Privacy Policy & Data Protection
Your privacy and confidentiality are at the heart of everything I do. This policy explains how your personal information is collected, stored, and protected — fully compliant with the UK GDPR, Data Protection Act 2018, and National Council for Hypnotherapy professional standards.
1. Who I Am & Who Is Responsible
Best Mind Therapy
Data Controller: Gary Smith
Email: Gary@bestmindtherapy.co.uk
Phone: 07359 071210
Address: 36 Northbourne Road, Swindon, SN25 4YE, United Kingdom
Professional Registration: AHD (Advanced Hypnotherapy Diploma Level 5), D.Hyp, HPD (NCH) Level 4, DSFH, DCH-Sup, MNCH (Reg.), AfSFH (Reg.), CNHC (Reg.) — fully accredited and bound by strict ethical codes.
I am committed to protecting your privacy and processing your personal data in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. I am registered with the Information Commissioner's Office (ICO).
2. What Information I Collect
I collect and process only the information necessary to provide you with safe, effective therapy services. I do not collect more than I need.
Information You Provide Directly
- Your name, contact details — email, phone number, address
- Relevant personal and health information you share during consultations
- Confidential clinical notes created during our sessions
- Payment details — processed securely; I do not store full card details
- Messages, emails, and form submissions between us (via Formspree)
- Appointment booking data via Calendly — only with your consent
Information Collected Automatically
- Website usage data — pages visited, time on site — fully anonymised
- Technical data — IP address, browser type — not linked to your identity
3. How & Why I Use Your Information
I process your data only on the lawful bases of consent, contractual necessity, legal obligation, and legitimate interests — always respecting your rights and freedoms.
Purposes of Processing
- To arrange, manage, and remind you of appointments
- To provide effective, tailored therapeutic care and support
- To maintain accurate, confidential clinical records for your continuity of care
- To process payments and maintain legally required financial records
- To communicate with you clearly and promptly about your sessions
- To comply with legal, professional, and ethical obligations
- To improve the website and services — using anonymised data only
Clinical notes are kept separate from marketing and general business data and treated with the highest level of confidentiality. I will never use your personal data for marketing without your explicit, opt-in consent — and you can withdraw that consent at any time.
4. Confidentiality & Sharing Your Information
Your information is never sold, rented, or shared for commercial purposes. Your clinical information is strictly confidential in line with the National Council for Hypnotherapy Code of Ethics.
When Information May Be Shared — Only With Your Consent or Legal Requirement
- You have given explicit written consent — e.g., sharing a summary with your GP or another therapist
- There is a legal obligation — such as a court order or statutory requirement
- There is a vital interest — to protect you or someone else from serious harm (I would always aim to discuss this with you first wherever possible)
- With trusted service providers acting as Data Processors — bound by strict data protection agreements and only ever processing the minimum data necessary
Trusted Third-Party Providers (Data Processors)
Services used to deliver care include secure appointment booking (Calendly), secure form handling (Formspree), email communication, and payment processing. All are UK/EU-based or certified under appropriate data transfer frameworks (UK International Data Transfer Agreement / EU Standard Contractual Clauses). Only the minimum necessary data is shared, and each is bound by a data processing agreement.
5. How Your Information Is Stored & Protected
- All personal and clinical data is stored securely, encrypted where appropriate
- Digital records are password-protected on regularly updated, secure systems with two-factor authentication where available
- Physical records are kept in locked, secure storage — accessible only to me
- Any contractors with access are bound by strict confidentiality agreements
- Backups are encrypted and securely stored
- Data is stored within the UK / European Economic Area wherever possible; any transfers outside this area use only approved adequacy frameworks or Standard Contractual Clauses
Data Retention Periods
- Clinical records: Kept for the duration of our work together + 7 years after your final session — aligned with NCH and professional guidelines (or longer if required for children/young people, until 7 years after they reach 18)
- Financial records: Retained for 7 years as required by HMRC
- General contact data: Retained as needed or until you request deletion
- After the retention period expires, data is securely and permanently deleted
6. Your Rights Under Data Protection Law
Under the UK GDPR and Data Protection Act 2018, you have the right to:
- Access — request a copy of all personal data I hold about you (Subject Access Request — free of charge for the first request)
- Rectification — correct any inaccurate or incomplete information
- Erasure — request deletion of your data ("right to be forgotten"), subject to legal/professional retention requirements
- Restriction — request limited processing of your data in certain circumstances
- Data Portability — request your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests or direct marketing
- Withdraw Consent — at any time, without affecting the lawfulness of processing before withdrawal
- Automated Decision-Making — I do not use any automated decision-making or profiling
To exercise any of these rights, simply contact me using the details below. I will respond within one calendar month (or sooner, where possible). There is no fee for the first request.
7. Cookies & Website Analytics
This website uses no intrusive advertising or tracking cookies. Only essential cookies required for site functionality may be in use. I use fully anonymised analytics to understand general site performance — your identity remains completely protected. No personal data is passed to advertising networks.
Fonts are loaded from Google Fonts; your IP may be visible to Google during font loading. You can disable cookies and font loading in your browser settings at any time, and the site will remain fully readable.
8. Contact & Queries
If you have any questions about this Privacy Policy, how your data is handled, or wish to exercise your rights — please contact me directly. I am your designated Data Controller:
Email: Gary@bestmindtherapy.co.uk
Phone: 07359 071210
Post: Gary Smith, Best Mind Therapy, 36 Northbourne Road, Swindon, SN25 4YE, United Kingdom
I will acknowledge your enquiry within 5 working days and provide a full response within one calendar month.
9. Changes to This Policy
This Privacy Policy may be updated occasionally to reflect legal changes or service updates. The date at the top will be revised accordingly. Significant changes will be communicated via this website or direct notice where appropriate. The version current at the time of your most recent interaction with me applies.
Have Questions About Your Data?
Your privacy matters. If anything is unclear or you'd like further details, please get in touch — I'm happy to explain.