Privacy Policy

At Lisa Sutcliffe Hypnotherapy, we are committed to protecting your privacy and handling your personal information transparently and securely.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website, contact us, book treatments, purchase products, or interact with our services.

This policy is designed to comply with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)
• Data (Use and Access) Act 2025 (DUAA 2025)

1. Who We Are

Lisa Sutcliffe Hypnotherapy is the data controller responsible for your personal information.

Email: lisa@flowerpowerholistics.co.uk
Website: www.flowerpowerholistics.co.uk

If you have any questions about this Privacy Policy or your personal data rights, please contact us using the details above.

2. Information We Collect

We may collect and process the following personal information:

• Name
• Email address
• Telephone number
• Postal address
• Appointment and booking details
• Purchase history
• Health and consultation information relevant to treatments
• Communications sent to us via forms, email, telephone, or social media
• Technical information such as IP address, browser type, device information, and website usage data

We only collect information that is necessary for providing our services, complying with legal obligations, or improving our website and customer experience.

3. How We Collect Information

We may collect information when you:

• Complete website forms
• Contact us by email, phone, or social media
• Book appointments
• Purchase products or gift vouchers
• Subscribe to marketing communications
• Browse or use our website

Some technical information may be collected automatically through cookies or analytics tools.

4. Lawful Bases for Processing

Contractual Necessity

To provide treatments, fulfil bookings, process purchases, and respond to enquiries.

Consent

Where you have clearly agreed to receive marketing communications or optional cookies.

You may withdraw consent at any time.

Legitimate Interests

To operate and improve our business, maintain website security, prevent fraud, manage bookings, and communicate with customers where appropriate.

We ensure our legitimate interests do not override your rights and freedoms.

Legal Obligation

Where we are required to comply with legal or regulatory requirements.

Vital Interests

Where processing is necessary to protect someone’s health or safety.

5. Special Category Health Information

Some treatments require us to collect limited health-related information to ensure treatments are safe and suitable.

This information is treated as special category data and processed only:

• with your explicit consent,
• for health and safety purposes,
• or where otherwise permitted by law.

We minimise the amount of health information collected and store it securely.

6. How We Use Your Information

We may use your information to:

• Provide treatments and services
• Manage bookings and appointments
• Process payments and purchases
• Respond to enquiries
• Send service-related communications
• Improve our website and customer experience
• Maintain business records
• Comply with legal obligations
• Send marketing communications where you have opted in

We do not sell personal data to third parties.

7. Marketing Communications

We may send marketing emails, SMS messages, or promotional updates where you have consented or where permitted under applicable law.

You can opt out at any time by:

• clicking the unsubscribe link,
• replying STOP to SMS messages,
• or contacting us directly.

8. Cookies and Analytics

Our website may use cookies and similar technologies to:

• improve website functionality,
• analyse website traffic,
• remember user preferences,
• and maintain website security.

We may use analytics providers such as Google Analytics.

Under DUAA 2025 and PECR updates, certain low-risk cookies used for website functionality, analytics, or security may not require explicit consent where legally permitted.

You can still manage cookies through your browser settings.

9. Sharing Your Information

We may share personal information with trusted service providers where necessary for business operations, including:

• website hosting providers,
• payment processors,
• booking systems,
• email service providers,
• analytics providers,
• professional advisers,
• insurers,
• and legal or regulatory authorities where required.

All third-party providers are expected to handle personal data securely and lawfully.

We do not share your information for third-party marketing purposes.

10. International Data Transfers

Some third-party providers may process data outside the United Kingdom.

Where this occurs, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations,
• International Data Transfer Agreements (IDTAs),
• or equivalent lawful safeguards.

11. Data Retention

We only keep personal information for as long as necessary for the purposes for which it was collected, including legal, tax, insurance, and regulatory requirements.

Retention periods may vary depending on the nature of the information and services provided.

When information is no longer required, it is securely deleted or anonymised.

12. Your Rights

Under UK data protection law, you may have the right to:

• access your personal data,
• correct inaccurate data,
• request deletion of data,
• restrict processing,
• object to processing,
• withdraw consent,
• request data portability,
• object to direct marketing,
• request human review of significant automated decisions.

You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk

13. Subject Access Requests (SARs)

You may request a copy of the personal information we hold about you.

We may ask for reasonable proof of identity before processing requests.

Under applicable law, we may clarify or narrow requests where necessary and proportionate to process requests efficiently and securely.

14. Automated Decision-Making

We do not currently use fully automated decision-making that produces legal or similarly significant effects.

If this changes, we will update this Privacy Policy and provide appropriate safeguards and rights.

15. Data Security

We take appropriate technical and organisational measures to protect personal data against:

• unauthorised access,
• accidental loss,
• misuse,
• disclosure,
• or alteration.

However, no internet transmission or storage system can be guaranteed as completely secure.

16. Data Breaches

If a personal data breach occurs that poses a risk to individuals, we will take appropriate action and notify relevant authorities and affected individuals where legally required.

17. Third-Party Websites

Our website may contain links to third-party websites or social media platforms.

We are not responsible for the privacy practices or content of external websites.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes.

The latest version will always be available on our website.

19. Contact

Lisa Sutcliffe Hypnotherapy 07773 552823