Privacy Notice
Last updated: 22 September 2026
Healing with Chloe is operated by Chloe O’Brien.
For the purposes of UK data protection law, I am the data controller for the personal information I collect and use in connection with my therapy and hypnotherapy practice.
Website: Healing with Chloe
Privacy contact: hello@healingwithchloe.com
If you have any questions about this Privacy Notice or how I handle your personal information, please contact me using the details above.
About this Privacy Notice
This Privacy Notice explains:
what personal information I collect;
why I collect and use it;
the legal bases I rely on;
how I store and protect it;
when information may be shared;
how long I keep it;
how third-party services are used;
your rights under UK data protection law; and
how to raise a data protection complaint.
I handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and Data (Use and Access) Act 2025, together with other applicable UK data protection legislation.
Because therapy may involve information about your physical or mental health, some of the information I process is classed as special category personal data and receives additional protection under data protection law.
What information I may collect
Depending on your relationship with Healing with Chloe, I may collect and process information including:
Identity and contact information
This may include:
your name;
date of birth;
email address;
telephone number;
emergency contact details;
address where relevant; and
parent, guardian or responsible-adult details where relevant.
Therapy and health information
This may include information you provide about:
what you would like help with;
your goals for therapy;
physical and emotional health;
mental health and wellbeing;
medical history;
medication;
sleep;
panic or anxiety symptoms;
alcohol or substance use where relevant;
previous therapeutic or medical support;
family and personal background;
your GP or other healthcare professionals where relevant;
information discussed during therapy;
progress during our work together; and
brief factual session records.
Health and mental-health information is special category personal data.
I aim to collect only information that is reasonably necessary for the therapeutic relationship, professional record keeping, safety and administration of my practice.
Appointment and communication information
This may include:
appointment dates and times;
booking information;
emails;
WhatsApp messages;
changes or cancellations;
online meeting information; and
relevant correspondence relating to your therapy.
Payment information
Where you pay by bank transfer, I may receive information such as your name, payment reference, amount paid and transaction date.
I do not require clients to provide online banking passwords or card-security information.
Feedback and testimonials
If you choose to provide feedback, I may collect your comments about your experience.
Permission to publish a testimonial is separate and optional. I will not publish identifiable client feedback as a testimonial without appropriate permission.
Website information
When you visit the Healing with Chloe website, limited technical information may be processed through cookies and similar technologies.
Essential technologies may operate automatically. Analytics, advertising or other non-essential tracking technologies will only be used in accordance with applicable cookie and electronic-communications rules.
Please see the Healing with Chloe Cookie Notice for further information.
Where I obtain information from
Most personal information is provided directly by you, for example when you:
make an enquiry;
book a discovery call;
contact me by email or WhatsApp;
complete the Client Intake Form;
attend therapy;
make a payment; or
provide feedback.
In some circumstances, information may also be provided by:
a parent or person with parental responsibility;
a person making a referral;
another healthcare or support professional; or
another person you have authorised to communicate with me.
I will only use information received from another person where there is an appropriate reason to do so.
Why I use your information
I use personal information where necessary to:
respond to enquiries;
arrange discovery calls and appointments;
assess whether my service may be appropriate;
understand your circumstances and therapeutic goals;
provide Solution Focused Hypnotherapy and related therapeutic support;
maintain appropriate client records;
communicate with you about appointments and therapy;
provide hypnosis recordings or other therapeutic resources;
maintain professional supervision;
manage payments and financial records;
meet professional, insurance, safeguarding and legal responsibilities;
respond to complaints and data-protection requests;
protect the safety of clients or others where appropriate; and
improve my service.
I do not sell client information.
My lawful bases for using personal information
UK data protection law requires me to have a lawful basis for processing personal information.
Different bases apply to different activities.
Contract and steps before entering a contract
I rely on Article 6(1)(b) – contract where processing is necessary to:
respond to a request to begin working together;
arrange therapy;
administer appointments;
communicate in relation to the therapeutic service;
receive payment; and
provide therapy and associated resources.
Some information is necessary in order for me to provide a safe and appropriate therapeutic service. If you choose not to provide information that is reasonably necessary for this purpose, I may be unable to provide therapy.
