Who we are
Hypnotherapy for Health is a registered business name of Great Minds Ltd, a company registered in Ireland (company number [CONFIRM]), with its registered office at Clones Road, Monaghan. Great Minds Ltd is the data controller for the personal information described in this policy. Therapy is provided by Sinéad Duffy, Clinical Hypno-Psychotherapist.
Contact for any question about your information:
Sinéad Duffy, Hypnotherapy for Health, Clones Road, Monaghan Town
Email: sinead@hypnotherapyforhealth.ie
Phone: +353 87 245 5900
This practice is not required to appoint a Data Protection Officer, so enquiries come directly to Sinéad.
What information is collected
If you contact us through the website
The enquiry form asks for your first name, last name, email address, a subject line and a message. Only your name and email are needed to reply to you; everything else is up to you.
Please don’t include detailed personal or health information in that message box. Email isn’t a secure channel, and anything you need to tell us can be discussed confidentially when we speak.
If you book an appointment
Booking is handled by Cal.com. When you book, you provide your name, email address and the time you’ve chosen. You may also be asked for a phone number. Cal.com sends you a confirmation and a reminder, and adds the appointment to Sinéad’s calendar.
If you become a client
Once therapy begins, a clinical record is kept. This may include your contact details, your reasons for coming to therapy, relevant history, notes made during or after sessions, and any correspondence between us. This is health information, and it is treated as confidential.
If you visit the website
Like almost all websites, this one records limited technical information automatically — your IP address, browser type and the pages you visited. See the Cookie Policy below.
Why we hold it, and our lawful basis
GDPR requires a lawful basis for holding personal information. Different information is held for different reasons.
| Information | Why it’s held | Lawful basis |
|---|---|---|
| Enquiry form details | To answer your question and arrange an appointment if you want one | Legitimate interests — responding to someone who contacted us |
| Booking details | To schedule, confirm and remind you of appointments | Performance of a contract, or steps taken before entering one |
| Clinical records | To provide safe, continuous therapy, and to meet professional obligations | Provision of health care under Article 9(2)(h) GDPR, together with professional confidentiality obligations |
| Payment and invoice records | To run the practice and meet tax obligations | Legal obligation |
Health information needs extra protection. Information about your health is “special category” data under GDPR. It is held only because it is necessary to provide therapy to you, it is kept confidential, and it is never used for marketing.
You will not be added to any mailing list as a result of contacting or attending the practice.
Who your information is shared with
What is never done: your information is never sold, never rented, and never shared for advertising. What you discuss in therapy is confidential.
Some third parties handle information on the practice’s behalf. They are bound by contract to use it only as instructed.
| Who | What they handle | Where data is held |
|---|---|---|
| HostGator | Website hosting, including enquiry form submissions stored in the website database | USA |
| Cal.com, Inc. | Appointment booking, confirmations and reminders | United States, under GDPR safeguards |
| Sinead@hypnotherapyforhealth.ie | HostGator | [USA] |
| Square | Card payment processing, if you pay by card | EU/EEA |
A note on Cal.com. Booking is provided by Cal.com, Inc., a company based in the United States. Your name, email address and appointment time are processed on their systems. Cal.com states that it is GDPR compliant, SOC 2 compliant and ISO 27001 certified. If you would prefer not to use online booking, you can arrange an appointment by phone or email instead.
When confidentiality may be broken. Therapeutic confidentiality is not absolute. Information may be disclosed without your consent only where there is a serious risk of harm to you or to another person, where a child or vulnerable adult may be at risk, or where disclosure is required by law or a court order. Wherever possible, this would be discussed with you first.
Case material is sometimes discussed in clinical supervision, which is a professional requirement. Supervision is confidential and clients are not identified by name.
How long information is kept
| Information | Kept for |
|---|---|
| Enquiries that don’t lead to an appointment | 12 months, then deleted |
| Clinical records | 6 years |
| Records relating to a client who was under 18 | 6 years |
| Financial and invoice records | 6 years, as required by Revenue |
| Booking records held by Cal.com | Active duration of the account |
When the retention period ends, records are securely destroyed or permanently deleted.
How your information is kept secure
- Paper records are stored in a locked cabinet in a secure room, accessible only to Sinéad Duffy.
- Devices used for practice work are password protected and encrypted.
- The website uses an SSL certificate, so information submitted through it is encrypted in transit.
- Access to any system holding client information is protected by strong passwords and, where available, two-factor authentication.
- Client information is not stored on shared or public computers, and is not discussed in any public setting.
No system is completely secure. If a breach were to occur that posed a risk to you, you would be informed, and the Data Protection Commission would be notified within 72 hours where required.
Your rights
Under GDPR you have the right to:
- Be told what information is held about you and why — which is what this policy is for.
- Access a copy of your information, including your clinical record.
- Correct anything factually inaccurate.
- Erase your information in certain circumstances. This right is limited where records must be kept to meet professional or legal obligations.
- Restrict or object to how your information is used in certain circumstances.
- Withdraw consent at any time, where consent was the basis for holding something. Withdrawing consent does not affect anything done before you withdrew it.
- Data portability — receive certain information in a machine-readable format.
To exercise any of these, email sinead@hypnotherapyforhealth.ie. You’ll receive a response within one month. There is no charge, unless a request is clearly excessive or repetitive.
About access to clinical records. You are entitled to see what is written about you. Occasionally a small part of a record may be withheld — for example, where it contains information about another person who hasn’t consented, or where disclosure could cause serious harm. If anything is withheld, you’ll be told that it has been, and why.
If you’re unhappy
If you have a concern about how your information has been handled, please raise it directly — most things are resolved quickly that way.
You also have the right to complain to the supervisory authority:
Data Protection Commission 21 Fitzwilliam Square South, Dublin 2, D02 RD28 www.dataprotection.ie
You can complain to them at any time, whether or not you have raised it with the practice first.
Changes to this policy
This policy may be updated from time to time. The date at the top shows when it was last revised. If a change materially affects how your information is used, existing clients will be told directly rather than relying on the website alone.