Privacy Policy

Who we are

Transforming Thoughts Ltd is a private practice offering NLP-informed coaching and non-medical hypnotherapy services to adult clients in the UK. Sessions are conducted online; in exceptional circumstances, and by prior agreement, a session may take place in person at a mutually suitable location.

For the purposes of UK GDPR, Transforming Thoughts Ltd is the Data Controller for the personal information you provide. This practice operates in accordance with the Code of Conduct of the International Alliance of Professional Complementary Practitioners (IAPCP). A copy is available on request.

What information we collect

Standard personal data: full name, date of birth and contact details (email, phone); emergency contact information; payment and billing records.

Special category (sensitive) data: physical and mental health information disclosed during intake and sessions; session notes and clinical records; information you share voluntarily in the course of your care.

We do not work with clients under 18 without verified parental or guardian consent, and this website does not currently offer services to under-18s.

Why we hold your data

For special category health data, we rely on Article 9(2)(h) UK GDPR - processing necessary for the provision of health care and the management of health care systems.

How we store your data

Your records are stored securely. Digital records are maintained on password-protected, encrypted devices or GDPR-compliant cloud storage with regular secure backups; any paper records are held in a locked filing cabinet.

Online sessions are not routinely recorded. If recording is required for any reason, you will be informed in advance and your explicit consent obtained before recording begins.

Your clinical records and health information are not transferred outside the UK/EU. Payment information shared with Stripe may be stored or processed outside the UK/EU, including in the United States. Stripe protects such transfers using recognised safeguards, including Standard Contractual Clauses and certification under the Data Privacy Framework. Any other third-party tools we use (such as scheduling or video software) are selected on the basis of UK/EU data adequacy standards and, where required, operate under a Data Processing Agreement.

In the event that this practice closes or the practitioner is no longer able to practise, arrangements will be made to ensure your records remain securely held and accessible to you or your legal representative on written request.

How long we keep your data

In line with IAPCP professional guidance, clinical records are retained for a minimum of seven years from the date of your last appointment. After the applicable retention period, records are destroyed securely and confidentially. Discovery call booking details are deleted after 12 months unless you become a client.

Who we share your data with

We do not sell or share your personal data with third parties for marketing purposes. In limited circumstances, information may be shared:

• With other professionals, where you have given explicit consent - for example, your GP or a referring clinician.
• Where required by law, such as a court order or direction from an authority with legal power to require disclosure.
• Where there is a serious risk of harm to you or another person - in such cases, disclosure may occur without prior consent, consistent with our professional duty of care and IAPCP guidance on public interest disclosure.

Any disclosure made without your prior consent is documented in writing, including the reason, date, recipient and information disclosed, in line with IAPCP Code of Conduct requirements. Discovery calls are booked via Cal.com, which processes data in the United States under Standard Contractual Clauses or the Data Privacy Framework. Calls are held on Zoom, which does not receive your client records. Other processors operate under a Data Processing Agreement where required..

Payments are processed by Stripe. When you make a payment, your name, email address and payment details are shared with Stripe to process the transaction. We do not see or store your full card details. Stripe handles your information in accordance with its own privacy policy: https://stripe.com/privacy

Your rights

Under UK GDPR, you have the right to access the personal data we hold about you; rectify inaccurate or incomplete data; request erasure, subject to our legal and professional obligations to retain clinical records; restrict processing in certain circumstances; object to processing based on legitimate interests; and data portability - receive your data in a commonly used, machine-readable format.

To exercise any of these rights, contact us in writing at privacy@transformingthoughts.com. We will respond within one calendar month.

Complaints

If you have concerns about how your data is handled, please contact us at privacy@transformingthoughts.com in the first instance. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113.

Cookies

Our website uses only essential cookies necessary for basic functionality. We do not use tracking, advertising or analytics cookies without your consent. See our Cookies Policy for full detail.

Changes to this policy

This policy is reviewed annually and following any significant changes to our practice or applicable law. The current version is always published on our website. A printed copy is available on request.