COREHYPNOTHERAPYGet in touch

Your information

Privacy policy.

How Core Hypnotherapy collects, uses and protects your personal information.

Last updated: 4 August 2026

This notice is for clients, prospective clients and website visitors. It explains the information Amanda uses in running Core Hypnotherapy and is intended to meet the transparency requirements of the UK GDPR and Data Protection Act 2018, as amended.

1. Who we are

Amanda-Gayle Ostler, trading as Core Hypnotherapy, is a sole trader and the data controller for the personal information described in this notice.

Contact: hello@corehypnotherapy.co.uk
Service: Online hypnotherapy from the United Kingdom

2. Information we may collect

  • Enquiry details: your name, email address, phone number, broad area of interest and the message you choose to send.
  • Client administration: appointment history, correspondence, invoices and payment status. Full card details are not held by Amanda when a separate payment provider is used.
  • Intake and session information: your goals, relevant personal history, session notes and information you choose to share about your physical or mental health. Health information is special category data and receives additional protection.
  • Technical information: essential security and server logs, which may include IP address, browser type and request time.

Please avoid sending detailed medical information through the initial enquiry form. If you decide to work with Amanda, necessary intake information will be collected through a more appropriate process.

3. How and why we use it

PurposeLawful basis
Responding to an enquiry and discussing a possible bookingSteps at your request before a contract, and legitimate interests in running the practice
Providing and administering booked servicesPerformance of a contract
Invoices, tax and legally required recordsLegal obligation
Practice security, legal claims and service improvementLegitimate interests, balanced against your rights

Where Amanda needs to use health information or other special category data, she relies on your explicit consent under Article 9(2)(a) UK GDPR unless another condition is required and appropriate. You can withdraw consent at any time. Withdrawal does not affect earlier lawful use, but it may mean the service cannot continue if the information is needed to provide it safely.

Personal information is not used for automated decision-making. Marketing messages will only be sent if you separately opt in, and you can unsubscribe at any time.

4. Who information may be shared with

Information is shared only where necessary with carefully selected providers such as email, secure video, appointment, payment, website hosting or professional IT services. Those providers act under their own legal duties or on Amanda's instructions and receive only the information they need.

Information may also be disclosed where required by law, to obtain confidential professional, legal or insurance advice, or where Amanda reasonably believes disclosure is necessary to protect someone from serious harm. It is never sold.

Some technology providers may process information outside the United Kingdom. Where this happens, an approved safeguard is required, such as UK adequacy regulations or appropriate contractual protections.

5. How long information is kept

  • Unbooked enquiries: normally up to 12 months after the last contact.
  • Client notes and service records: normally up to 7 years after the work ends, unless a different period is required by law, insurance or an applicable professional obligation.
  • Invoices and tax records: normally 6 years after the relevant financial year.
  • Marketing preferences: until you withdraw consent, plus a minimal suppression record so your preference can be respected.

Information is securely deleted or anonymised when it is no longer needed.

6. Security and confidentiality

Reasonable technical and organisational safeguards are used, including access controls, device security, confidential working practices and suitable service providers. No internet transmission can be guaranteed completely secure, so please do not send highly sensitive detail in an initial enquiry.

Sessions are confidential, subject to limited exceptions such as a legal requirement or a serious and immediate risk of harm. Any exception will be handled carefully and, where possible, discussed with you first.

7. Enquiry form, cookies and analytics

The enquiry form prepares a message in your own email application. The website does not store what you type into that form. Once you send the email, the information is handled as correspondence under this policy.

This website does not intentionally use advertising cookies, behavioural tracking or non-essential analytics. The hosting service may process essential technical logs to deliver and protect the site. If optional analytics or cookies are added later, this notice and any necessary consent controls will be updated first.

8. Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your information; object to certain uses; receive portable data; and withdraw consent. You also have the right to object to processing based on legitimate interests. These rights are not absolute, but every request will be considered promptly.

To exercise a right, email Amanda using the address below. Identity may need to be verified. You can also complain to the Information Commissioner's Office, although Amanda would appreciate the opportunity to address your concern first.

9. Questions or concerns

Email hello@corehypnotherapy.co.uk. This notice may be updated when the service or legal requirements change; the date at the top shows the latest version.

Go to the enquiry page