Privacy Policy
Katie Palmer Hypnotherapy
Last updated: 14 October 2026
1. Introduction
At Katie Palmer Hypnotherapy, your privacy and confidentiality are extremely important.
Whether you’re visiting my website, making an enquiry or working with me as a client, I am committed to protecting your personal information and treating it with care and respect.
This Privacy Policy explains what information I collect, why I collect it, how it is stored, who it may be shared with and your rights under UK data protection legislation.
2. Who I Am
Katie Palmer Hypnotherapy is operated by Katie Palmer, an independent hypnotherapist and coach based in Wokingham, Berkshire, United Kingdom.
I am the Data Controller responsible for personal information collected in connection with my business.
Website: https://katiepalmer.co.uk
Email: wellbeing@katiepalmer.co.uk
For any questions about your personal information, please contact me using the details above.
3. Information I Collect
The information I collect depends on how you interact with my business.
Website enquiries
When you contact me through my website or by email, I may collect your name, email address, telephone number and any information you choose to share.
Wheel of Life Scorecard (ScoreApp)
Our Wheel of Life scorecard is provided through ScoreApp, a third-party platform.
When you complete the scorecard, we collect your name, email address and answers to the questions. ScoreApp processes this information to calculate your results and generate your personalised scorecard.
Your responses and results may also be accessible to Katie Palmer Hypnotherapy to help us understand the areas of your life you would like to improve and, where appropriate, support any subsequent conversations about working together.
Your information will be handled in accordance with this Privacy Policy and ScoreApp’s Privacy Policy.
Completing the scorecard does not automatically subscribe you to marketing emails. We will only send you promotional communications where you have provided the necessary consent or another lawful basis applies.
Bookings and appointments
When you book a Discovery Call, consultation or therapy session, I may collect your contact information, appointment details, booking history and relevant payment information.
Client consultations and therapy sessions
When we work together, I may collect information relevant to your wellbeing and the services you receive.
This can include personal circumstances, relevant medical history, medication, emotional wellbeing, consultation forms and session notes.
Some information may be classed as special category data under UK GDPR, including information about your physical or mental health.
I only collect information that is relevant and necessary for providing my services and meeting applicable professional responsibilities.
4. How I Use Your Information
I use personal information to:
- Respond to enquiries and arrange Discovery Calls.
- Manage appointments and communicate with clients.
- Provide hypnotherapy, coaching and other therapeutic services.
- Maintain appropriate consultation and treatment records.
- Process payments and maintain financial records.
- Meet legal, professional and insurance obligations.
- Improve my website and understand visitor activity where legally permitted.
- Send occasional newsletters and service updates where appropriate marketing permissions are in place.
I do not sell or rent your personal information.
5. Legal Basis for Processing Your Information
Under UK GDPR, personal information must be processed using an appropriate lawful basis.
Depending on the purpose, these may include:
Contract: To arrange appointments, provide agreed services and take steps requested before entering into a contract.
Legal obligation: To meet applicable legal responsibilities, including tax and accounting requirements.
Legitimate interests: To respond to enquiries, administer my business, maintain appropriate records and protect legal interests where those interests do not override your rights.
Consent: Where required for optional website tracking, marketing or other specific processing activities.
Sensitive Personal and Health Information
As part of providing hypnotherapy, coaching and complementary therapies, I may need to collect and record information about your physical or emotional health, medical history and personal circumstances.
This information is used to assess the suitability of my services, provide appropriate therapeutic support and maintain confidential client records.
Health information is classified as special category personal data under UK GDPR and receives additional protection.
I process this information only where an appropriate lawful basis and additional legal condition apply. Where explicit consent is required, this will be obtained separately and recorded.
Information may also be processed or retained where necessary and legally permitted in connection with professional obligations or legal claims.
6. Confidentiality and Client Records
Confidentiality is central to my work.
Information shared during consultations and therapy sessions is treated as confidential and is not disclosed without an appropriate legal basis.
There may be circumstances where disclosure is legally required or otherwise legally justified, including certain safeguarding situations.
Record storage
Consultation forms and therapy notes are maintained electronically, primarily using a password-protected reMarkable tablet.
Records may also be transferred to a password-protected Mac computer.
The tablet is stored in a locked cupboard when not in use.
Reasonable precautions are taken to protect confidential information against unauthorised access, loss or disclosure.
