Privacy Policy

Privacy Policy

Oli-Co Hypnotherapy
Last updated: 2026

Oli-Co Hypnotherapy respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what personal information I collect, why I collect it, how I use and protect it, how long I keep it, who I may share it with, and your rights under UK data protection law.

This Privacy Policy applies to information collected through the Oli-Co Hypnotherapy website, by email, telephone, online enquiry/contact forms and in connection with the provision of hypnotherapy and psychotherapy services.

Oli-Co Hypnotherapy is the data controller for the personal information described in this Privacy Policy.

The main legislation governing the processing of your personal information is the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 (DUAA).

  1. Who I am

Oli-Co Hypnotherapy is operated by Rebeka Cohen-Oliver, Solution Focused Hypnotherapist & Psychotherapist.

Telephone: 07969 088700
Email: contact@olicohypnotherapy.co.uk
Practice address: Ashford Road, Whitwick, Coalville, Leicestershire, LE67 5GD

For questions about this Privacy Policy or how your personal information is handled, please contact me using the details above.

  1. What personal information I collect

Depending on how you interact with Oli-Co Hypnotherapy, I may collect and process information including:

  • your name;
  • telephone number;
  • email address;
  • information necessary to arrange appointments;
  • information you provide during an initial consultation;
  • information relevant to your therapy and treatment;
  • information about your health, wellbeing and circumstances where this is relevant to providing therapy;
  • session notes and records of your treatment;
  • correspondence between you and Oli-Co Hypnotherapy;
  • payment and transaction information where necessary;
  • information contained in enquiries, feedback or complaints;
  • information you voluntarily provide for a testimonial;
  • technical information relating to your use of the website, such as IP address, browser type and information collected through cookies, where applicable.

I aim to collect only information that is adequate, relevant and limited to what is necessary for the particular purpose for which it is being processed.

For example, a telephone number may be necessary to arrange or change an appointment, whereas information such as your full home address would not ordinarily be collected unless there is a genuine reason for needing it.

  1. Why I use your personal information

I use personal information for purposes including:

  • responding to enquiries;
  • arranging and managing appointments;
  • providing hypnotherapy and psychotherapy services;
  • maintaining appropriate client records;
  • communicating with you about your appointments and treatment;
  • dealing with payments and financial administration;
  • maintaining professional, legal and insurance records;
  • managing the security of my systems and information;
  • responding to complaints;
  • complying with legal or regulatory requirements;
  • protecting the safety and wellbeing of clients and others where necessary;
  • improving the website and services;
  • sending newsletters or blog updates where you have chosen to subscribe;
  • publishing a testimonial where you have specifically agreed to this.

I will not collect or use personal information for purposes that are incompatible with the purpose for which it was originally collected unless permitted by law.

  1. Lawful bases for processing

UK GDPR requires me to have a lawful basis for processing personal information.

Depending on the circumstances, I may rely on one or more of the following lawful bases:

Legitimate interests

For ordinary client administration and the provision and management of my services, I may rely on legitimate interests where this is appropriate.

Where I rely on legitimate interests, I consider:

Purpose: I have a genuine and appropriate reason for processing the information, such as communicating with a client, arranging appointments, maintaining appropriate client records or managing my professional practice.

Necessity: I only collect and process information that is reasonably necessary for that purpose.

Balance: I consider the impact of the processing on your privacy and rights and take steps to ensure that my interests do not override your rights and freedoms.

Contract

Where appropriate, I may process information because it is necessary to take steps at your request before entering into an agreement with you or to provide services that you have agreed to receive.

Consent

I may rely on your consent where the law requires or where consent is the appropriate lawful basis.

For example, I may ask for your consent before:

  • sending certain optional marketing communications;
  • publishing a testimonial;
  • processing information for a purpose where consent is the appropriate legal basis.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

Legal obligation

I may process personal information where this is necessary to comply with a legal obligation, including applicable accounting, tax, regulatory, insurance or legal requirements.

Vital interests

In limited circumstances, personal information may be processed where this is necessary to protect someone’s vital interests.

Recognised legitimate interests

The Data (Use and Access) Act 2025 introduced a new lawful basis known as recognised legitimate interests.

This is separate from the ordinary legitimate interests basis and applies only to specified purposes recognised in the UK GDPR.

