GDPR, Data Protection, and Confidentiality

Practitioner Courses in Clinical Hypnotherapy, Coaching, NLP, EMDR, EFT & Mindfulness

I collect personal information from you as part of my enrolment process. In handling this information, I am bound by two sets of rules, the General Data Protection Regulations (GDPR) and my professional body’s code of ethics. This page will explain how these affect the way I work.

My company, Annette Brown School of Hypnotherapy, Coaching, NLP, EMDR and EFT, is registered with the ICO

I am both the Data Controller and the Data Protection Officer. My contact details are, Annette Brown, email, phone 01253 969695.

  • The information about you that I collect comes from you, via an enrolment form (either online or on paper)
  • You have no legal requirement to share information with me, but if you do not I will not be able to offer you a place on a course
  • The purpose of collecting personal information from you is to enable me to decide if I can offer you a place on one of my courses, to administer the course once you are enrolled, to enable me to invoice you and receive payment, and to sign you up for my monthly newsletter
  • The categories of data/information I collect include: your name and contact details, your learning and payment preferences, your medical history, and details of any criminal convictions
  • You give me permission to hold and use this information in line with these guidelines when you apply to come on the course.
  • I keep the information you give me for seven years after your graduation, which is the length of time suggested by my professional body and insurance company for client records: they don’t have separate advice for trainers
  • Sharing your information:
  • if you enrol on a course, I share your name and contact details with the General Hypnotherapy Register and the ACCPH, who grant you a student membership, and with the administrator of the external course which is completed as part of your studies
  • If a third party (e.g. an employer or someone offering training grants) is involved in your application, I will share relevant information with them.
  • My professional body’s code of ethics also allows me to share anonymous case histories verbally or for the purposes of supervision or training. Anonymous means your personal details are removed and no information that might identify you is used.

I maintain the same level of confidentiality for students as I do for clients which means that I only divulge sensitive information where there is a legal requirement for me to do so e.g. where the Children’s Act applies or a court order is issued, or when there is good cause to believe that if I do not disclose information you or others would be exposed to a serious risk of harm.

You have rights over the information I hold about you. These are

  • Portability – you can ask me to send your information to someone else
  • Rectification – if you think my records are wrong you can ask me to change them
  • Erasure – in some circumstances you can ask me to remove your details from my records (this is sometimes called ‘the right to be forgotten’)
  • Fair profiling – you can ask that any processes I automate are done by a person instead of a computer. I don’t currently automate any information processing, although I do use online forms to collect information.
  • Right of access – you can have a copy of the information I hold at any time, by requesting it in writing. If you do this, it will be provided within 30 days and free of charge.
  • Restricting processing – in some circumstances you can request that I stop processing your information
  • Objection – you can object to the way I process information (e.g. if it is used to send you direct marketing and you don’t want to receive this) and can ask me to stop using it in the way
  • Information – you have the right to understand how I collect and process your information (hence this privacy notice)

You can learn more about these rights on

You can withdraw your permission for me to use your information at any time, although it would mean leaving the course if you are still a student

You have a right to complain to the ICO if you have any problem with the way I store or use your data, or if you do not think your rights are being respected.