you, have inaccurate information corrected, ask for deletion or restriction in certain circumstances, object to how your information is used, ask for it to be transferred where that right applies, and withdraw consent where consent is the basis. Requests are normally answered within one month and free of charge. For an access request, the period starts once any reasonably required identity information and any fee lawfully charged have been received; if clarification is reasonably required, the period may pause while I wait for it. I will carry out reasonable and proportionate searches. These rights are not absolute; if a request cannot be met in full, I will identify the specific legal reason and explain your right to complain.

To exercise any right, email hello@rugbyhypnotherapy.co.uk.

Complaints

If you are unhappy with how your information has been handled, email me at hello@rugbyhypnotherapy.co.uk. I will acknowledge a data-protection complaint within 30 days, which is the maximum the law allows, and I aim to do it within five working days. I will take appropriate steps to investigate it without undue delay, keep you informed and provide the outcome without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. A service or professional-conduct complaint can be raised under the Complaints Procedure and, if unresolved after 28 days, with IPHM.

Newsletter sign-ups

You can ask to join by sending an email with a clear choice to receive occasional practical ideas and news about workshops and services from Adel at Rugby Hypnotherapy. I collect your email address, any name your email includes, the consent wording and dates, and any confirmation, withdrawal or delivery information. Your questionnaire answers, results and health labels are not included. Please keep this email to your newsletter request.

I use your consent, UK GDPR Article 6(1)(a), to send the newsletter. The guide is a welcome gift. You can use the questionnaire and see your full summary without subscribing, and you can unsubscribe at any time and keep the guide.

For now, the sign-up button opens a draft in your own email app. Nothing is submitted to me merely by opening it; you choose whether to send the message. I receive requests in my Microsoft 365 business inbox and handle confirmations, guide replies and unsubscribes personally. No Web3Forms submission or automated Brevo email is triggered by this sign-up route, and these sign-ups are not currently passed to Brevo. Email addresses and consent records are held in business email and a separate administrative subscription register.

Microsoft 365 processes the correspondence under its applicable data-processing and international-transfer terms. Your own email provider processes messages under its own terms. The manual newsletter emails are sent without added open-tracking pixels or click-measurement links. Basic delivery and security records may still be processed by the email providers.

To stop newsletter emails, reply asking to unsubscribe or email hello@rugbyhypnotherapy.co.uk. You do not need to give a reason. Every newsletter will include this option.

If a request is unclear, I ask you to confirm and do not subscribe you until you do. Unconfirmed requests are deleted from my active records after 30 days without a reply. Confirmed subscriptions are reviewed annually, and I stop sending after two years unless you actively renew your permission. Evidence of consent is kept while the subscription is active and for up to two years afterwards, where needed to demonstrate compliance. I keep the minimum email address and opt-out record needed to prevent further marketing, reviewing that need annually. This limited record is held under Article 6(1)(f), my legitimate interest in respecting your choice and demonstrating compliance.

Switching-off questions

The optional switching-off questions run in your browser. Your choices and the summary are held only in the page’s memory while you use it. They aren’t sent to Rugby Hypnotherapy or another provider, and they aren’t saved in cookies or browser storage. They are cleared when you leave or reload the page. You can also use “Clear my answers” to remove them.

No email address or sign-up is needed. There are no scores, diagnostic profiles or treatment recommendations. The normal technical server logs described below may record a visit to the page, but do not receive your questionnaire answers. If you choose to contact me separately, that enquiry is handled under the other sections of this notice.

This website

The website uses GoDaddy-managed domain services and Host Europe infrastructure in Germany. Technical server logs may include an IP address, browser information and access time; the contractual host and its precise log-retention setting are being confirmed. Web3Forms, operated by Web3Creative from India, delivers contact-form messages to Microsoft 365 using infrastructure in the United States and the European Union. Its Data Processing Agreement version 1.0, last updated 13 July 2026, applies where Web3Forms processes personal data for the practice and incorporates the UK Addendum and Standard Contractual Clauses for relevant international transfers. Under that agreement, submissions have a maximum lifetime of three years, and on ending the service data is deleted or returned within ninety days, subject to routine backup cycles. Web3Creative must notify me of a personal data breach within seventy-two hours. Web3Forms states that Microsoft Clarity may be used inside its provider dashboard; I do not open or use the submissions dashboard to read enquiries. I only access account settings, access keys, redirect URLs or billing where no client information renders. Cal.com is a United States provider and supplies the consultation calendar; its code loads only when you choose to open the booking calendar. Cal.com’s privacy policy, effective 20 August 2026, says that the practice is controller and Cal.com is processor for booking data, that UK transfers use Standard Contractual Clauses or an adequacy mechanism, and that the service uses encryption and access controls. The practice Cal.com account is protected by a unique password and two-factor authentication. Booking fields are for appointment administration only; please do not enter health information or session notes. Rugby Hypnotherapy does not deliberately use advertising or behavioural analytics on its own pages. If non-essential storage or tracking is added to the website, this notice will be updated and consent obtained where required.