Where a particular processing activity falls within one of those recognised purposes and the relevant conditions are met, I may rely on this lawful basis.

The introduction of recognised legitimate interests does not mean that all processing of client information can automatically be treated as a recognised legitimate interest. Where this basis does not apply, I will use another appropriate lawful basis.

  1. Special category information

Information concerning your physical or mental health is treated as special category personal data under the UK GDPR and receives additional protection.

Where I process health information as part of providing therapy, I will ensure that both an appropriate Article 6 lawful basis and an appropriate Article 9 condition are in place.

Where appropriate, this may include explicit consent or another Article 9 condition permitted by law.

I will only collect and process health information that is relevant and necessary to the therapy or other legitimate purpose for which it is being processed.

  1. Keeping your information confidential

Information provided during therapy is treated as confidential.

I will not normally disclose information about you to another person or organisation without your permission unless:

  • I am legally required to disclose it;
  • disclosure is necessary to protect you or another person from serious harm;
  • disclosure is necessary to comply with a legal or regulatory requirement;
  • disclosure is otherwise permitted by data protection law; or
  • there is another lawful and appropriate basis for disclosure.

Where information is requested by a public authority or another organisation carrying out a public task, I will consider the applicable legal requirements before making a disclosure.

  1. Sharing your information

I do not sell your personal information.

I may share information where necessary with appropriate third parties, which may include:

  • professional advisers;
  • insurers;
  • professional or regulatory bodies where necessary;
  • technology and IT service providers;
  • website, email or booking service providers;
  • payment service providers;
  • accountants or other professional service providers;
  • legal or law-enforcement authorities where legally required or otherwise permitted.

I will only share information that is reasonably necessary for the relevant purpose and will take appropriate steps to protect it.

Where a third-party service provider processes information on my behalf, I will ensure appropriate contractual and security arrangements are in place where required.

  1. International transfers

Where personal information is processed by a service provider outside the UK, I will ensure that any international transfer is carried out in accordance with applicable UK data protection law.

This may include relying on an adequacy decision or appropriate safeguards recognised under the UK GDPR.

  1. How I protect your information

I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

  • secure storage of paper records;
  • locked storage for physical records;
  • password protection;
  • appropriate device security;
  • internet and network security measures;
  • secure access to email and business systems;
  • restricting access to personal information to those who need it.

No method of electronic transmission or storage can be guaranteed to be completely secure, but I take reasonable and proportionate steps to protect the information I hold.

  1. How long I keep your information

I will not keep personal information for longer than is necessary for the purpose for which it was collected.

I may retain client records for an appropriate period after therapy ends where this is necessary for:

  • legal or regulatory requirements;
  • professional or insurance requirements;
  • establishing, exercising or defending legal claims;
  • resolving disputes;
  • maintaining appropriate professional records.

When information is no longer required, it will be securely deleted, destroyed or anonymised where appropriate.

  1. Your data protection rights

Under UK data protection law, you may have rights including:

  • the right to be informed about how your personal information is used;
  • the right of access to your personal information;
  • the right to rectification of inaccurate or incomplete information;
  • the right to erasure, in certain circumstances;
  • the right to restriction of processing, in certain circumstances;
  • the right to data portability, where applicable;
  • the right to object to certain processing;
  • the right to withdraw consent where processing is based on consent;
  • rights relating to certain forms of automated decision-making and profiling.

These rights are subject to certain legal exceptions and are not all absolute.

  1. Subject Access Requests

You have the right to ask for a copy of the personal information I hold about you. This is known as a Subject Access Request (SAR).

You can make a SAR by contacting me at:

contact@olicohypnotherapy.co.uk

You do not normally need to use a particular form to make a SAR.

When dealing with a SAR, I will make searches that are reasonable and proportionate in the circumstances. Following the changes introduced by the Data (Use and Access) Act 2025, the law does not require an organisation to search every document, email or other source where doing so would be unreasonable or disproportionate and the information is unlikely to contain relevant personal information.

I may need to verify your identity before providing personal information.

I will normally respond to a valid SAR within the applicable statutory time limit.

  1. Complaints about the use of your personal information

You have the right to complain to Oli-Co Hypnotherapy if you believe that your personal information has not been handled in accordance with data protection law.