Legitimate interests
I may rely on Article 6(1)(f) – legitimate interests where this is necessary and proportionate for purposes including:
maintaining appropriate professional records;
maintaining continuity of care;
professional supervision;
maintaining professional standards;
protecting my practice and clients;
dealing with professional complaints; and
retaining records where reasonably necessary after therapy has ended.
My legitimate interests do not override your fundamental rights and freedoms.
Legal obligations
I rely on Article 6(1)(c) – legal obligation where information must be processed to comply with applicable legal requirements, including relevant tax, accounting and data-protection obligations.
Consent
I rely on Article 6(1)(a) – consent for activities that are genuinely optional, such as:
certain marketing communications;
optional feedback where consent is appropriate; and
publication of testimonials.
Where processing relies on consent, you can withdraw that consent at any time.
Withdrawal does not make processing that took place before withdrawal unlawful.
Safeguarding and emergencies
Where necessary to safeguard a child or an adult who meets the statutory definition of being at risk, I may rely on the recognised legitimate interest for safeguarding vulnerable individuals. Other lawful bases, including legal obligation or vital interests, may apply in different circumstances. Where safeguarding involves special-category information, an appropriate Article 9 and Data Protection Act 2018 condition will also be identified.
Special category health and therapy information
Information about physical or mental health receives additional legal protection.
For health and therapy information necessary to provide my therapeutic service, I rely on Article 9(2)(h) UK GDPR, read with Schedule 1 Part 1 paragraph 2 and section 11 of the Data Protection Act 2018, where the processing is necessary for the provision of health care or treatment and is carried out subject to my duty of confidentiality.
I have a professional duty of confidentiality towards my clients.
Other special-category conditions may apply in particular circumstances, including:
explicit consent, for example where you specifically agree to publication of sensitive information in a testimonial;
establishment, exercise or defence of legal claims, where necessary;
substantial public interest and safeguarding provisions, where permitted by law; and
vital interests, in a genuine emergency where the legal conditions are met.
I only process special-category information where there is an appropriate legal basis and the information is reasonably necessary for the purpose concerned.
Confidentiality
The therapeutic relationship is confidential.
I will not ordinarily disclose what you tell me during therapy to other people without an appropriate reason or your permission.
However, confidentiality is not absolute.
There may be circumstances where information needs to be disclosed, for example:
where you have authorised me to communicate with another professional;
where I reasonably believe there is a serious safeguarding concern or risk of significant harm;
where disclosure is necessary to protect vital interests;
where information is lawfully required by a court, law-enforcement body or other authority;
where disclosure is necessary for the establishment, exercise or defence of legal rights; or
where another legal obligation requires disclosure.
Where it is safe, lawful and appropriate to do so, I would normally aim to discuss a disclosure with you before making it.
I disclose only information that is necessary and proportionate to the circumstances.
Professional supervision
Professional supervision forms part of responsible therapeutic practice.
I may discuss aspects of my work with a qualified clinical supervisor to support professional standards, client safety and the quality of my work.
Where possible, identifying information is removed or minimised and direct identifiers are removed or minimised where possible, and clients may be referred to using a client code or pseudonym
My supervisor is also subject to professional confidentiality requirements.
In exceptional circumstances, more information may need to be discussed where necessary for safety, safeguarding, professional advice or legal reasons.
Online therapy
Therapy sessions are currently provided using Google Meet.
I do not record Google Meet therapy sessions.
Meeting links are sent directly to clients by email or WhatsApp.
Clients are responsible for choosing an environment in which they can participate safely and privately.
Additional arrangements apply when working online with children or vulnerable clients.
Hypnosis recordings
I may provide hypnosis or relaxation recordings for use between sessions.
Some recordings are generic and others are individually prepared.
A personalised recording may itself reveal information about your therapeutic goals or circumstances and is therefore treated as confidential client information.
Recordings are commonly sent directly to the client through WhatsApp.
I take reasonable steps to minimise unnecessary identifying information within recordings.
Systems and service providers
To run my practice I use a limited number of external services.