7. How Long I Keep Information
Personal information is retained only for as long as necessary for the purpose for which it was collected, taking account of applicable legal, professional and insurance requirements.
Client records
Adult client consultation forms and therapy notes are normally retained for seven years following the final appointment.
Records relating to clients under 18 may be retained for longer in accordance with applicable insurance and professional requirements.
Records may also be retained longer where necessary in connection with legal proceedings or other justified obligations.
Website enquiries
Enquiry correspondence is retained for a reasonable period to respond to questions and manage appropriate follow-up.
If you do not become a client, your details are not automatically added to my booking database or marketing list.
Financial records
Relevant financial and transaction information is retained in accordance with applicable accounting and tax requirements.
Marketing records
Marketing contact details are retained while there is an appropriate lawful basis and reason to do so.
Information is securely deleted or disposed of when no longer required.
8. Booking Appointments
I use Ovatu to manage online appointments and bookings.
When you book through Ovatu, information necessary to arrange and administer your appointment is processed through its booking system.
Appointment-related communications may include confirmations, reminders, rescheduling information and other messages necessary to manage your booking.
These communications are separate from marketing messages.
Ovatu processes information according to its applicable privacy terms.
9. Payments
Payments may be made through Ovatu, Stripe, PayPal or by direct bank transfer.
Payment providers process transactions in accordance with their own privacy and security arrangements.
I do not directly collect or store full payment card details processed through these services.
I may retain relevant transaction information for accounting, administration and legal purposes.
10. Website Contact Forms
When you complete a contact form, I use the information you provide to respond to your enquiry and, where appropriate, discuss or arrange an appointment.
Submitting an enquiry does not automatically add you to a marketing mailing list.
Please avoid including detailed medical information or other highly sensitive information in an initial website enquiry. Confidential matters can be discussed privately.
11. Marketing Communications
I currently use Ovatu to maintain client contact information and manage communications.
I may send occasional newsletters, information about my services and business updates where I have valid consent or another lawful basis and the relevant electronic marketing requirements are satisfied.
Booking an appointment does not automatically constitute consent to receive marketing.
Marketing communications can be declined or unsubscribed from without affecting appointment confirmations or essential booking messages.
You can ask to stop receiving marketing communications at any time by using an unsubscribe facility or contacting me directly.
12. Cookies and Website Analytics
My website uses cookies and similar technologies to support its operation and understand how visitors interact with its content.
Google Analytics is used to collect information about website activity, such as page visits and how visitors find the website, where permitted.
Optional analytics tracking is managed through the website’s cookie consent system.
Visitors can accept, reject or manage optional cookies through the available consent controls.
Further information is available in my Cookie Policy.
13. Sharing Information with Third Parties
I may use trusted third-party organisations to support the operation of my business.
These include providers of appointment booking, payment processing, website hosting, business email and website analytics services.
These providers receive or process information only where necessary for the relevant purpose and subject to applicable data protection requirements.
Personal information may also be disclosed to professional advisers, insurers or relevant authorities where necessary and lawful.
Some service providers may process information outside the United Kingdom. Where applicable, international transfers must be supported by appropriate legal safeguards.
14. Working with Clients Under 18
My services are primarily intended for adults aged 18 and over.
Occasionally, I may agree to work with a client aged 16 or 17, subject to an assessment of suitability and any applicable consent, confidentiality and safeguarding requirements.
Personal information relating to younger clients is handled with particular care and may be subject to longer retention requirements.
15. Your Data Protection Rights
Under UK GDPR, you have rights relating to your personal information.
Depending on the circumstances, these include the right to access your information, request corrections, request deletion, restrict processing, object to certain processing and request data portability.
Where processing is based on consent, you may withdraw that consent.
You also have an unconditional right to object to the processing of your personal information for direct marketing.
Some rights are subject to legal conditions and exemptions, including where information must be retained for legal obligations or claims.
To exercise your rights, please email:
Requests will normally be answered within one month, in accordance with applicable data protection requirements.
16. Complaints
If you have concerns about how your personal information has been handled, please contact me so I can investigate.
You also have the right to complain to the Information Commissioner’s Office (ICO).
Website: https://ico.org.uk
Telephone: 0303 123 1113
17. Changes to This Policy
This Privacy Policy may be updated to reflect changes to my business, services, technology or applicable legal requirements.