Privacy, GDPR & Consent

Last updated: July 2026

ICO Registration Number: ZB676025

This page covers two things: how your information is handled when you use this website, and how your information is handled if you become a therapy client. Sharon Clare Hypnotherapy operates in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as updated by the Data (Use and Access) Act 2025.

1. Who We Are

Sharon Clare Hypnotherapy is the data controller for the personal information you provide through this website, and for the client records held directly — session notes, contact details and related correspondence.

For clients seen at the Belfast and Lisburn clinics, the clinic is separately responsible, as data controller, for the booking and consent information held on its own systems (Jane and Phorest respectively). Each clinic issues its own privacy notice at the time of booking.

If you have any questions about this policy or how your data is handled, you can get in touch at: sharon@sharonclare-hypnotherapy.com

2. Consent to Solution-Focused Hypnotherapy

By booking a session, you agree that:

You are entering a course of Solution-Focused Hypnotherapy and accept your own responsibility in the process.
You will engage in the positive activities suggested between sessions to maximise benefit.
The number of sessions and the results are estimates only — no specific outcome can be guaranteed.
Session notes will be held in accordance with UK GDPR and this statement.
You give consent to be included in any therapist research programme (CORP), if applicable; all data will remain confidential.
Your therapist may break confidentiality only to safeguard you or others, or to prevent a crime.
This agreement is governed by UK law and subject to the exclusive jurisdiction of the UK courts.

3. How Your Data Is Stored and Used

Because hypnotherapy involves health-related information, this counts as “special category data” under GDPR. Sharon Clare Hypnotherapy relies on:

Your explicit consent to process health and therapy-related information (Article 9(2)(a)); and
Contract / legitimate delivery of the service as the basis for processing the everyday contact information needed to arrange and run sessions (Article 6(1)(b)).

Only the minimum information needed to provide safe, effective therapy is collected. In particular, a full postal address is not requested unless there is a specific reason (for example, an insurer or regulator requires it), in line with the data minimisation principle. A date of birth is collected — this is used to confirm you are being offered age-appropriate consent arrangements and to apply the correct retention period below.

Identifiable data held may include:

Name, date of birth, and contact details (phone/email)
GP details — only where you give specific, separate consent
Session records, brief notes, text messages, or emails between you and Sharon Clare Hypnotherapy

4. Purpose of Data Collection

To provide effective, continuous therapy, the following information is collected:

Your goals for hypnotherapy
A small amount of medical information relevant to your treatment
Brief session notes
Date of birth, to confirm age-appropriate consent and apply the correct retention period
Contact and GP details, used only with your explicit, separate consent
CORP (research) data, if you choose to participate
Relevant information about significant others, where helpful to the therapeutic process

5. Retention of Records

Sharon Clare Hypnotherapy is a member of the Association for Solution Focused Hypnotherapy and the Complementary and Natural Healthcare Council. In line with their regulations and insurance requirements:

Adult client records are kept for 8 years after the final session.
For clients under 16, records are kept until age 25.
For clients aged 17–18, records are kept until age 26.

All records are deleted the following January once these periods expire. Due to insurance requirements, records cannot be destroyed before the minimum term.

6. Accessing Your Data

You may request a copy of your records at any time.
Write to Sharon Clare Hypnotherapy specifying the data you wish to see.
Your identity will be confirmed and a reasonable and proportionate search of your records carried out.
Information will be provided within 30 days of your request (or of any identity check or clarification needed), free of charge. Where extra time is genuinely needed to clarify your request, that clarification period does not count towards the 30 days.
The insurance company’s legal team may need to verify any release of information.

7. Raising a Concern or Complaint

If you have any concern about how your data is handled, please raise it directly with Sharon Clare Hypnotherapy first, by email or in writing:

Your complaint will be acknowledged within 30 days.
It will be looked into and responded to without undue delay.

If you remain unhappy with the response, you also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

8. Security of Your Information

How and where your data is held depends on how we are in contact and, for clinic-based sessions, on the clinic you attend.

Enquiries, booking and first contact

For online clients and sessions at Garvagh, initial contact is usually via Calendly, WhatsApp, text, or email. Calendly is used for scheduling and also hosts your consent form and this statement; it processes your name, email and phone number as part of managing your booking. See Calendly’s own privacy policy for details of how they handle data.
WhatsApp and text messages are held on a mobile phone secured by Face ID or passcode.
Email is protected by device authentication (Face ID, username and password) and treated as a written record, stored securely.

Session notes

Enquiry and session notes are taken using the Notability app. Notes are uploaded to a secure OneDrive folder, and any identifying details are then removed from Notability, so Notability itself does not retain a searchable, identifiable record.
OneDrive is the main secure store for client records. Access requires device authentication, and the client records area is additionally protected (for example, two-factor authentication and/or a locked, encrypted area such as OneDrive Personal Vault) so that files cannot be opened without further verification, even if the device itself is unlocked.

Belfast clinic clients

Booking details and your consent form are held on the clinic’s own Jane system, operated and secured by the clinic, which issues its own privacy notice to you at the time of booking. Session notes from your hypnotherapy sessions are taken and stored in the same way described above (Notability → OneDrive).

Lisburn clinic clients

Booking details and consent are held on the clinic’s own Phorest system, operated and secured by the clinic, which issues its own privacy notice to you at the time of booking. Session notes are taken and stored in the same way described above (Notability → OneDrive).

