Policies & Privacy

Privacy Notice

Cat Wright Solutions Hypnotherapy

Version: 3.0
Last Updated: July 2026
Review Date: July 2027

Introduction

Cat Wright Solutions Hypnotherapy is committed to protecting your privacy and ensuring that your personal information is handled fairly, lawfully, transparently and securely.

This Privacy Notice explains how we collect, use, store, protect and share your personal information when you contact us, visit our website or access our hypnotherapy services.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable privacy legislation.

Who We Are

Cat Wright Solutions Hypnotherapy is the Data Controller for the personal information described in this notice.

Data Controller:
Cat Wright (Catherine Wright)

Email: cat@catwrightsolutions.co.uk

Website: www.catwrightsolutions.co.uk

ICO Registration Number: ZA429920

Information We Collect

Enquiries

When you contact us by telephone, email, website enquiry form or social media, we may collect:

• Name
• Email address
• Telephone number
• Information relating to your enquiry
• Preferred method of contact

During Assessment and Therapy

If you choose to engage our services, we may collect:

• Name
• Address
• Date of birth
• Contact details
• Emergency contact / next of kin details
• GP details
• Medical and health information
• Therapy notes
• Session records
• Appointment history
• Correspondence relating to your treatment

We only collect information that is relevant, adequate and limited to what is necessary for the purposes described in this Privacy Notice. We take reasonable steps to ensure the personal information we hold is accurate, complete and kept up to date.

Health information is classified as Special Category Data under UK GDPR and receives additional protection.

Why We Process Your Information

We only collect the information necessary to provide safe, effective and professional hypnotherapy services.

The table below explains why we process personal information and the legal basis we rely upon.

Purpose	Personal Data Used	Legal Basis
Responding to enquiries	Name, contact details, enquiry details	Legitimate Interests
Arranging appointments	Contact details	Contract
Delivering hypnotherapy services	Client information and session notes	Contract
Assessing suitability for treatment	Health information, GP information	Contract and Special Category Data Condition
Maintaining clinical records	Therapy notes	Legitimate Interests
Emergency situations	Next of kin information	Vital Interests
Invoicing and financial administration	Contact and payment information	Legal Obligation
Responding to complaints or legal claims	Relevant client records	Legal Obligation and Legitimate Interests

The UK GDPR requires organisations to identify a lawful basis for each processing activity.

Processing of Special Category Data

As part of providing hypnotherapy services, we process health-related information, which is classed as Special Category Data.

We process this information because it is necessary to:

• Assess suitability for hypnotherapy
• Identify contraindications
• Deliver therapeutic support safely
• Protect your wellbeing
• Meet professional obligations

Our lawful basis for processing health information is:

Article 6 UK GDPR

• Article 6(1)(b) – Performance of a contract
• Article 6(1)(f) – Legitimate interests where appropriate
• Article 6(1)(d) – Vital interests in emergencies

Article 9 UK GDPR (Special Category Data)

We normally process health information under Article 9(2)(a) (explicit consent). In limited circumstances we may also rely upon Article 9(2)(h) where the processing is necessary for the provision of health or therapeutic services.

Special Category Data may only be processed where an Article 9 condition is satisfied in addition to an Article 6 lawful basis.

How We Use Your Information

We use personal information to:

• Communicate with you
• Arrange and manage appointments
• Deliver therapy services
• Maintain professional records
• Ensure client safety
• Meet legal and regulatory obligations
• Defend legal claims where necessary
• Improve our services

We do not sell personal information to third parties.

We do not use personal information for automated decision-making or profiling.

Who We Share Information With

We will only share personal information where necessary and lawful. This may include:

Clinical Supervision

As part of professional practice, aspects of your case may be discussed during supervision.

Where possible, information will be anonymised. Supervisors are subject to professional confidentiality obligations.

Professional Advisers

Where necessary:

• Legal advisers
• Accountants
• Professional indemnity insurers

Healthcare Professionals

With your knowledge and consent where appropriate.

Legal Requirements

Information may be disclosed where required by law, court order, safeguarding obligations or to protect life.

Please note: Information may be disclosed without consent where required for safeguarding purposes, prevention of serious harm, or where required by law.

Service Providers

We use trusted third-party providers who process information on our behalf.

