Privacy Policy
Who I am
Your privacy matters to me, and so does the trust you place in me when you share something personal. This policy explains what information I collect, why I need it, how I keep it safe and what your rights are.
I am Cat Larsson, a clinical hypnotherapist and MEMI practitioner working as a sole trader in the United Kingdom. I offer sessions online and at my clinic in Taunton, Somerset, to clients in the UK and Sweden. I am the data controller for your personal information, which means I decide how it is used and I am responsible for looking after it.
You can contact me about anything in this policy at [your business email address]. I am registered with the Information Commissioner’s Office (ICO) under registration number [ICO number, to add once registered].
This policy was last updated on [date of publication].
What information I collect
When you book a session or contact me through my booking system, I collect your name, email address, phone number and the details of the appointment you choose. If you pay online, your payment is handled by a secure payment provider and I never see or store your full card details.
Before and during our work together, I collect information you choose to share about your health and wellbeing. This may include your reasons for seeking support, your emotional and physical health, sleep, relationships, life experiences and any medication or other treatment that is relevant to our sessions. I also keep brief notes of each session.
If you email, message or phone me, I keep a record of that communication so I can reply and support you properly.
Why I use your information
I use your information to arrange and provide your sessions, to keep accurate records of our work, to take payment, to send appointment confirmations and reminders, and to reply when you get in touch. I also keep records because my professional standards, my insurance and the law require me to.
Under UK data protection law I need a lawful reason for each of these. I rely on our contract when I arrange and provide sessions and take payment. I rely on my legal obligations when I keep financial records for HMRC. I rely on my legitimate interests when I keep a record of our communication and run my practice responsibly.
Information about your health is treated as special category data and has extra protection. I hold it because it is needed to provide you with therapeutic care, and I ask for your explicit consent to record it when we begin working together. You can ask questions about what I record at any time.
I will never sell your information, and I will never use it for marketing unless you have clearly agreed to hear from me.
Who I share it with
I only share your information with trusted services that help me run my practice, and only as much as they need. Acuity Scheduling manages my bookings, contact form, appointment reminders and online payments. Google Workspace provides my business email. Zoom is used for online sessions. WordPress hosts my website. Each of these services processes your information on my behalf and is bound by its own data protection commitments.
I do not share what you tell me in sessions with anyone else, with the limited exceptions explained under “Keeping your information safe” below. I may also discuss my work in clinical supervision, which is a normal part of good professional practice. When I do, I never share your name or anything that could identify you.
Information stored outside the UK
Some of the services I use, such as Acuity Scheduling, Google and Zoom, may store or process information in the United States or elsewhere outside the UK and the European Economic Area. When this happens, the transfer is protected by safeguards recognised under UK and EU data protection law, such as approved contract terms or recognised data protection frameworks. If you are a client in Sweden, your information is protected to the same standard.
How long I keep it
I keep client records, including session notes, for eight years after our last session. This is in line with the guidance for therapeutic practice and gives me what I need if a question or complaint ever arises. After eight years, I securely delete digital records and shred any paper notes.
I keep financial records for as long as HMRC requires. If you contacted me but never booked a session, I delete your details once they are no longer needed.
Keeping your information safe
I store your records securely, using password-protected accounts with two-step verification and devices that only I use. Any paper notes are kept in a locked cabinet. Only I have access to your records.
What you share with me is confidential. There are rare situations where I may need to share information without your consent. These are when I believe you or someone else is at serious risk of harm, when there is a concern about the safety of a child or vulnerable adult, or when the law or a court requires it. If this ever happens, I will talk with you first wherever it is safe and possible to do so.
Your rights
You have the right to ask for a copy of the information I hold about you, and to ask me to correct anything that is wrong. You can ask me to delete your information or limit how I use it, although I may need to keep some records for the full eight years for legal and professional reasons. Where I rely on your consent, you can withdraw it at any time. You can also object to how I use your information, or ask me to send it to you or someone else in a usable format.
To use any of these rights, just email me. I will reply within one month, and there is no charge.
If you are unhappy with how I have handled your information, please talk to me first so I can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you live in Sweden, you can also contact Integritetsskyddsmyndigheten (IMY) at imy.se.
Cookies
My website uses a small number of cookies that are needed for it to work properly. When you open my booking page, Acuity Scheduling may also set its own cookies so that your booking and payment can be completed securely. [If you add Google Analytics or another tracking tool later, add a sentence here and a cookie banner that asks visitors for consent.] You can block or delete cookies in your browser settings, although some parts of the site may then not work as expected.
Changes to this policy
I may update this policy from time to time, for example if I start using a new service. The latest version will always be on this page, with the date it was last updated at the top.
If you have any questions about your privacy or this policy, please email me at hallo@catlarsson.com. I am always happy to talk it through.