Research data

CORP research data is accessed only via password-protected systems.

9. Use of Artificial Intelligence (AI) Tools

Sharon Clare Hypnotherapy may use AI tools for general business administration — such as drafting correspondence, scheduling support, marketing content, and document preparation. The following safeguards apply:

No identifiable client health information, session notes, or therapy content is entered into general-purpose AI tools. Where AI assistance touches anything client-related, information is anonymised or pseudonymised first.
AI tools are not given direct access to client record systems or folders (OneDrive client records, Notability, or the clinics’ Jane and Phorest systems).
AI is never used to make decisions about your therapy, diagnosis, or treatment. All clinical judgement remains solely with Sharon Clare.
Any AI provider used is expected to meet the same confidentiality and data-security standards as any other supplier, and is not used to store or train on your personal data.

10. Confidentiality

All sessions are strictly confidential.
Your therapist may share limited, non-identifying details with a clinical supervisor for best-practice purposes.
Information is only disclosed without consent if there is serious risk of harm to you or others, or if required by law, warrant, or court order.
If you meet Sharon Clare outside a session, she will protect your privacy and not initiate conversation. You are free to discuss your therapy with others present if you choose.

11. Online Sessions

Sharon Clare Hypnotherapy provides online sessions using Zoom.

Your responsibilities

Provide consent for online therapy.
If you are under 18, written consent must come from a responsible adult.
Ensure a quiet, private space for the session with a reliable internet connection.
You’ll need a camera, microphone, and speakers.
Have a comfortable seat or sofa and a pillow to support your head during trance work.
Remain visible on camera at all times, especially during hypnosis.
For children, sessions cannot take place in a bedroom, and a parent must be present throughout.

Therapist responsibilities

Assess the suitability of online therapy for your needs.
Take reasonable steps to ensure your environment is appropriate.
Advise you to identify a local support person (friend, family member, or health practitioner) in case of emergency.

12. Technology and Privacy

The systems used for scheduling, notes and records (including Calendly, Notability, OneDrive, and the clinics’ own Jane and Phorest systems) apply industry-standard encryption and access controls. The privacy of any internet communication is, however, limited by the security of the technology and network used at each end.

13. Contact Form Data

When you submit a contact form on this website, we collect your name, email address, and any information you include in your message. We use this information solely to respond to your enquiry. We do not share this data with third parties, and we retain it only for as long as necessary to handle your enquiry.

The legal basis for processing contact form data is our legitimate interests in responding to enquiries and providing our services (Article 6(1)(f) UK GDPR).

14. Quiz Data and Health Information

If you complete one of our online quizzes (Stress Symptoms, Medical Anxiety, or Bladder Urgency), we collect your name, email address, quiz responses, and your result tier. Your quiz responses may include information about your health and wellbeing, which is classified as special-category data under UK GDPR.

We ask for your explicit consent before storing this data. You will be asked to check a separate consent checkbox confirming that you consent to us storing your quiz responses, which may include health-related information, for up to 12 months. This is a requirement of Article 9(2)(a) UK GDPR for processing special-category health data.

Retention: If you do not go on to book a session or remain subscribed to our emails, we will delete your quiz response data after 12 months. If you become a client, your data may be retained for longer in accordance with the clinical record-keeping obligations set out in section 5.

Your quiz data is stored securely in Supabase, a cloud database provider, within the European Economic Area.

15. Email Marketing and Kit (ConvertKit)

If you opt in to receive email updates — either through a contact form, quiz, or subscription — we will add your email address and first name to our email marketing platform, Kit (formerly ConvertKit).

Kit is a data processor acting on our behalf. This means Kit stores and processes your email address and name in order to send emails on our instruction. Kit’s privacy policy can be found at kit.com/privacy. Kit is based in the United States and participates in the EU-US Data Privacy Framework.

The legal basis for adding your details to Kit is your explicit consent (Article 6(1)(a) UK GDPR). You can withdraw consent and unsubscribe at any time by clicking the unsubscribe link in any email we send you.

When you complete a quiz, we apply a tag to your subscriber record in Kit that records which quiz you completed and your result tier (for example, quiz-stress-symptoms-tier-2). This allows us to send you relevant follow-up information.

16. Cookies and Analytics

This website uses cookies to function correctly and to understand how visitors use the site. We use Google Analytics to collect anonymised data about page visits and traffic sources. This data does not identify you personally.

You can control cookie preferences in your browser settings. Disabling cookies may affect the functionality of some parts of this website.

17. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to access — you can request a copy of the data we hold about you
Right to rectification — you can ask us to correct inaccurate data
Right to erasure — you can ask us to delete your personal data, subject to the retention obligations in section 5
Right to restrict processing — you can ask us to limit how we use your data
Right to withdraw consent — you can withdraw consent for email marketing or quiz data storage at any time
Right to complain — you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

To exercise any of these rights, please get in touch at sharon@sharonclare-hypnotherapy.com. We will respond within 30 days.

18. Changes to This Policy

This document is a general statement and is not a substitute for independent legal advice. Given the number of systems and locations involved, Sharon Clare Hypnotherapy periodically reviews this statement and its data-sharing arrangements with clinic partners. The date at the top of this page shows when it was last updated.