I will provide reasonable assistance to enable you to make a data protection complaint.

How to make a complaint

You can make a complaint by:

Email: contact@olicohypnotherapy.co.uk

Data Protection Complaint

Please explain, as far as possible:

  • what personal information your complaint concerns;
  • what you believe has happened;
  • why you believe your information has not been handled appropriately;
  • what outcome you would like.

If you require an alternative way of making a complaint because you cannot use email, please contact me and I will provide an appropriate alternative.

I will acknowledge receipt of a data protection complaint within 30 days.

I will then take appropriate steps to investigate and respond to the complaint without undue delay, and I will keep you informed about progress where appropriate.

This data protection complaints process concerns complaints about the use or handling of your personal information. It is separate from complaints about the general quality of therapy, professional conduct or other aspects of the service.

If you remain dissatisfied

If you are dissatisfied with my response to your data protection complaint, or believe that your personal information has not been handled in accordance with data protection law, you have the right to complain to the Information Commissioner’s Office (ICO).

Information about making a complaint to the ICO is available from the ICO website.

  1. Testimonials

If you provide a testimonial, I will only publish your personal information or testimonial where I have an appropriate lawful basis to do so.

Where publication requires consent, I will obtain your consent before publishing it.

Testimonials may be published on the website and could therefore be accessible internationally. Once information has been published on the internet, it may be copied or shared by others outside my control.

You can contact me to ask for a published testimonial to be removed.

  1. Website contact forms

If you contact Oli-Co Hypnotherapy using a website contact form, I may collect information such as your name, email address and telephone number together with the content of your enquiry.

This information is used to respond to your enquiry and, where appropriate, to arrange an initial consultation or appointment.

I will not use your enquiry information for unrelated purposes without an appropriate lawful basis.

  1. Blog and email subscriptions

If you choose to subscribe to blog posts or other optional email communications, I will use your email address for that purpose.

You can unsubscribe at any time using the unsubscribe facility provided in the communication or by contacting me.

Unsubscribing from marketing or optional communications does not necessarily mean that I must delete information that I am required or entitled to retain for other legitimate purposes.

  1. Cookies

The Oli-Co Hypnotherapy website may use cookies or similar technologies.

Cookies may be used for purposes such as:

  • enabling website functionality;
  • remembering preferences;
  • understanding how visitors use the website;
  • improving website performance and user experience.

Where consent is required for a particular cookie or similar technology, appropriate consent will be requested.

You can also manage cookies through your browser settings.

Third-party websites and services linked from the Oli-Co Hypnotherapy website may have their own privacy and cookie policies. This Privacy Policy does not apply to those third-party websites.

  1. Website analytics and technical information

When you visit the website, certain technical information may be collected automatically, depending on the website’s configuration and the services being used.

This may include information such as:

  • IP address;
  • browser and device information;
  • date and time of access;
  • pages visited;
  • referring website;
  • technical information about website usage.

Where such information constitutes personal data, it will be handled in accordance with applicable data protection law.

  1. Children’s information

Oli-Co Hypnotherapy may provide services to children and young people.

Where therapy is provided to a child or young person, personal information will be processed with particular care and in accordance with applicable data protection law, professional requirements and the circumstances of the individual.

Where appropriate, information may be collected from or shared with a parent, guardian or other person with parental responsibility, taking account of the child’s age, maturity, understanding, confidentiality and applicable legal and professional requirements.

  1. Links to other websites

The Oli-Co Hypnotherapy website may contain links to other websites or services, including social media and payment platforms.

Once you leave the Oli-Co Hypnotherapy website, this Privacy Policy no longer governs the information collected by those third-party websites.

You should read the privacy policy of any third-party website or service you use.

  1. Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, technology or the way Oli-Co Hypnotherapy operates.

The latest version will be published on this website with the date on which it was last updated.

Last updated: 12 August 2026

  1. Contact

If you have any questions about this Privacy Policy or how your personal information is handled, please contact:

Rebeka Cohen
Oli-Co Hypnotherapy
Ashford Road
Whitwick
Coalville
Leicestershire
LE67 5GD

Telephone: 07969 088700
Email: contact@olicohypnotherapy.co.uk