These currently include:
Google services may be used for:
email;
Google Forms;
Google Drive;
Google Docs; and
Google Meet.
Client records held in my Google Drive are accessible only by me.
Calendly
Calendly may be used to arrange appointments and discovery calls.
I aim to collect only the information necessary for scheduling through Calendly.
WhatsApp / Meta
WhatsApp may be used for:
appointment communication;
sending Google Meet links;
routine client communication; and
sending hypnosis recordings.
I minimise unnecessary sensitive clinical information in messaging wherever practicable.
HSBC
HSBC is currently used to receive client payments by UK bank transfer.
HSBC processes banking information under its own legal and regulatory responsibilities.
Website, analytics and advertising providers
The Healing with Chloe website may use hosting, security, analytics and advertising services.
Where non-essential cookies or similar technologies are used, these are managed through the website’s cookie-consent controls and the Cookie Notice.
International processing and transfers
Some of the technology providers I use operate internationally. This means that personal information may sometimes be processed outside the United Kingdom.
The services I currently use include Google, Calendly and WhatsApp.
Google operates services and infrastructure internationally. Where personal information is transferred outside the UK, Google uses recognised transfer mechanisms including UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework and contractual safeguards where required.
Calendly stores user and invitee information in the United States. Calendly participates in the UK Extension to the EU-US Data Privacy Framework and its Data Processing Addendum also incorporates contractual safeguards, including the UK Addendum to the Standard Contractual Clauses, where applicable.
WhatsApp operates globally and may process account, device, usage and other service information outside the UK. WhatsApp uses recognised safeguards including UK adequacy regulations and approved UK contractual transfer mechanisms. Personal WhatsApp messages and calls are protected by end-to-end encryption, meaning that WhatsApp cannot read or listen to their content.
Where personal information is transferred outside the United Kingdom, I take reasonable steps to use services that provide an appropriate lawful transfer mechanism and suitable protections for personal information.
You may contact me to request further information about an international transfer and, where applicable, information about or a copy of the relevant safeguards.
Who I may share information with
Depending on the circumstances, information may be shared with:
technology and communications providers necessary to operate the practice;
my clinical supervisor;
a healthcare or support professional where you have authorised communication or another lawful basis exists;
my professional insurer;
a professional membership or regulatory body where necessary;
an accountant, HMRC or other financial authority where legally necessary;
legal advisers where necessary;
safeguarding services or social-care authorities;
emergency services;
police or other law-enforcement authorities where disclosure is lawful and necessary; or
courts or other bodies where disclosure is legally required.
I do not routinely share therapy information with family members, partners or friends simply because they know you are attending therapy.
Children and young people
Additional protections apply when I work with children and young people.
Where appropriate, I may collect information about:
the young person;
a parent or person with parental responsibility;
emergency contacts; and
relevant safeguarding or health information.
Privacy and confidentiality will be explained in a way appropriate to the young person's age and understanding.
A parent or responsible adult does not automatically have an unrestricted right to every piece of information discussed in therapy.
Requests involving a young person's information are considered in accordance with data protection law, safeguarding requirements, the young person's age and understanding, parental responsibility and the circumstances of the request.
Safeguarding responsibilities may require information to be shared where there is a serious concern about the safety or welfare of a child or another person.
When I work with a client under 18, a separate under-18 agreement and consent process will be completed before therapy begins.
How I protect your information
I take reasonable organisational and technical steps to protect personal information.
These include:
password-protected accounts and devices;
PIN and/or biometric protection on relevant mobile devices;
restricted access to client records;
only I currently have access to the Healing with Chloe client records held in Google Drive;
private online meeting links;
not recording Google Meet therapy sessions;
minimising information collected and shared;
using client codes and removing unnecessary identifying details where practicable for professional supervision;
keeping financial information separate from clinical notes where practicable; and
securely deleting information when it is no longer required.
No electronic system can be guaranteed to be completely secure, but I take proportionate steps to protect the confidentiality, integrity and availability of client information.
How long I keep information
I do not keep personal information indefinitely.
Different information is retained for different periods depending on its purpose, professional requirements, insurance requirements and legal obligations.
