1. Who we are
Hands on Heart Healing provides Reiki, Reflexology, Divine Energy Healing, Crystal Healing and Hypnotherapy. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the practitioner is the "data controller" for the personal information described in this notice — the person who decides how and why your information is used.
This notice explains what information we collect about you, why we collect it, how we use and protect it, and what rights you have. Please read it before your first appointment and feel free to ask us anything that is not clear.
Data protection registration: ICO registration reference: ZC242325
2. The personal information we collect
Depending on how you interact with us, we may collect:
• Contact and identity details — name, address, phone number, email address, and date of birth.
• Emergency contact details, where you choose to provide them.
• Health and wellbeing information relevant to your treatment — for example, medical conditions, medications, injuries, pregnancy, mental health considerations relevant to treatment, and any other information you share about your physical or emotional wellbeing. This is "special category data" under Article 9 of the UK GDPR and receives extra legal protection — see Section 4.
• Where relevant to sessions, information you choose to share about your spiritual or religious beliefs or practices. This is also special category data.
• Notes made during and after consultations and treatment sessions, including your reasons for seeking treatment and your progress.
• For hypnotherapy sessions, an audio recording of the session, made solely to support accurate transcription and clinical note-taking — see Section 5 for full details.
• Appointment and booking history, and payment records (we do not store full card details — these are processed by our payment provider).
• Correspondence between us, such as emails, texts, or messages.
• If you contact us through our website or social media, the details you provide in that enquiry. If you message our Facebook page via Messenger, we will see your Facebook profile name and the content of your messages. Please do not send health or other sensitive information through Messenger; we will collect what we need securely through our client information and consent form instead.
We collect this information directly from you, primarily through our client information and consent form (which we host online using JotForm), in-session conversations, and any follow-up correspondence. We do not buy personal information about you from any other organisation.
We collect this information directly from you, primarily through our client information and consent form (which we host online using JotForm), in-session conversations, and any follow-up correspondence. We do not buy personal information about you from any other organisation.
3. Why we use your information and our legal basis
We only use your personal information where the law allows us to. Our lawful bases under Article 6 of the UK GDPR are:
• Contract — to provide the treatment you have booked, manage appointments, and take payment and to take steps at your request before you book (such as answering enquiries including those sent by messenger).
• Consent — for anything we do not need to do in order to provide treatment, such as sending appointment reminders by text/email, marketing communications, or using your testimonial or photograph. You can withdraw this consent at any time.
• Legitimate interests — for basic business administration, such as keeping accurate accounting records, and for the security of our records.
• Legal obligation — where we must keep certain records, for example for tax purposes.
Health and other special category information about you is only ever processed with your explicit, freely given consent, as described in Section 4. You do not have to disclose any health information you are not comfortable sharing, but this may affect our ability to safely provide treatment.
4. Special category (health) data
Because our treatments relate to physical, mental and spiritual wellbeing, some of the information we hold about you is "special category data" — a category of information the law treats as more sensitive, including data about health, and data revealing religious or philosophical beliefs.
We only process this information:
• with your explicit consent, given in writing on our client information and consent form, which explains exactly what will be recorded and why;
• to the extent necessary to provide you with a safe and appropriate treatment; and
• in line with our internal Special Category Data Policy, which sets out the additional safeguards we apply to this information.
You can withdraw your consent to us holding or using this information at any time, although this will not affect anything we have already done with it, and may mean we are unable to continue providing treatment to you.
5. Audio recording of hypnotherapy sessions
For hypnotherapy sessions, we may make an audio recording of your appointment. This section explains how and why we do this, alongside the information about special category data in Section 4.
Purpose: We record hypnotherapy sessions solely to help the practitioner transcribe the session accurately and prepare clear, reliable written clinical notes afterwards. Recordings are not used for training, marketing, or any other purpose, and are not shared with anyone outside the practice.
Legal basis: Under Article 6 of the UK GDPR, we rely on legitimate interests — accurate record-keeping supports the safe and effective delivery of your treatment — and, where relevant, contractual necessity in providing the service you have booked. Because the recording captures special category (health) data, we additionally rely on your explicit consent under Article 9(2)(a) of the UK GDPR. This is given separately and specifically for the recording itself, in addition to your general treatment consent described in Section 4.
Storage and security: Audio recordings are held securely, on password-protected devices and/or secure transcription software that uses encryption. Access to recordings is limited to the practitioner only.
Retention: Audio recordings are temporary. They are deleted permanently as soon as your written clinical notes have been completed, and in any event within 7 days of the session, whichever happens first.
Your rights: You can withdraw your consent to being recorded at any time, including part-way through a session, without it affecting your therapy or any other treatment we provide. If you withdraw consent, we will take handwritten notes instead. Withdrawing consent does not affect the lawfulness of anything already done with a recording before you withdrew it.