These may include:

• Microsoft 365 (Outlook, Teams and OneDrive)
• Website hosting providers
• Website analytics providers
• Telephone providers
• Accountancy software providers

All providers are required to maintain appropriate security and confidentiality safeguards.

International Transfers

Some service providers may process information outside the United Kingdom.

Where international transfers occur, we ensure appropriate safeguards are in place, including:

• UK adequacy regulations
• International Data Transfer Agreements
• Approved contractual safeguards

These safeguards are designed to protect personal information to UK GDPR standards.

Storage and Security

We take appropriate technical and organisational measures to protect personal information.

These include:

• Password-protected devices
• Password-protected cloud storage
• Secure email systems
• Limited access to records
• Locked filing cabinets
• Secure office premises
• Regular software and security updates

Paper records are stored securely and accessed only where necessary.

Data Retention

Enquiries that do not proceed to face-to-face or online sessions will normally be deleted within 6 months unless there is a legitimate reason to retain them longer.

Records are retained only for as long as necessary.

Adult Client Records

Clinical records are retained for: Eight years after the final therapy session

Child Client Records

Records are retained until: The client's 25th birthday

Financial Records

Invoices, accounting records and related documentation are retained for: Six years after the end of the relevant accounting period

This retention period supports HMRC and legal requirements.

At the end of the retention period:

• Paper records are securely shredded.
• Electronic records are securely deleted.

In the Event of Death or Incapacity

In the event of the death or incapacity of Cat Wright, a nominated therapeutic executor may access client records solely for the purposes of:

• Contacting current clients
• Managing the closure of services
• Securing or archiving records
• Ensuring compliance with legal obligations

All information will continue to be treated confidentially.

Data Breaches

Cat Wright Solutions maintains procedures for identifying, investigating and responding to personal data breaches.

Where required by law:

• A report will be made to the Information Commissioner's Office (ICO) without undue delay and, where applicable, within 72 hours of becoming aware of the breach.
• Individuals affected will be informed where there is a high risk to their rights and freedoms.

Your Rights

Under UK GDPR you have the right to:

• Be informed about how your information is used
• Access your personal information
• Request correction of inaccurate information
• Request erasure of information in certain circumstances
• Restrict processing in certain circumstances
• Object to processing in certain circumstances
• Request transfer of your information to another provider (data portability)
• Withdraw consent where consent is relied upon
• Complain to the Information Commissioner's Office

These rights are not absolute and may be subject to legal exemptions.

Subject Access Requests

You may request a copy of the personal information we hold about you.

Requests should be sent to: cat@catwrightsolutions.co.uk

We may request proof of identity before releasing information.

Requests for Correction

If any information we hold about you is inaccurate or incomplete, please contact us and we will correct it as appropriate.

Right to Erasure

You may request deletion of your personal information.

However, this right is not absolute.

We may be required to retain information where:

• Legal obligations apply
• Insurance requirements apply
• Professional standards apply
• Ongoing legal claims exist

If information cannot be erased, we will explain why.

Communications

We may contact you regarding:

• Appointments
• Therapy sessions
• Administrative matters
• Information relevant to your care

We do not use your personal information for unsolicited marketing.

Online Sessions

Where sessions are delivered online using secure video platforms (usually Microsoft Teams):

• Sessions are not routinely recorded.
• Clinical notes may be taken.
• The same confidentiality and security standards apply as for face-to-face sessions.

Website Analytics and Cookies

Our website uses cookies and analytics tools to understand how visitors use the site and to improve functionality.

Where required by law:

• Non-essential cookies will only be set after obtaining your consent.
• You may withdraw your consent at any time through your browser settings or website cookie preferences.

Analytics information is used only in aggregated form and is not used to identify individual visitors.

Links to Other Websites

Our website may contain links to external websites.

We are not responsible for the privacy practices of external sites and encourage you to review their privacy notices before providing personal information.

Complaints

If you have concerns about how we handle your personal information, please raise your concerns directly with us in the first instance at: cat@catwrightsolutions.co.uk

You also have the right to complain to:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113

Changes to This Privacy Notice

This Privacy Notice may be updated periodically to reflect changes in legislation, regulatory guidance or business practices.

The latest version will always be available on request and through our website where applicable.