Enquiries that do not become clients
Information relating to enquiries that do not proceed to therapy will normally be deleted within six months of the last meaningful contact, unless there is a legitimate reason to retain it longer.
Client clinical records
For adult clients, clinical records will normally be retained for eight years after the last therapeutic interaction, subject to any longer requirement imposed by my insurer or applicable law.
For a client who is a child, clinical records will normally be retained until their 25th birthday, or until their 26th birthday where the client was 17 when therapy ended, subject to any longer requirement imposed by my insurer or applicable law.
Routine appointment communications
Routine administrative emails and WhatsApp messages will normally be deleted within 12 months after therapy ends where they are no longer required.
Correspondence that forms a meaningful part of the clinical record may be retained with that record.
Financial records
Financial information required for tax and accounting purposes is retained for the period required by HMRC and other applicable legal obligations.
Personalised hypnosis recordings
My copy of a personalised recording will normally be retained while it is therapeutically useful and deleted within approximately three months after therapy ends, unless there is a reasonable professional reason to retain it for longer.
A copy that you have already received on your own device remains under your control.
Complaints and safeguarding information
Information relating to a complaint, safeguarding concern or legal matter may need to be retained for longer where necessary to comply with professional, insurance or legal requirements.
Feedback and testimonials
Identifiable service feedback is retained only for as long as reasonably useful.
A testimonial may remain published until permission is withdrawn or I stop using it.
Where appropriate, I may retain evidence that valid publication permission was given.
Your data protection rights
Depending on the circumstances and lawful basis being used, you may have the right to:
be informed about how your information is used;
request access to personal information I hold about you;
ask for inaccurate information to be corrected;
request deletion of information in certain circumstances;
request restriction of processing in certain circumstances;
object to certain processing;
receive certain information in a portable format where the right to data portability applies; and
withdraw consent where consent is the lawful basis being relied upon.
These rights are not absolute and sometimes another legal, professional or safeguarding requirement means I may need to retain or continue processing certain information.
Your right to object
Where I rely on legitimate interests to process your personal information, you have the right to object to that processing.
If you object, I will consider your circumstances and whether there are compelling legitimate grounds for the processing to continue.
Accessing your records
You have the right to request access to personal information held about you. This is commonly called a Subject Access Request (SAR).
A request does not need to use the words "Subject Access Request" and may be made verbally or in writing.
I may need to verify your identity before releasing information.
I will normally respond within one calendar month, subject to the extensions permitted by data protection law in appropriate circumstances.
I am required to take reasonable and proportionate steps to locate the personal information covered by a request.
Information about another person may need to be redacted or withheld where disclosure would unfairly affect their rights or where another legal exemption applies.
Deleting your information
You may ask me to erase personal information I hold about you.
The right to erasure is not absolute.
For example, I may need to retain some information because:
professional record-keeping requirements apply;
my insurer requires records to be retained;
the information is required for legal claims;
a legal obligation applies; or
safeguarding considerations require continued retention.
I will consider each request individually and explain the outcome.
Data protection complaints
If you have concerns about how Healing with Chloe has collected, used, stored or shared your personal information, please contact me first so that I can investigate the issue.
You can make a data protection complaint here
or by contacting:
I will:
provide a clear route for you to raise a data protection complaint;
acknowledge receipt within 30 days;
take appropriate steps to investigate;
keep you informed where appropriate; and
tell you the outcome without undue delay.
This process is specifically for complaints about the handling of personal information.
Complaints about therapeutic practice, professional conduct or the quality of the service are dealt with separately under the Healing with Chloe Complaints Policy.
Complaining to the Information Commissioner's Office
You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
I would welcome the opportunity to try to resolve your concern first, but contacting me does not remove your right to contact the ICO.
Information Commissioner's Office: ico.org.uk
Changes to this Privacy Notice
I review this Privacy Notice periodically and may update it if:
the services I provide change;
the systems or technology I use change;
professional requirements change; or
data protection law or regulatory guidance changes.
The current version will be published on the Healing with Chloe website together with its last-updated date.
Where there is a significant change to how I use existing client information, I will take reasonable steps to bring that change to the attention of affected clients before the new processing begins where required.