Last updated: 8 November 2026.

 

This policy explains how I collect, use and protect your personal information when you visit my website, get in touch or book a session. Your privacy matters to me, especially because some of what you share is personal and sensitive.

 

1. Who I am

 

I am Tabitha Nicholls, a sole trader trading as The Pocket Hypnotist. I am the controller of your personal information, which means I decide how it is used and am responsible for protecting it.

 

Postal address available on request by emailing tabitha@thepockethypnotist.com.

 

Email: tabitha@thepockethypnotist.com.

 

2. Information I collect

 

1. Contact details: your name, email address, phone number and, if you use the cancellation form, your postal address.
2. Booking and payment details: what you booked, dates, times and payment records, such as the amount, date and the name on a bank transfer.
3. Client information: what you would like help with, relevant health information, medication, notes I make during sessions, and your consent forms.
4. Emergency details: an emergency contact and where you are during a session.
5. For young people: the parent or guardian's name, contact details and confirmation of parental responsibility.
6. Session recordings: audio of a session, only if you agree to one.
7. Messages: anything you send me by email, contact form or other messages.
8. Website data: information collected through cookies and similar technology, such as your device, browser and pages visited.
9. Marketing preferences: whether you have chosen to hear from me.

 

Most of this comes directly from you. For a young person, some comes from their parent or guardian. If you book for someone else, please make sure they know you are sharing their details with me.

 

3. Why I use it and my legal grounds

 

UK data protection law requires a legal ground for each use of your information.

 

Replying to your enquiry and free consultation: taking steps at your request before a contract.
Taking bookings and providing sessions: contract with you.
Taking payments and keeping business and tax records: contract and legal obligation.
Keeping client notes and handling complaints or claims: legitimate interests in running a safe, accountable practice.
Contacting your emergency contact or emergency services: vital interests, where someone's safety is at risk.
Sending news about my work: your consent, which you can withdraw at any time.
Running and improving the website: legitimate interests, and consent for non essential cookies.

 

I will not sell your information or use it for anything unrelated to these purposes.

 

4. Health information

 

Information about your physical or mental health is special category data and has extra protection under UK data protection law.

 

I use your health information only to assess whether my work is suitable for you and to work with you safely. I rely on your explicit consent, which I ask for separately on my client form. You can withdraw that consent at any time. If you do, I will stop using your health information, although I may not be able to continue working with you safely.

 

In limited situations I may also rely on other grounds the law allows: to protect someone's vital interests in an emergency, to establish or defend legal claims, or to protect a child or adult at risk where the law permits this.

 

Accepting my Terms and Conditions does not by itself mean you have consented to the use of your health information.

 

5. Young people

 

Private sessions are available from age 12 with written consent from a parent or legal guardian. For young people, I collect consent from the parent or guardian and also check that the young person is happy to take part.

 

Young people aged 13 and over can exercise their own data protection rights where they understand what that means. A parent or guardian may make requests on behalf of a younger child, or an older child who has agreed to this, where it is in the child's best interests.

 

I keep a young person's session content confidential in the way explained in my Terms and Conditions, and share information with a parent or others only where there is a safeguarding need or the law requires it.

 

6. Session recordings

 

I record a session only with your separate, clear consent. Recordings are audio only and are made so you can listen back yourself. I do not use them for training, marketing or anything else.

 

I make the recording through Zoom, keep it in secure, password protected storage and send it to you securely. I delete my copy, including the copy held by Zoom, within 30 days of the session. You can ask me to delete it sooner, and you can withdraw your consent at any time.

 

7. Who I share information with

 

I use a small number of trusted suppliers who process information for me under contract and only on my instructions:

 

1. Wix, which hosts my website and handles bookings and forms.
2. Zoom, which I use for sessions and consultations.
3. Monzo Bank, which processes payments made by bank transfer or Monzo payment links.
4. Google, which provides my email through Gmail.
5. My accountant and professional advisers, where needed.

 

I may also share information where the law requires it, with the emergency services or a safeguarding authority to protect someone from serious harm, or with your emergency contact in an emergency.

 

8. Transfers outside the UK

 

Some of my suppliers, including Wix, Zoom and Google, may process information outside the UK, including in the United States. Where this happens, the transfer is protected by safeguards UK law recognises, such as UK adequacy regulations, the UK Extension to the EU US Data Privacy Framework, or the UK International Data Transfer Addendum to standard contractual clauses. You can ask me for more details.

 

9. How long I keep information

 

Enquiries that do not lead to a booking: 12 months after our last contact.
Client forms, notes and consent records for adults: 7 years after our last session.
Client records for under 18s: until their 25th birthday or 7 years after the last session, whichever is later.
Booking, payment and tax records: at least 5 years after the 31 January tax return deadline for that tax year, as HMRC requires.
Session recordings: deleted within 30 days of the session.
Marketing preferences: until you unsubscribe, then a note so I do not contact you again.

 

When information is no longer needed, I delete it securely.

 

10. Keeping information secure

 

I protect your information with strong passwords and two step verification on my accounts, encrypted devices, password protected Zoom meetings with waiting rooms, and access limited to me. I keep any paper notes locked away. If a breach happens that puts your rights at risk, I will tell you and the ICO where the law requires.

 

11. Cookies

 

My website uses cookies, some essential for it to work and others for things like analytics. Non essential cookies are only used if you agree through the cookie banner, and you can change your choice at any time through the banner settings or your browser.

 

12. Your rights

 

You have the right to:
1. Ask for a copy of your information.
2. Ask me to correct information that is wrong or incomplete.
3. Ask me to delete your information.
4. Ask me to limit how I use your information.
5. Object to my use of your information where I rely on legitimate interests, and to marketing at any time.
6. Ask for information you gave me to be sent to you or someone else in a usable format.
7. Withdraw your consent at any time, where I rely on it.

 

Some rights have limits, for example where I must keep records for tax or legal reasons. To make a request, email tabitha@thepockethypnotist.com. It is free, and I will reply within one month. I do not make decisions about you using automated processes alone.

 

13. Complaints and changes

 

If you have a concern about how I use your information, please contact me first so I can try to put it right.

 

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

 

I may update this policy from time to time. The date at the top shows when it was last changed, and I will tell you directly about any significant change that affects you.