Privacy notice

Matthew Bates Hypnotherapy
Last updated: 12/11/2026

This privacy notice explains how Matthew Bates, trading as Matthew Bates Hypnotherapy ("I", "me", "my"), collects, uses, stores and protects your personal information when you visit this website, submit an enquiry or receive my hypnotherapy and psychotherapy services.

My services may involve information about your physical health, mental health and wellbeing. Some of this information is classified as special category personal data under UK data protection law and receives additional protection.

1. Who I am

Data controller: Matthew Bates, trading as Matthew Bates Hypnotherapy
Practitioner and data protection contact: Matthew Bates
Business location: Ashford, Kent, England
Email: info@matthewbateshypnotherapy.co.uk

Telephone: 07834 511938

If you have questions about this notice or how your information is handled, contact me at info@matthewbateshypnotherapy.co.uk.

2. What information I collect

When you make an enquiry

When you complete the website enquiry form or contact me by email, I may collect:

• Your name.
• Email address.
• Telephone number.
• Preferred contact times.
• Whether you are enquiring for yourself, on behalf of another person, or about a talk or presentation.
• Brief information about your difficulty, including how long it has been present.
• What you have already tried.
• Relevant health or medication information that you choose to share.
• How you heard about Matthew Bates Hypnotherapy.
• Any other information you choose to provide.

Please avoid including detailed medical or other sensitive information in your initial website enquiry. This can be discussed through an appropriate communication channel if you decide to proceed.

If you proceed to assessment or therapy

If you proceed to an assessment or programme, I may collect more detailed information, including:

• Your sleep history, sleep pattern and sleep-related concerns, where relevant.
• Information about work, travel, routines and circumstances relevant to your treatment.
• Health information, including current or previous physical or mental-health conditions, medication and relevant medical history.
• Information about previous treatment or support you have received.
• Assessment responses, questionnaires and progress measures.
• Session notes and treatment records.
• Appointment, invoicing and payment records.
• Signed consent forms and records of consent.

Where services are provided to someone under 18, I may also collect relevant information about their parent or legal guardian, parental responsibility and the arrangements necessary to provide appropriate services.

Information collected automatically when you visit the website

Certain technical information may be collected automatically when you visit this website, including:

• IP address.
• Browser type and version.
• Device and operating system information.
• Pages visited and website access information.
• Date and time of access.
• Technical information required to maintain website security and functionality.

This information is used for website operation, security, troubleshooting and the prevention of malicious activity.

3. Why I use your information

I use your information to:

• Respond to your enquiry and assess whether my services are suitable.
• Arrange appointments, assessments and sessions.
• Carry out an initial assessment and decide, with you, whether to proceed.
• Provide safe, appropriate and individualised hypnotherapy and psychotherapy services.
• Keep accurate clinical and administrative records.
• Monitor progress and review the effectiveness of the support provided.
• Process fees and manage the business relationship.
• Meet legal, regulatory, professional and insurance obligations.
• Communicate with you about appointments and services.
• Maintain website security and prevent misuse.

I do not use your information for automated decision-making or profiling. Decisions about suitability, treatment and continuation are made by me in discussion with you.

4. Lawful bases for processing

Under UK data protection law, I must identify a lawful basis under Article 6 of the UK GDPR for processing personal data. Where I process health information or other special category data, I must also identify an applicable condition under Article 9.

The bases I rely upon include:

Explicit consent for health information

Before proceeding with assessment or therapy involving health information, I obtain written consent from each client for the processing of their personal and health information.

Consent records are scanned and stored electronically as part of my client records.

This consent is intended to provide explicit consent under Article 9(2)(a) of the UK GDPR for the processing of special category health information for the specified purposes.

You may withdraw your consent at any time by contacting me at info@matthewbateshypnotherapy.co.uk.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. It may, however, affect my ability to continue providing services that require the processing of that information.

Where another lawful basis applies, certain information may need to be retained, for example where necessary to meet legal obligations or establish, exercise or defend legal claims.

5. Confidentiality

Information you share is treated confidentially and is used only for your care and the lawful operation of the practice.

I do not publish testimonials, case studies, client names or identifiable client information without your explicit written permission.

I do not share your information with third parties for marketing purposes.

Confidentiality is maintained subject to applicable legal and professional obligations and exceptional circumstances where disclosure may be necessary or legally required, including safeguarding concerns or circumstances involving a serious risk of harm.

6. When information may be shared

I will only share your information where there is a lawful and appropriate reason to do so. This may include:

• With your GP, physician or other clinician: where appropriate, normally with your knowledge and consent, for example where a referral or coordinated care is appropriate.
• With professional advisers: such as accountants, insurers or legal advisers, where necessary for the operation of the practice or to meet legal obligations.
• With service providers: such as Google, Zoho, Microsoft, Cloudflare and Web3Forms, where they provide systems used to operate the practice.
• Where the law requires it: for example, where there is a legal duty to disclose, a court order, a relevant regulatory requirement or circumstances involving a serious risk to life or safety.

I aim to discuss any proposed disclosure with you in advance unless doing so would be inappropriate or unlawful.

7. Service providers I use

I use third-party providers to operate the practice and manage client information.

Web3Forms

Website enquiry submissions are processed by Web3Forms, operated by Web3Creative.

Web3Forms receives completed form submissions, processes them and forwards them to my designated email address or other specified endpoint. According to the information provided by Web3Forms, it does not store users’ form submissions. Its systems may generate server logs that contain personally identifiable information.

