Privacy policy
Last updated 12 September 2026.
This policy explains how Debbie Bell (“the Practitioner”) collects, uses, stores, and protects your personal information, in line with the Data (Use and Access) Act 2025, the Data Protection Act 2018, and the UK General Data Protection Regulation (UK GDPR).
By using debbiebellhypnotherapy.co.uk or booking a session, you agree to this policy.
Debbie Bell is the data controller and is registered with the Information Commissioner’s Office. ICO registration number: ZB692945.
What I collect
Information is collected so therapy can be safe, suitable, and effective.
- Personal details, such as your name, address, contact details, and booking or payment details.
- Health and lifestyle information relevant to your sessions, including session notes. This is special category data and is treated as confidential.
- Messages you send by email, text, or phone, and records of appointments.
Children and young people
Where sessions are for someone under 18, extra care is taken. A parent or guardian’s consent is obtained. Information may be discussed in professional supervision so the work stays safe. Identifying details are not shared in supervision, and supervisors are bound by confidentiality.
Confidentiality
What you discuss in sessions stays confidential, except where there is a legal or ethical duty to pass information on. That includes a risk of serious harm to you or someone else, a safeguarding concern involving a child or a vulnerable adult, or a legal requirement such as a court order. Where possible, this will be discussed with you first.
If we see each other outside a session, your confidentiality still stands. I will not start a conversation in public. If you say hello first, I will respond, but we will not talk about your therapy outside a session.
How information is collected
Information comes from emails, phone calls, and texts, from bookings, and from your initial consultation and later sessions.
How it is used
Your information is used to provide therapy, keep accurate records, manage bookings and payments, reply to you, and meet legal, ethical, and insurance duties. It is not sold, and it is not shared for marketing.
The lawful reasons for using it include the contract to provide sessions, legitimate interests in running a safe practice, legal duties, protecting life where that is necessary, and your explicit consent for health information.
This website
This site does not use a website builder, and it does not set marketing or analytics cookies. The company that hosts the site may keep ordinary server logs, such as an IP address, the time, and the page requested, so the site can stay secure. That is done for security, which is a legitimate interest. If cookies are added later, this policy will be updated.
When you email, I keep your contact details, the message, and the history of our correspondence so I can reply and keep an accurate record.
The site may link to other websites. Their privacy practices are their own.
Payment
Sessions are paid by cash or bank transfer. Only the details needed to take payment, make a refund, or answer a payment query are shared with the bank. Your bank handles that information under its own privacy policy.
If you book through Setmore, Setmore processes that booking under its own privacy policy.
Who else sees it
Information is shared only when it needs to be:
- with your bank, for a payment
- with Setmore, if you book that way
- where the law requires it
- where there is a safeguarding concern
- with a supervisor, with identifying details removed where possible
How long it is kept
Adult records are kept for 7 years after the final session. Records for children and young people are kept for 20 years after the last contact, or until age 25 (or 26 if the young person was 17 when seen), whichever applies. Records are securely destroyed in the January after that period ends. These periods follow recognised health and social care practice, and may be longer if a legal claim, a complaint, or a safeguarding matter requires it.
Asking for information to be deleted
You can ask for your information to be erased, where the law allows it. Please ask in writing. Once your identity is confirmed, paper records are securely destroyed and electronic records are permanently deleted. There is no charge.
The right to erasure is not absolute. Information may be kept where it is needed for a legal duty, insurance, a legal claim, or safeguarding. A short note that you made the request is kept, so that compliance can be shown.
Your rights
You can ask for a copy of your information, ask for mistakes to be corrected, ask for processing to be restricted, object to processing, ask for information to be moved, and withdraw consent. Email debbie@debbiebellhypnotherapy.co.uk.
A request for a copy of your information will be answered within one month. The search will be reasonable and proportionate.
Complaints
If you are unhappy with how your information is handled, email debbie@debbiebellhypnotherapy.co.uk. The complaint will be acknowledged within 30 days, and answered without undue delay. If you are not satisfied, you can contact the Information Commissioner’s Office at ico.org.uk.
Decisions about your care
No automated decision-making or profiling is used in your care.
This policy may be updated. The latest version will be on this page.