Privacy &
Data Protection
Your personal information deserves thoughtful care. Here is a clear explanation of what is collected, how it is used, and the choices and rights available to you.
The purpose of this policy
This notice explains how Best Mind Therapy Limited, trading as Best Mind Therapy, handles personal information when you enquire about or receive hypnotherapy, psychotherapy, supervision or related services, or use this website. It also explains your rights and how to contact me about your information.
The legal framework includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the changes made by the Data (Use and Access) Act 2025 that are now in force.
Plain English: I use information to respond to enquiries, provide and manage agreed services, maintain appropriate records and meet professional or legal responsibilities. Therapy discussions are handled in confidence, subject to limited safeguarding and legal exceptions explained below.
Who is responsible for your information?
Data controller: Best Mind Therapy Limited (company number 14378855), trading as Best Mind Therapy. Gary Smith is your principal contact for privacy matters.
Postal contact: Northbourne Road, Swindon, Wiltshire, SN25 4YE, United Kingdom.
Email: Gary@bestmindtherapy.co.uk
Telephone: 07359 071210
Please use the subject line “Data Protection Request” for a rights request or “Data Protection Complaint” if you want to raise a concern. Avoid sending highly sensitive clinical details in an ordinary email unless necessary.
What information may be collected?
- Identification and contact: name, email, telephone number, postal address and, where relevant, emergency or GP contact information.
- Appointments and administration: bookings, attendance, reminders, requested service, correspondence, contracts and consent records.
- Health and therapy: information you choose to share about physical or mental wellbeing, relevant history, goals, risk and safeguarding considerations, brief session notes and treatment decisions. These may be special-category personal data.
- Young people's information: relevant parent/carer details, consent or capacity discussions and information necessary to support the young person safely.
- Payments: invoices, amounts, dates, payment references and accounting records. Complete payment-card details are normally handled by the payment provider, not recorded in therapy notes.
- Website information: server/security logs and, depending on the consent or permitted exception that applies, analytics about website use.
- Other sources: information from a parent or carer, GP, referring professional or employer only where there is an appropriate and lawful reason to receive it.
I aim to collect only what is relevant and proportionate. You are not required to disclose unnecessary medical details in an initial website enquiry.
Why information is used and the legal bases
The UK GDPR requires a lawful basis for each activity. Health and other special-category information requires an additional Article 9 condition, which is identified and documented for the relevant processing. A general signature or an agreement to attend therapy is not, by itself, a substitute for a valid special-category condition.
| Purpose | UK GDPR Article 6 basis |
|---|---|
| Replying to an enquiry and arranging an initial consultation | Taking steps before a contract at your request (Art. 6(1)(b)); legitimate interests for proportionate administration where appropriate (Art. 6(1)(f)) |
| Providing agreed sessions and managing appointments | Performance of a contract (Art. 6(1)(b)) |
| Keeping relevant records, ensuring safety and handling complaints | Legitimate interests (Art. 6(1)(f)), legal obligation (Art. 6(1)(c)) or other lawful basis where the specific circumstances require it |
| Invoicing, accounting and tax obligations | Performance of a contract and legal obligation (Art. 6(1)(b), (c)) |
| Website protection, technical maintenance and lawful statistical analysis | Legitimate interests (Art. 6(1)(f)), subject to PECR and any required consent |
| Optional marketing or non-essential tracking | Consent where legally required (Art. 6(1)(a) and/or PECR); any alternative basis must be justified and documented |
Sensitive health information: where needed for care or support, a separate Article 9 condition applies—for example explicit consent (Art. 9(2)(a)) where properly obtained, or the health/social-care condition (Art. 9(2)(h)) only if its professional-confidentiality and other legal requirements are met. Any other applicable condition, such as for legal claims, is assessed for that particular purpose. The actual condition used must be recorded and reflected in the relevant client paperwork.
Where legitimate interests are used, these are balanced against your privacy rights. You may object in circumstances where the law gives you that right.