Web3Forms states that:

• Web3Forms states that it does not store form submissions.
• It may have server logs containing personally identifiable information.
• Web3Forms states that these logs are deleted periodically, every two months.
• Its service infrastructure may involve third-party infrastructure providers.

Web3Forms acts as a data processor when handling website visitor submissions on my behalf. Its infrastructure providers and other sub-processors may also process information as part of delivering the service.

Other service providers

The organisations listed above may act as data processors or, where applicable, independent data controllers depending on the service provided and the nature of the processing.

Where an organisation acts as a processor, appropriate contractual arrangements should govern its handling of personal information.

I take reasonable steps to ensure that personal information is handled in accordance with applicable data protection requirements.

Payments are made by direct bank transfer. I do not collect or store payment card details.

8. International transfers

Some of the service providers I use may store or process information outside the United Kingdom.

For example, Web3Creative, the operator of Web3Forms, is based in India and uses infrastructure providers that may process information in multiple regions.

Other providers may also use international infrastructure or support arrangements.

Where personal information is transferred outside the UK, I will rely on an applicable lawful transfer mechanism, where required. Depending on the circumstances, this may include:

• UK adequacy regulations.
• The UK International Data Transfer Agreement.
• The UK Addendum to the EU Standard Contractual Clauses.
• Another recognised lawful transfer mechanism.

Where appropriate safeguards are required, I will ensure that the relevant transfer arrangements and assessments are in place.

Further information about applicable safeguards can be requested using the contact details in this notice.

9. How long I keep your information

I retain personal information only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal, professional and insurance requirements.

Adult client records

My professional indemnity insurance requires client consultation records to be taken and retained for a period of five years after the end of the relevant treatment or service.

This retention period applies to relevant clinical consultation records, including assessment and therapy records.

Records relating to minors

Where I provide services to someone under 18, my insurance requires consultation records to be retained for five years after the individual's 18th birthday.

Financial and invoicing records

Financial and invoicing records are retained for the periods required by applicable UK tax and accounting rules.

Enquiries that do not proceed

Enquiries that do not proceed to assessment or therapy are retained only for as long as necessary to respond to the enquiry, deal with any follow-up and meet any relevant business or legal requirements.

They are then securely deleted.

Web3Forms states that it does not store form submissions. Any server logs that may contain personally identifiable information are, according to Web3Forms, deleted periodically every two months. I cannot independently control or verify the provider’s log-deletion process.

Where information needs to be retained for legal claims or another applicable lawful purpose, it may be kept for the necessary additional period.

10. How I protect your information

I use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include:

• Password-protected systems and devices.
• Restricted access to client information.
• Use of established third-party service providers.
• Secure handling of enquiry forms and email communications.
• Electronic storage of client records using Microsoft OneDrive.
• Appropriate access controls for systems containing client information.
• Secure handling of payments by direct bank transfer, without storing card details.

Access to client records is limited to me and authorised service providers where necessary to deliver their services.

I review the security arrangements used by the practice and its service providers periodically.

11. Your rights

Under UK data protection law, you have rights in relation to your personal information. These include:

• Right to be informed: to understand how your information is collected and used.
• Right of access: to request a copy of the personal information held about you.
• Right to rectification: to ask for inaccurate or incomplete information to be corrected.
• Right to erasure: to request deletion of your information in certain circumstances.
• Right to restrict processing: to request that the use of your information is restricted in certain circumstances.
• Right to object: to object to processing based on legitimate interests in certain circumstances.
• Right to data portability: to receive certain personal information in a portable format where processing is based on consent or contract and carried out by automated means.
• Right to withdraw consent: to withdraw consent where consent is the basis for processing.

These rights are not absolute. For example, clinical records may need to be retained where there is an applicable legal, professional, insurance or legal-claims reason.

To exercise any of these rights, contact me at info@matthewbateshypnotherapy.co.uk.

I may need to verify your identity before responding.

12. Cookies and similar technologies

This website is intended to use only cookies and similar technologies that are strictly necessary for its operation, including those required for security, website functionality and the enquiry form.

I do not currently intend to use advertising cookies, tracking pixels, cross-site tracking or analytics cookies.

Technical information may nevertheless be collected through website server logs and security services, as described in this notice.

If analytics or other non-essential technologies are introduced in future, this notice will be updated and, where required, consent will be obtained before those technologies are used.

You can also manage or delete cookies through your browser settings. Blocking or deleting cookies may affect how parts of the website function.

13. Embedded video

I do not currently embed third-party video content on this website.

If embedded video is introduced in future, the video provider may collect technical information or use cookies when the video is loaded or played.

I will update this notice and provide appropriate information and consent arrangements where required before introducing non-essential technologies.

14. Complaints

If you have concerns about how I handle your personal information, please contact me first so that I can try to resolve the matter directly.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk

15. Changes to this notice

I may update this notice from time to time.

Any changes will be published on this page with an updated "Last updated" date.

Where changes materially affect how I use your information, I will take reasonable steps to bring them to your attention.

16. How to contact me

If you have questions about this notice, wish to exercise your data protection rights or wish to raise a concern, contact:

Matthew Bates Hypnotherapy
Attn: Matthew Bates
25 Earls Avenue
Ashford
Kent
TN24 0AB
England

Email: info@matthewbateshypnotherapy.co.uk