6. Children and young people
We do not treat clients under the age of 18. Where we do, we apply the following additional safeguards:
• For clients under 16, our client information and consent form — including consent to process any health or other special category data — must be completed and signed by a parent or legal guardian before any treatment takes place. We also seek the young person's own agreement to treatment, in an age-appropriate way, wherever they are able to give it.
• For clients aged 16 or 17, we will normally seek consent from both the young person and a parent or legal guardian. Some 16- and 17-year-olds are able to consent to their own treatment; where there is any doubt about a young person's capacity to understand and agree to treatment or to the use of their information, we will also obtain parental or guardian consent.
• We apply extra care to information collected about children and young people, including limiting who can access it and thinking carefully about what we record and for how long.
• We keep treatment records for clients who were under 18 at the time of treatment until they reach the age of 25 (see Section 8).
• Once a young person turns 18, they may exercise their own rights under Section 10 directly, independently of a parent or guardian.
If you have any safeguarding concerns about a child or young person, please raise them with us directly, or contact the relevant local authority children's services or the police if you believe a child is at immediate risk.
7. Who we share your information with
We do not sell your personal information to anyone. We only share it in limited circumstances:
• With your GP or another healthcare professional, but only with your specific consent, or where we believe there is a serious risk to your safety or someone else's.
• With service providers who support our business ("processors"), such as a bookkeeper/accountant or IT support, where used. This includes JotForm, which hosts our online client intake and consent forms, and Proton Drive, which we use to store client folders and records securely. These providers only act on our instructions and are required to keep your information secure.
• Where we are required to by law, for example if requested by a court, regulator, or the police.
• With a professional body, insurer, or their legal advisers, if needed to respond to a complaint or insurance claim.
JotForm stores the information submitted through our online forms on cloud servers located in Germany, and Proton Drive stores our client folders and records on servers located in Switzerland. This means some of your personal information is transferred outside the United Kingdom, to the European Economic Area (EEA) and to Switzerland. The UK Government has confirmed that both the EEA, including Germany, and Switzerland provide an adequate level of data protection under UK data protection law, so no additional safeguards are required for these transfers. Aside from this, we do not currently transfer your personal information outside the United Kingdom. If this changes, we will update this notice and ensure appropriate legal safeguards are in place.
Facebook and Messenger (Meta). If you contact us through our Facebook Page or Messenger, your messages are also processed by Meta Platforms, which operates Facebook and Messenger. Meta is a separate data controller: it handles your information for its own purposes under its own privacy policy (available at facebook.com/privacy/policy), and we do not control how it uses that information. Meta may store or transfer your information outside of the United Kingdom including to countries that do not have a UK adequacy decision. You can exercise your data protection rights in relation to Meta directly with Meta. If you would prefer not to use Messenger, you can contact us by using the enquiry form on the website instead.
8. How long we keep your information
We keep information for no longer than necessary. As a general guide:
• Client consultation and treatment records: at least 7 years from your last appointment (longer if you were under 18 when treated, or if required by our professional indemnity insurer).
• Financial and payment records: at least 6 years, in line with HMRC requirements.
• Marketing consents and preferences: until you withdraw consent.
• Enquiries that do not lead to a booking: normally deleted within 12 months.
• Messages sent through Messenger also remain on Meta's systems in line with Meta's own policies unless you delete them.
Full detail is set out in our Data Retention and Deletion Policy, available on request.
9. How we protect your information
We take the security of your information seriously and use measures appropriate to a small practice handling sensitive data, including:
• storing paper records in locked storage, accessible only to the practitioner;
• storing digital records — including client folders — in Proton Drive, an end-to-end encrypted cloud storage service, and on password-protected devices and accounts;
• limiting access to your records to the practitioner only, unless you are told otherwise;
• securely disposing of records once their retention period ends (shredding paper, permanently deleting digital files).
10. Your rights
Under UK data protection law, you have the right to:
• be informed about how your personal information is used (as set out in this notice);
• access a copy of the personal information we hold about you;
• have inaccurate information corrected;
• ask us to erase your information in certain circumstances;
• restrict or object to certain processing, including direct marketing;
• receive certain information in a portable, machine-readable format; and
• withdraw consent at any time, where we rely on consent.
To exercise any of these rights, please contact us at info@handsonhearthealing.co.uk. We will normally respond within one month.
We may need to verify your identity before responding, and in some cases the law allows us to withhold or limit what we provide (for example, where records also concern another person).
11. Complaints
If you are unhappy with how we have handled your personal information, please tell us first at info@handsonhearthealing.co.uk so we can try to put things right — we will acknowledge your complaint within 30 days and aim to resolve it as quickly as possible.
You also have the right to complain directly to the UK's data protection regulator, the Information Commissioner's Office (ICO):
• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Changes to this notice
We may update this notice from time to time, for example to reflect changes in the law or in how we run the practice. The version number and effective date at the top of this document show when it was last updated. We will let existing clients know if we make a significant change.