Confidentiality and professional supervision
What you discuss in therapy is treated as confidential. Brief clinical notes are used to support continuity, appropriate care and professional accountability. Identifying details are not routinely disclosed to other people merely because they ask for them.
Professional clinical supervision may involve discussing aspects of work to maintain standards. Cases are discussed without identifying clients wherever possible, with confidentiality duties respected. Any disclosure that identifies you must have a lawful basis and, where required, your informed agreement.
There are important limits to confidentiality. Information may need to be shared when reasonably necessary for safeguarding a child or vulnerable person, preventing serious harm, meeting a legal duty, responding to a valid court requirement, or protecting legal rights. Information shared will be restricted to what is necessary and appropriate; where safe and lawful, I will discuss a proposed disclosure with you first.
For employer-funded sessions, your employer is not automatically entitled to session notes or personal clinical details. Any attendance or administrative reporting arrangements should be explained before the service begins.
Children, teenagers and parents/carers
Children and young people have data-protection rights in their own right. Privacy explanations should be understandable for their age and maturity. Decisions about sharing information with parents or carers consider the young person's understanding, parental responsibility, confidentiality, safeguarding and applicable law.
Information may be shared with a parent/carer when appropriate and lawful, but a parent does not automatically receive a copy of all the young person's confidential therapy records. Where safeguarding concerns arise, proportionate information may be shared with the appropriate people or services.
Consent to therapy and consent for particular uses of personal data are separate questions. Relevant decisions are discussed and recorded before sessions begin.
Booking, video sessions and service providers
Depending on the service, personal information may be handled by third parties that help operate the practice. These may include:
- Calendly: appointment scheduling, confirmations and reminders.
- Email and website hosting providers: handling enquiries, site operation and server logs.
- Microsoft Teams or Zoom: delivering an agreed online session. Sessions are not routinely recorded.
- Accountancy and payment providers: invoices, payment processing and statutory financial records.
- Website forms: where a contact form is enabled, the service provider used to deliver submissions.
- Google Analytics: website usage measurement, where enabled and permitted under PECR.
These organisations have their own privacy information. Where they act as processors, appropriate contractual safeguards are required. Their processing locations and sub-processors may change, so this notice does not claim all data remains in the UK or EEA. I do not sell client therapy records to advertisers or data brokers.
How information is protected
Safeguards include locked storage for paper notes, access controls for electronic devices and accounts, and restricting information to people who need it for an authorised purpose. Electronic communications and third-party systems have their own security considerations; ordinary email is not the same as a secure clinical messaging system.
I review and respond to suspected personal-data incidents. Where a breach creates a reportable risk, it is reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Individuals are also informed without undue delay where the law requires notification because of high risk.
How long records are kept
I keep information only as long as is reasonably required for the purposes described, considering clinical and safeguarding responsibilities, contractual obligations, potential legal claims and applicable law. Retention periods are not all dictated by a single UK GDPR rule.
| Record type | Practice retention approach |
|---|---|
| Adult client records and session notes | Normally eight years after the final session, subject to a documented reason for any longer retention |
| Records relating to children and young people | Normally reviewed for retention until the 25th birthday, or 26th birthday if treatment ended at 17, with adjustments where safeguarding or other lawful needs require them |
| Invoices and accounting documents | Normally six years, or longer if a particular tax, company or legal requirement applies |
| Unconverted enquiries | Normally up to 12 months after the last relevant correspondence unless another legitimate reason applies |
| Website security and analytics data | Based on the documented purpose, security settings and the service provider's configured retention periods |
| Marketing preferences | Until withdrawn or no longer needed, with a minimal suppression record where necessary to honour opt-outs |
At the end of the relevant period, records are securely destroyed, anonymised or reviewed for another lawful basis to retain them. A deletion request does not automatically override necessary legal or professional retention.
