Last updated: 16 October 2026
1. Who we are
Brighouse Hypnotherapy Ltd (company number 17291041) operates the Brighouse Mind & Body Practice website. It is the data controller for personal information collected through this website and for information handled by Denise Beckett in her own practice.
Our contact details are: 4–8 Bridge End, Brighouse, HD6 3DH; denise@brighousemindandbody.co.uk; 01484 887209. Our ICO registration number is ZC247436.
2. Independent practitioners
Other practitioners featured at Brighouse Mind & Body Practice are self-employed. Each practitioner is normally a separate data controller for the client information they collect and use when providing their services. They are responsible for their own clinical records, retention arrangements and privacy information.
Website enquiries are received by Denise. If you ask to hear from another practitioner, relevant details from your enquiry may be passed to that practitioner so they can respond. Their own privacy information will then apply to the information they handle.
3. Information we collect
- Identity and contact details, such as your name, email address, telephone number and address.
- Enquiry and booking details, including the service or practitioner you are interested in and appointment information.
- Information you choose to provide in messages, forms, consultations or sessions. This may include health, wellbeing or other sensitive information.
- For a client under 18, their age and relevant parent or guardian details and consent.
- Payment and transaction information, such as the amount, date, payment status and reference. Card details may be handled directly by the relevant booking or payment provider.
- Technical and usage information, such as IP address, browser or device information, cookie choices and how the website is used.
- Correspondence, feedback and complaint information.
4. How we collect information
We may collect information directly from you through the website, by email, telephone or message, through a booking service, and during consultations or therapy sessions. Information may also be provided by a parent or guardian, a practitioner, or a professional who refers you, where they are authorised to do so. Technical information may be collected automatically through cookies and similar technologies.
5. Why we use information and our lawful bases
We use personal information to respond to enquiries; assess whether a service may be suitable; arrange, provide and manage appointments; take payment; maintain appropriate client and business records; communicate about services; deal with complaints; keep the website and practice secure; and meet professional, safeguarding, insurance, tax and legal responsibilities.
Depending on the purpose, we rely on one or more of the following lawful bases under UK data protection law:
- Contract: where the information is needed to take steps at your request before a booking or to provide an agreed service.
- Legitimate interests: to run the practice, respond to enquiries, keep proportionate records, improve services, and protect clients, practitioners and the website, where those interests are not overridden by your rights.
- Consent: where you have made a genuine choice, including for non-essential cookies or optional marketing. You may withdraw consent at any time.
- Legal obligation: where information must be used or retained to comply with the law.
- Vital interests: in a genuine emergency where use of information is necessary to protect life and consent cannot reasonably be obtained.
Health and therapy information is special category data. Where Denise handles this information, the usual additional condition is your explicit consent. Where applicable and permitted by law, information may instead be used to protect vital interests, support safeguarding, establish or defend legal claims, or meet another substantial public-interest condition.
We do not use personal information for solely automated decisions that have legal or similarly significant effects.
6. Who we may share information with
We only share information where there is a proper reason and limit it to what is needed. Recipients may include:
- The independent practitioner you have asked to contact or provide a service to you.
- Booking, payment, banking, website hosting, website form, email, security, analytics and IT service providers. Services used by or linked from the website may include WordPress, Gravity Forms, Fresha, Google, Meta/Facebook and Vimeo.
- Professional advisers, insurers and regulators where reasonably necessary.
- A GP, psychiatrist or other relevant professional where you have consented, where a referral is being arranged, or where sharing is otherwise necessary for serious safety or safeguarding concerns.
- Emergency services, safeguarding bodies, courts, law-enforcement bodies or other authorities where disclosure is necessary or legally required.
Denise may discuss clinical work with a professional supervisor to support safe and ethical practice. Only a client’s first name is used and no other directly identifying client details are shared.
We do not sell personal information.
7. International transfers
Some technology providers may store or process information outside the UK. Where this happens, we take reasonable steps to ensure an appropriate legal safeguard is in place, such as UK adequacy regulations or approved contractual protections.
8. How long we keep information
Denise normally keeps adult client notes and related clinical records for seven years after the final session. Records for a client who was under 18 are normally kept until their 25th birthday. A longer period may apply where there is a legal, safeguarding, insurance or professional reason.
General enquiries, correspondence, booking information, website logs and complaint records are kept only for as long as reasonably needed for their purpose, taking account of legal, security and professional requirements. Financial records are retained for the applicable statutory period. Other self-employed practitioners set their own appropriate retention periods.
9. Security
We use reasonable technical and organisational measures to protect personal information and restrict access to people and providers who need it. No internet or storage system can be guaranteed completely secure, but suspected data breaches will be assessed and reported where the law requires.
10. Children and young people
Denise works with clients aged 9 and over and obtains written consent from a parent or legal guardian before treating anyone under 18. We aim to explain privacy in an age-appropriate way and to use only the information needed for safe and suitable care. Other practitioners may have different age criteria and consent arrangements.
11. Your data protection rights
Depending on the circumstances, you may have the right to ask for access to your information; correction of inaccurate information; deletion; restriction of use; transfer of information you provided; or to object to certain uses. You may also withdraw consent at any time where consent is the lawful basis. These rights are not absolute, and a legal or professional reason may require some information to be retained.
To exercise a right, contact Denise using the details above. We may need to verify your identity and will respond within the period required by law.
12. Cookies and third-party content
The website uses essential cookies to function and may use optional analytics, advertising or embedded-content cookies where permitted. Embedded maps, videos, social media features and booking tools may allow their providers to receive technical information when you interact with them. You can use the website’s cookie controls and your browser settings to manage non-essential cookies. Blocking some cookies may affect how the site works.
13. Complaints
Please contact Denise first if you are concerned about how information has been used. A data protection complaint will be acknowledged within 30 days and investigated without undue delay.
You also have the right to complain to the UK data protection regulator, the Information Commissioner’s Office (ICO). Information about making a complaint is available at ico.org.uk/make-a-complaint/data-protection-complaints/.
14. Changes to this policy
We may update this policy when the practice, website or law changes. The latest version will be published on this page with a revised date.