At Empowered Hypnotherapy, your privacy and the security of your data are taken very seriously. In May 2018, the Data Protection Act was replaced by the General Data Protection Regulation (GDPR). These rules ensure that your personal, confidential, and sensitive health and session data are held privately and securely.

​

1. Data Controller Details

• Business Name: Amelia Kury T/A Empowered Hypnotherapy

• Website: www.empoweredhypnotherapy.co.uk

• ICO Registration Reference: ZB295996

​

2. How will my data be stored?

Your personal information, case details, and session notes are collected and retained strictly for the purpose of delivering effective therapeutic services. All sensitive data is held securely:

• Hardcopy Documents & Written Notes: Stored securely in a locked cabinet within a locked room.

• Text Messages & Phone Contacts: Secured via PIN code, fingerprint/face ID, and device encryption.

• Emails: Password-protected email accounts. Any sensitive attachments sent electronically will be password-protected.

• Electronic Documents: Held on encrypted, password-protected devices.

​

3. Why do you collect this information?

I collect basic personal data (such as contact information, emergency contacts, and GP details) along with relevant personal, medical background information, and brief session notes.

This information allows me to:

• Provide a safe, tailored, and high-quality hypnotherapy service.

• Prepare for our therapeutic sessions with appropriate context.

• Maintain professional standards as required by my governing bodies.

Your contact details, address, and GP details will only ever be used in accordance with the consent you provide or under exceptional legal/safeguarding circumstances.

​

4. How long will you hold my information for?

As a member of the National Council for Hypnotherapy (NCH) and the Association for Solution Focused Hypnotherapy (AfSFH), I am required to retain client records in accordance with professional regulatory guidelines:

• Adult Clients: Records are retained for 8 years following our final session.

• Clients Under 18: Records are held until your 25th birthday (or until your 26th birthday if you were 17 at the conclusion of therapy).

All data and records will be securely destroyed/deleted in the January following the required retention period.

​

5. Can I see or request a copy of my records?

Yes. Under GDPR regulations, you have the right to request a copy of the information held about you. Notes of your sessions are available to you upon reasonable notice and will be fulfilled within 30 days.

​

6. What if I request my data to be erased?

Under GDPR, you have the "right to be forgotten" and may request deletion of your records. However, please note that where legal, insurance, or professional body obligations require records to be retained for a set period (e.g., claims defense retention rules), those legal obligations supersede erasure requests.

​

7. Confidentiality & Exceptions

Everything discussed within hypnotherapy sessions is strictly confidential between the therapist and client. Information is protected at all times, except in the following rare circumstances:

1. Supervision: Under my professional obligations with the NCH and AfSFH, I undertake ongoing clinical supervision. I may discuss client case histories with my supervisor to ensure effective practice. In these instances, all information shared is completely anonymised so you cannot be identified, and my supervisor also adheres strictly to GDPR laws.

2. Legal Orders: Information will be disclosed if required under a Court Order (civil, criminal, or coroner’s court) or where required by law enforcement.

3. Safeguarding & Harm: If there is reason to believe that failure to disclose information would cause severe harm or danger to yourself or members of the public, under duty of care, relevant health professionals or authorities may be informed. Where safe and appropriate, this would be discussed with you first.

4. Health Professionals: Information may be shared with your GP or NHS medical practitioner, but only with your explicit consent.

​

8. What if we meet outside of our sessions?

To protect your privacy and maintain confidentiality in public, if we happen to see each other outside of our sessions, I will not approach or acknowledge you first. If you choose to greet me, you remain in complete control over how much or how little you wish to disclose.

​

9. Your Rights

Under data protection laws, you hold the following rights:

• Right of access: To request copies of your personal data.

• Right to rectification: To request correction of inaccurate or incomplete data.

• Right to restriction or objection: To request restriction or object to data processing.

If you have any questions or concerns regarding how your data is handled, please contact Amelia Kury directly. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk using reference number ZB295996.