At The Silverberg Practice, I am committed to protecting and respecting your privacy and ensuring your personal and sensitive confidential data is kept secure. This document combines my practice terms regarding data protection, confidentiality, and your privacy rights in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Uses and Access Act (2025), and regulatory guidelines.

​

1. What Are Your Reasons for Collecting Information?

To provide you with the highest quality support, I collect information about your reasons for seeking hypnotherapy, a small amount of relevant medical information, and limited details about significant people in your life, along with brief notes from each session. This helps me stay informed and maintain continuity across our work together. Your contact information, address, and GP details will only be used with your explicit consent.

​

2. Lawful Basis for Processing

Under the UK GDPR, I process your information based on the following lawful bases:

• Legitimate Interests: Processing is necessary for the performance of hypnotherapy services, maintaining continuity of care, and fulfilling professional administration.

• Recognised Legitimate Interests: In specific circumstances defined by the Data Uses and Access Act (2025)—such as protecting public safety or complying with legal warrants or police requests—I may process or share information under recognised legitimate interests without requiring a formal balancing test.

• Explicit Consent: Contact information, address details, and GP communication are utilized strictly based on your explicit consent.

​​

3. How Is My Information Protected and Stored?

I take the security of your personal and sensitive data seriously and implement robust technical and physical measures:

• Hardcopy Documents: Stored securely in a locked filing cabinet within a locked room.

• Text Messages: My work phone is secured with a PIN code and multi-factor authentication.

• Emails: My work email account requires a secure username, password, and authentication.

• Electronic Documents: Any electronic documents (e.g., a letter to your GP or an invoice) containing personal or sensitive information are password-protected and stored on a password-protected computer.

​​

4. How Long Will You Hold My Information For?

I am regulated by professional standards that stipulate I must hold your data for 8 years after the last interaction for adult clients. The exception applies to children, for whom I must hold data until their 25th birthday (or until their 26th birthday if treatment ends when they are 17). All records are securely deleted in January following the expiry of these retention scales, aligning with NHS data retention guidelines.

Note on Early Deletion: Due to the sensitive nature of clinical work, my insurance provider does not allow the deletion of data before the minimum required holding period.
 

5. Confidentiality and Professional Supervision

Everything we discuss in our sessions is treated as strictly confidential. At times, I may share aspects of our work with my professional supervisor to support the quality and effectiveness of my practice. These discussions are conducted without revealing any identifying information about you. My supervisor is also bound by GDPR and confidentiality requirements.

 

6. Contact with Other Professionals and Third Parties

I can only contact other health or social care professionals with your written consent. The only exceptions are:

• Duty of Care: If I have serious concerns that you may be at risk of harming yourself or someone else, I am legally and ethically required to inform appropriate authorities. Wherever possible, I would discuss this with you first.

• Legal Obligations: I am legally obliged to share information with the police if required under a warrant or court order.

​​

7. Website Cookies and Tracking

My website (www.thesilverbergpractice.com) uses cookies and similar tracking technologies via Wix to ensure proper functionality and analyze site traffic. For detailed information, please see my Cookie Policy.

​

8. Your Rights & Access (Subject Access Requests / SARs)

If you have any questions or want to know which personal data I have about you, please contact me directly. Under the UK GDPR, you have the following rights:

• Right to be informed: You have the right to know what personal information I collect, why I collect it, how long I keep it, and who it may be shared with.

• Right of access (Subject Access Requests): You can ask for a copy of the personal information I hold about you. I will respond to all requests within 30 days. In line with the Data Uses and Access Act (2025), searches will be reasonable and proportionate—meaning I am not required to review every historical document if it is disproportionately difficult or unlikely to contain relevant data. Please note that in some cases, my insurance provider’s legal team may need to review and verify information before it is shared.

• Right to rectification: You can ask me to correct inaccurate or incomplete information. I will update it without undue delay.

• Right to erasure ("right to be forgotten"): You can ask for your personal information to be deleted in certain circumstances. This right is not absolute, because as a registered practitioner I must keep therapy records for the required professional retention period (8 years for adults, and until age 25 or 26 for children). Furthermore, due to the sensitive nature of clinical work, my insurance provider does not allow the deletion of data before the minimum required holding period.

• Right to restrict processing: You can ask me to limit how your information is used (for example, while its accuracy is being checked).

• Right to data portability: You can request your personal information in a structured, commonly used format and ask for it to be transferred to another provider.

• Right to object: You can object to certain types of processing. For example, if I ever use data for direct marketing, you can object at any time.

Please make sure to always clearly state who you are so that I can be certain I do not modify or delete any data of the wrong person. To exercise any of these rights, please contact me directly.

​

9. Data Protection Complaints Procedure

If you believe your personal information has been handled in a non-compliant manner, you have the right to raise a complaint:

• How to File: Please submit your complaint by emailing: sarah@thesilverbergpractice.com

• Process: I will acknowledge all data protection complaints within 30 days, investigate the matter, and inform you of the outcome without undue delay.

• Escalation: Please utilize this internal complaints process first. If you remain dissatisfied with the resolution, you retain the right to escalate your complaint to the Information Commissioner’s Office (ICO).

Note: This complaints procedure relates solely to how personal data is used, distinct from general clinical practice complaints handled via professional associations.

​​

10. Encounters Outside of Sessions

If we happen to see each other outside of a hypnotherapy session, I may acknowledge you discretely but I won’t initiate conversation to protect your privacy. You are free to speak openly about your therapy if you choose, but I am bound by GDPR regulations to safeguard your confidentiality at all times.