Privacy Policy

Holly Hitchen Therapies

Last updated: July 2026

1. Introduction

Holly Hitchen Therapies provides music therapy and solution focused hypnotherapy services. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website www.hollyhitchentherapies.co.uk, contact us, or become a client.

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Holly Hitchen, trading as Holly Hitchen Therapies

Contact email: hollyhitchentherapies@gmail.com

Holly Hitchen is registered with the Health and Care Professions Council (HCPC) as a music therapist and is a member of the Association for Solution Focused Hypnotherapy (AfSFH), and practises in accordance with their respective standards of conduct, performance, and ethics.

If you have any questions about this policy or how your data is handled, please contact us using the details above.

2. What Information We Collect

We may collect and process the following types of information:

Information you give us directly:

Name, email address, phone number, and postal address
Details you provide when booking a session, filling in an enquiry form, or emailing us
Information shared during intake forms, consultations, or therapy sessions, which may include health information, medical history, mental health history, and other sensitive personal details relevant to your treatment
GP details or information about other healthcare professionals involved in your care, where relevant
Payment and billing information
Any correspondence between us

Information collected automatically via our website:

Technical data such as IP address, browser type, device information, and general location
Usage data, such as pages visited and time spent on the site
Cookies and similar tracking technologies (see Section 9)

3. How We Use Your Information

We use your personal information to:

Respond to enquiries and provide information about our services
Book, manage, and deliver music therapy and solution focused hypnotherapy sessions
Maintain accurate clinical records and case notes
Communicate with you about appointments, follow-ups, or changes to our services
Process payments and maintain financial records
Meet our legal, professional, and insurance obligations
Improve our website and services
Send you information you have specifically requested, such as newsletters (only where you have opted in)

We do not use automated decision-making or profiling in relation to your data.

4. Our Legal Basis for Processing Your Data

Under UK GDPR, we rely on the following legal bases:

Contract – to provide the therapy services you have requested and booked with us
Consent – for marketing communications, and for processing special category data (such as health information) related to your therapy, which we obtain explicitly before or during your first session
Legitimate interests – for administrative purposes such as maintaining records, improving our services, and ensuring the security of our website
Legal obligation – to comply with professional body requirements, safeguarding duties, insurance requirements, or legal requests

Because we process health-related and other special category data as part of therapy, we rely on explicit consent (UK GDPR Article 9(2)(a)) and, where applicable, the provision of health or social care treatment (Article 9(2)(h)), alongside our duty of confidentiality as a practitioner.

5. Confidentiality and Clinical Records

All information shared in therapy sessions is treated as strictly confidential. Clinical notes are kept securely and are only accessed by Holly Hitchen and, where relevant, a clinical supervisor bound by their own confidentiality obligations, for the purposes of professional supervision.

Confidentiality may only be broken in exceptional circumstances, such as:

Where there is a risk of serious harm to you or another person
Where disclosure is required by law or a court order
Where required for safeguarding purposes (e.g., concerns about a child or vulnerable adult)

Where possible, we will discuss any such disclosure with you first.

6. Sharing Your Information

We do not sell or rent your personal information. We may share your information with:

Clinical supervisors, for professional supervision purposes (anonymised where possible)
Your GP or other healthcare professionals, but only with your consent or where required by law
Professional bodies or insurers, where necessary for regulatory, complaints, or insurance purposes
IT and administrative service providers (e.g., booking systems, email providers, cloud storage), who are contractually required to protect your data
Payment processors, to handle transactions securely
Regulatory or legal authorities, where required by law

Any third parties who process data on our behalf are required to keep it secure and confidential, and to use it only for the purposes we specify.

7. What Your Clinical Record Contains

In line with professional body requirements, your clinical record may include:

Your written consent to receive therapy (or parental/guardian consent, where applicable)
Information gathered during your initial consultation
Session and progress notes
Copies of any relevant correspondence, such as letters from your GP or other healthcare professionals

8. Data Retention

We retain personal and clinical information only for as long as necessary:

Clinical records are typically retained for 8 yrs for adults and up to 25th birthday for children, in line with professional body guidance and insurance requirements
Contact and enquiry information not leading to therapy is retained for 3-12 months under UK GPDR principles.
Financial records are retained for as long as required by HMRC (currently 6 years)

After these periods, your information is securely deleted or anonymised.

9. Cookies and Website Analytics

Our website may use cookies and similar technologies to:

Ensure the website functions correctly
Understand how visitors use the site (e.g., via analytics tools such as Google Analytics)

You can control or disable cookies through your browser settings. Disabling cookies may affect the functionality of the website.

10. Data Security

We take appropriate technical and organisational measures to protect your personal information, including:

Secure, password-protected storage of electronic records
Locked storage for any paper records
Restricted access to client information
Secure communication methods where possible

While we take reasonable steps to protect your data, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

If a data breach occurs, we will act promptly in line with ICO guidance on data breach management. This means we will work with you to limit or prevent any harm, notify our clinical supervisor, take steps to repair any harm caused, and put measures in place to prevent a repeat of the breach.

11. Your Rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data in certain circumstances (“right to be forgotten”)
Restrict processing of your data in certain circumstances
Data portability – receive your data in a portable format
Object to processing based on legitimate interests or for direct marketing
Withdraw consent at any time, where processing is based on consent (this will not affect processing carried out before withdrawal)

To exercise any of these rights, please contact us using the details in Section 1. We will respond within one month, as required by law.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been handled unlawfully:

Website: ico.org.uk
Helpline: 0303 123 1113

If your concern relates to professional conduct rather than data handling specifically, you may also raise this with the HCPC (www.hcpc-uk.org/complaints) or the AfSFH Standards Enquiry Procedure (www.afsfh.com).

12. Children's Data

If you are seeking therapy for a child or young person, we will collect information about the child from you as their parent or guardian and will handle this data with the same care and confidentiality outlined in this policy.

Written consent from a parent or guardian is required for clients under the age of 16. Young people aged 16 or over may consent to their own therapy where they are assessed as competent to understand what is involved and its implications (known as Gillick competence). Where an adult consents on behalf of a child, both the child and the consenting adult will be made aware of the limits of confidentiality, including circumstances in which information may need to be shared to protect the child's welfare.

13. Links to Other Websites

Our website may contain links to other websites. We are not responsible for the privacy practices or content of those external sites, and we encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on our website with a revised "last updated" date.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

Holly Hitchen Therapies

hollyhitchentherapies@gmail.com

Music Therapy

or

Hypnotherapy

?

Are you interested in…

Book A Session