Data held by Aija Hypnotherapy will be held lawfully and for the retention periods set out in this policy document.
 
This document refers to:
  • Written Documents
  • Spreadsheets
  • Hardcopy case notes and files
  • Database entries
  • Images
  • Recordings
  • Emails
  • Text messages
  • Supervision notes
  • Visits to the organisation’s website
  • Social media communication

The purpose of this document is to ensure that Aija Hypnotherapy has a framework that ensures the rights and freedom of individuals in relation to their personal data (Article 1) and adheres to best practice in the management of client information and business records.

Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;
  • is the right information
  • is in the right place
  • at the right time
  • with the right people
  • for the right reasons

This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates. Aija Hypnotherapy is fully committed to ensuring clients privacy and data protection rights. I will not explicitly inform my clients or website users of these changes. Instead, I recommend that you check this page occasionally for any policy changes.

For the purpose of this policy Aija Kruce is the named Data Protection Officer/Controller and Head of Organisation. 

1. Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised.

2. Any data collected is solely for the purpose of providing a person-centred service to an individual client.

3. All technology used to store or facilitate information and communication is maintained according to the Data Retention Policy for Aija Hypnotherapy.

4. All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.

5. It is the responsibility of the Data Controller to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.

6. Any electronic devices where personal or sensitive, confidential information is held will be password protected. 

In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.

On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisation’s website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]

  • Personal information is collated and stored in hardcopy in a locked filing cabinet behind a locked door.
  • Any document containing personal data will state “Official-sensitive, private and confidential” clearly.
  • All emails will contain a privacy statement.

Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have;
  • the right to be informed;
  • the right of access;
  • the right to rectification;
  • the right to erasure;
  • the right to restrict processing;
  • the right to data portability;
  • the right to object; and
  • the right not to be subject to automated decision-making including profiling.

Please note that Aija Hypnotherapy does not use automated decision-making tools, including profiling.

If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing.

Website visitors
When an individual visits www.aijahypnotherapy.com, I use Google analytics who are considered a third party service, to collect information about what visitors do when they click on my website, e.g. which page they visit the most. Google analytics only collect non-identifiable data which means I or they cannot identify who is visiting. Aija Hypnotherapy will always be transparent when it comes to collecting personal data and will be clear about how that data is processed. Google analytics privacy notice can be found here

Cookies
Like any other website, Aija Hypnotherapy's website uses cookies. These cookies are used to store information including visitors’ preferences, and the pages on the website that the visitor accessed or visited. The information is used to optimise the users’ experience by customising the web page content based on visitors’ browser type and/or other information. You can choose to disable cookies through your individual browser options. For further information visit www.aboutcookies.org or www.allaboutcookies.org.

Contact Form
When you contact Aija Hypnotherapy via the website Contact Form, your name and email address will be collected. By using the Contact Form, you consent to Aija Hypnotherapy using this information for correspondence purposes, notably to discuss your interest in the Hypnotherapy service and/or to book an appointment. To delete your email from Aija Hypnotherapy's records, please contact Aija Kruce by email at aija@aijahypnotherapy.com  

What is the lawful basis for processing data at Aija Hypnotherapy?

  • In relation to communicating with my clients: The individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.
  • Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
  • Processing is necessary for your legitimate interests as specified in Article 9 of the GDPR;

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

2. Paragraph 1 shall not apply if one of the following applies:
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

This means that Aija Hypnotherapy does not require consent to hold your data to provide a service but does require your consent to contact you for specific purposes. Participating in the service by attending more than one appointment implies that you agree with the Terms and Conditions provided to you at the commencement of service delivery.

Description of processing
The following is a broad description of the way this organisation/data controller processes personal information.

Reasons/purposes for processing information
Aija Hypnotherapy processes personal information to enable the provision of Psychotherapy and Hypnotherapy, to advertise services and to maintain accounts and records.

Type/classes of information processed
Aija Hypnotherapy processes information relevant to the above reasons/purposes. This information may include:
  • personal details
  • family, lifestyle and social circumstances
  • goods and services
  • financial details
  • employment and education details

Aija Hypnotherapy also processes sensitive classes of information that may include:
  • physical or mental health details
  • racial or ethnic origin
  • religious or other beliefs of a similar nature
  • offences and alleged offences

Aija Hypnotherapy processes personal information about:
  • clients
  • suppliers
  • business contacts
  • professional advisers
  • supervisors 

A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.

A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after eight years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.

A SAR request will include information I hold about you, Aija Hypnotherapy will:
  • give you a description of it;
  • tell you why I are holding it;
  • tell you who it could be disclosed to; and
  • let you have a copy of the information in an intelligible form.

SAR requests should be put in writing to Aija Hypnotherapy. A response may be provided informally over the telephone with your agreement, or formally by letter or email. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information. If you wish for your data to be provided to another service provider, you may also request this in writing. I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to Aija Hypnotherapy.

Right to Erasure
Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made. In some instances, my supervisory body or insurance company may require me to lawfully hold your files until the end of their retention period. If this arises, I will notify you at my earliest opportunity.

Complaints
Aija Hypnotherapy hopes to the meet the highest quality standards when processing personal and sensitive data. Complaints can help identify areas for improvement and therefore Aija Hypnotherapy would welcome you raising any concerns you have.

These Information Governance Policy Documents are created to be as transparent and understandable as possible. It will not be completely exhaustive of all aspects of data collection. If you would like further information about a specific process, please contact Aija Hypnotherapy.