This policy explains how I collect, use and protect your personal information when you visit this website or work with me as a client. I take your privacy seriously, particularly given the sensitive nature of therapy.
Who I am
This website is operated by Tom Warmerdam, a Cognitive Behavioural Hypnotherapist providing online therapy.
- Email: hello@tomwarmerdam.co.uk
- Telephone: 07961 272 173
- ICO registration number: ZC230327
For the purposes of UK data protection law, I am the data controller for the information described in this policy.
What information I collect
When you contact me
If you complete the enquiry form or contact me by phone or email, I collect your name, email address, telephone number, your preferred method of contact, and whatever you choose to tell me about what you would like help with.
You do not need to share detailed personal or medical information at this stage. A brief description is enough.
When you become a client
If we go on to work together, I will collect further information as part of your assessment and ongoing sessions. This may include your contact details, date of birth, GP details, relevant medical and mental health history, current medication, and notes recording the work we do together.
When you visit this website
This website does not use tracking or advertising cookies, and no cookie banner is required. My hosting provider, Netlify, records standard technical information such as IP addresses and pages requested in order to deliver the site securely.
Special category data
Information about your physical or mental health is treated as special category data under UK GDPR, which means it receives a higher level of protection.
I process this information on the basis of Article 9(2)(h) — the provision of health and social care — and I handle it under a duty of confidentiality. It is never used for marketing and never shared for commercial purposes.
Why I use your information, and my lawful basis
- To respond to your enquiry. Lawful basis: legitimate interests — you have contacted me and expect a reply.
- To provide therapy and keep clinical records. Lawful basis: contract, together with Article 9(2)(h) for health data.
- To meet professional and insurance obligations. Lawful basis: legal obligation and legitimate interests.
- To take payment and keep financial records. Lawful basis: contract and legal obligation.
How long I keep it
- Enquiries that do not lead to sessions: deleted within [ 6 / 12 ] months.
- Client records: retained for [ 7 ] years after your final session, in line with professional and insurance requirements. Where the client was under 18, records are kept until their 25th birthday.
- Financial records: retained for 6 years, as required by HMRC.
Who I share it with
Your information is confidential and is not sold, rented or shared for marketing. I use a small number of service providers who process data on my behalf under written agreements:
- Netlify — website hosting and enquiry form submissions
- Google Workspace — email correspondence, calendar and document storage
- Vimeo — video hosted on this website
- Google Meet — online sessions
Some of these providers are based outside the UK. Where that is the case, transfers are protected by UK-approved safeguards such as the International Data Transfer Agreement or adequacy regulations.
Clinical supervision
As is standard professional practice, I discuss my work in supervision to maintain the quality and safety of the therapy I provide. Clients are referred to anonymously and identifying details are not shared.
When I may need to break confidentiality
In rare circumstances I may need to share information without your consent — where there is a serious risk of harm to you or another person, where a child or vulnerable adult may be at risk, or where I am required to do so by law or a court order. Wherever it is safe and appropriate, I will discuss this with you first.
Your rights
Under UK data protection law you have the right to:
- Ask what information I hold about you and request a copy
- Have inaccurate information corrected
- Request deletion of your information, subject to my professional retention obligations
- Object to or restrict how I use your information
- Request your information in a portable format
- Withdraw consent at any time, where consent is the basis I am relying on
To exercise any of these, email hello@tomwarmerdam.co.uk. I will respond within one month.
How your information is kept safe
Electronic records are stored on password-protected, encrypted devices. Any paper records are kept in a locked cabinet. Records are stored separately from identifying details where practical, and I review my security arrangements regularly.
Complaints
If you are unhappy with how I have handled your information, please contact me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
I may update this policy from time to time. Any changes will be posted here with a revised date at the top of the page.