Your data-protection rights
Subject to the relevant legal conditions and exemptions, you can ask to:
- Access the personal information held about you.
- Correct inaccurate or incomplete details.
- Have information erased in circumstances where that right applies.
- Restrict processing or object to certain uses, including direct marketing.
- Receive certain information in a portable format.
- Withdraw consent for processing based on consent, without affecting earlier lawful processing.
- Challenge certain solely automated decisions with legal or similarly significant effects, where relevant.
Requests are normally answered without undue delay and within the applicable one-month period. Where permitted by law, the period may be extended for complex or multiple requests, or the clock may be affected by a reasonable need to verify identity or obtain essential clarification. Most requests are free of charge.
To exercise a right, email Gary@bestmindtherapy.co.uk. I may need to confirm your identity and, where someone acts for another person, their authority to do so.
How to make a data-protection complaint
If you believe your information has been handled incorrectly, email Gary@bestmindtherapy.co.uk with the subject “Data Protection Complaint”, or contact me by telephone or post. Please explain the concern and what outcome you are seeking; do not send more sensitive information than is needed.
Under the complaint-handling requirements introduced by the Data (Use and Access) Act 2025 and in force from 19 June 2026, I will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep you informed and explain the outcome without unjustified delay.
You may also raise a concern with the UK's independent information-rights regulator. Since 30 September 2026 its statutory name has been the Information Commission, while its services continue to use the familiar ICO name. See the ICO website and its ICO — make a complaint.
A data-protection complaint is different from a subject access request, and each has its own legal response timetable. The 30-day acknowledgement rule is not a blanket deadline for completing every complaint investigation.
Website cookies and analytics
The website and its third-party services may use cookies or similar technologies for security, functionality, bookings and measurement. The actual categories depend on which tools are enabled when you visit.
Where non-essential tracking requires consent under PECR, it should not run before appropriate consent is obtained. Some strictly limited statistical uses may qualify for an exception introduced by the Data (Use and Access) Act 2025, but only where the conditions are met; this does not provide a blanket exemption for Google Analytics, advertising or visitor profiling.
You should be able to review and change cookie preferences through the site's cookie controls where consent-based technologies are used. Browser settings may also limit cookies. See the website's cookie notice or preference panel for the currently active technologies and their retention periods.
If a cookie preference panel is not yet available, please contact me with your concern. The practice must still implement any required technical consent controls; this paragraph is not a substitute for them.
International processing and transfers
Some third-party platforms may process or store information outside the United Kingdom. Where a restricted international transfer takes place, appropriate safeguards must be applied, such as a UK adequacy regulation, the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU standard contractual clauses, or another lawful transfer mechanism, as appropriate.
You may contact me to ask about the relevant providers and safeguards for your information. No statement in this policy guarantees that every supplier stores all information within the UK.
Marketing and communications
Booking information is used for appointments and service communications. Optional newsletters, promotions or marketing messages are handled separately and must meet UK GDPR and PECR requirements. Consent is used where required, and each marketing email should provide a simple way to opt out.
Clinical information is not used to build advertising audiences. People who opt out should not receive further direct marketing contrary to their choice, though a minimal record of that preference may be retained.
Automated decisions and AI
I do not use a system to make solely automated decisions about whether you receive therapy that have a legal or similarly significant effect on you. Standard booking confirmations or website statistics are not clinical assessments. If this changes, the relevant privacy information and safeguards will need to be updated before that use begins.
Policy changes and contact
This page is reviewed when services, technology, relevant law or processing arrangements change. A meaningful change will be reflected here and, where legally required, brought to the attention of people affected. This notice was last revised 31 October 2026.
Questions about your privacy?
Please contact Gary Smith directly if you would like to understand how your information is managed, request access or raise a concern.
Other useful pages: Client terms, Session fees, booking enquiries and Best Mind Therapy home.
© 2026 Best Mind Therapy Limited · Company no. 14378855 · Swindon, Wiltshire