Privacy Policy

Last Updated: 21 April, 2026

Next review: April, 2027

Introduction

Welcome to the privacy policy for Asclepieia Hypnotherapy and Wellness Ltd.

Led by Christopher Hardy, an NMC Registered Mental Health Nurse (PIN 09F0389E) with over 20 years of NHS experience, our practice is built on a foundation of clinical excellence, ethical practice, and absolute psychological safety. We understand that seeking hypnotherapy requires immense trust. We respect your privacy and are committed to protecting your personal data to the same rigorous professional standards expected within NHS mental health settings.

This policy explains how we look after your personal data when you visit our website (asclepieiahypnotherapy.co.uk), join our waiting list, subscribe to our mailing list, or engage our clinical hypnotherapy services.

1. Who We Are

Data Controller: Asclepieia Hypnotherapy and Wellness Ltd is the data controller and is responsible for your personal data.

• Registered Company Number: 17167132

• ICO Registration Reference: ZC127411

• Clinician: Christopher Hardy BSc (Hons) DipPSN RNMH

• Registered Office: 15 Princes Drive, Skipton, England, BD23 1HN

• Clinic Address: The Divergent Space, 6 Victoria St, Skipton BD23 1JE

• Email Address: hello@asclepieiahypnotherapy.co.uk

• Telephone: 01756 228611

If you have any questions about this privacy policy or our data practices, please contact Christopher Hardy using the details above.

2. The Data We Collect About You

To provide our professional hypnotherapy services, we may collect, use, store, and transfer different kinds of personal data about you, which we have grouped as follows:

• Identity Data: First name, last name, title, and date of birth.

• Contact Data: Billing address, email address, and telephone numbers.

• Clinical & Health Data (Special Category Data): Because hypnotherapy involves treating anxiety, stress, phobias, and other conditions, we will collect information about your mental and physical health, medical history, lifestyle, and GP details. This requires a higher level of protection under UK law.

• Marketing and Communications Data: Your preferences in receiving marketing/newsletters from us and your communication preferences.

• Technical & Usage Data: Information about how you use our website, IP address, browser type, and operating system (collected via cookies, Google Analytics, and Meta/Facebook Pixel).

3. How Is Your Personal Data Collected?

• Direct Interactions: You may give us your Identity, Contact, and Health Data by filling in forms, joining our waiting list, subscribing to our mailing list, or corresponding with us by post, phone, email, or during clinical consultations (in-person in Skipton or online).

• Automated Technologies: As you interact with our website, we may automatically collect Technical Data about your equipment and browsing actions using cookies.

4. How We Use Your Personal Data & Our Lawful Basis

We will only use your personal data when the law allows us to. Under the UK GDPR, we rely on the following lawful bases:

1. Performance of a Contract: Processing your data is necessary to deliver the hypnotherapy services you have engaged us for.

2. Consent: Where you have explicitly consented, such as joining our email mailing list for blogs and updates. You can withdraw this consent at any time.

3. Legitimate Interests: For running our business, maintaining records, and ensuring our website remains secure and relevant.

4. Legal Obligation: Where we need to comply with a legal or regulatory obligation (e.g., HMRC tax records or NMC regulatory compliance).

Processing Special Category (Health) Data: As a clinical practice, we collect health data. Our lawful basis for processing this under Article 9 of the UK GDPR is Explicit Consent (gathered during your initial consultation/onboarding) and the Provision of Health or Social Care, rooted in Christopher Hardy’s professional registration as an NMC mental health nurse.

5. Data Security & Professional Confidentiality

Drawing on 20+ years of NHS experience, strict confidentiality is non-negotiable at Asclepieia Hypnotherapy. We have put in place robust clinical and technical security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered, or disclosed.

• Access to clinical records is strictly limited to Christopher Hardy.

• Digital records and emails are stored securely using professional-grade encryption.

• Physical Notes: Any handwritten notes made during sessions are stored in a locked filing cabinet. Once transferred to our secure digital system, physical copies are immediately destroyed via cross-shredding.

• Safeguarding: In the event of a serious risk of harm to yourself or others, we may share information with appropriate authorities (e.g., your GP) under the NMC code of conduct.

6. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including satisfying any legal, regulatory, tax, accounting, or clinical reporting requirements.

• Clinical Records: In line with standard UK medical and therapeutic record-keeping guidelines, your clinical notes will be retained securely for 8 years after your final session before being securely destroyed.

• Mailing List: Your contact details will be kept on our marketing list until you unsubscribe.

7. Disclosures of Your Personal Data

We do not sell or trade your data. We may share your data with trusted third parties strictly for the purposes of running our clinic, including:

• IT, website, and system administration providers, including Hostinger Reach which we use to manage our email communications safely and effectively.

• Analytics providers, specifically Google Analytics and Meta (Facebook) Pixel to help us understand website traffic and improve our online services.

• Professional advisers including lawyers, bankers, auditors, and insurers.

• HM Revenue & Customs, regulators, and other authorities based in the UK.

8. Your Legal Rights

Under UK data protection laws, you have rights including the right to:

• Request access to your personal data (a "data subject access request").

• Request correction of incomplete or inaccurate data we hold about you.

• Request erasure of your personal data (subject to our legal requirements to retain medical/therapeutic records).

• Withdraw consent at any time where we are relying on consent to process your data (e.g., mailing lists).

9. Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). Our ICO registration number is ZC127411. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact Chris directly in the first instance.