PRIVACY POLICY

Tracy Maria Vose (“we”, “us”, “our”) is the data controller for the personal data collected through www.tracymariavose.com (the “Website”) and in connection with the services we provide.

This policy explains what personal data we collect, why we collect it, what we do with it, and what rights you have. It should be read alongside our Cookie Policy and our Terms and Conditions.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

IMPORTANT: HEALTH INFORMATION

Because we provide hypnotherapy services, some of the information you give us — for example the issue you would like help with, your medical or psychological history, or any medication you are taking — is information about your physical or mental health. This is “special category data” under Article 9 of the UK GDPR and receives additional protection.

We only collect health information where you choose to provide it, and we rely on your explicit consent (Article 9(2)(a)) as our condition for processing it. You can withdraw that consent at any time by contacting us at [email protected], although we may not be able to continue providing therapy services without it.

We do not share health information with advertising platforms, analytics providers, or any third party for marketing purposes. We do not sell it, and we do not use it to build advertising audiences.

We are not a healthcare provider regulated by the Care Quality Commission, and our services do not constitute medical treatment.

DEFINITIONS

Personal data – information relating to an identified or identifiable living individual.

Special category data – personal data revealing health, racial or ethnic origin, religious beliefs, sex life or sexual orientation, political opinions, trade union membership, genetic or biometric data.

Usage data – data collected automatically by the Website or its infrastructure, such as IP address and pages visited.

Processing – anything done with personal data, including collecting, storing, using, sharing and deleting it.

Controller – the party that decides how and why personal data is processed. For the Website, that is us.

Processor – a third party that processes personal data on our behalf and on our instructions.

WHAT WE COLLECT

Information you give us:

• Name
• Email address
• Telephone number
• Location (such as country, town or postcode)
• Information you provide in enquiry forms, applications, bookings, surveys or correspondence
• Payment details (processed by our payment provider — see “Payments” below)

Health information you choose to give us (special category data — see above):

• The concern or symptom you would like help with
• Relevant medical or psychological history, where you tell us
• Medication you are taking, where you tell us
• Notes made during consultations or sessions

Information we collect automatically:

• IP address, browser type and version, device type and operating system
• Pages visited, time and date of visit, time spent on pages, referring source
• Cookie and tracker identifiers (see our Cookie Policy)

We do not collect more information than we need. If you are unsure whether a piece of information is required, ask us before providing it.

OUR LAWFUL BASES FOR PROCESSING

We must have a lawful basis under Article 6 of the UK GDPR for everything we do with your personal data. Ours are:

• Contract – to provide the services you have booked or purchased, to arrange appointments, and to take payment.
• Consent – for marketing emails and text messages, for non-essential cookies and trackers, and (as explicit consent under Article 9) for any health information you provide. You may withdraw consent at any time.
• Legitimate interests – to run and secure the Website, to respond to enquiries, to keep records, to understand how the Website is used, and to prevent fraud. We have considered your rights and do not believe this processing overrides them. You may object at any time.
• Legal obligation – to keep financial and tax records and to comply with the law.

MARKETING

Where you have given consent, or where you are an existing customer and we are marketing similar services, we may contact you by email, SMS or telephone with news, offers and information about our services.

You can opt out at any time — by using the unsubscribe link in any email, by replying STOP to any text message, or by emailing [email protected]. Opting out of marketing will not affect messages relating to a service you have already booked.

We never use health information to decide what marketing to send you.

PROFILING AND ADVERTISING

Subject to your cookie consent, we use advertising and analytics tools that build audiences based on how visitors interact with the Website — for example, showing adverts to people who have visited a page but not made an enquiry (“retargeting”), or finding new audiences who behave similarly to existing visitors (“lookalike audiences”).

This involves automated processing of usage data, but it does not produce legal effects concerning you or similarly significantly affect you, and we do not carry out automated decision-making of that kind. You can prevent this processing entirely by declining non-essential cookies, and you may object at any time.

WHO WE SHARE DATA WITH

We share personal data with the following categories of recipient, who act as our processors or as independent controllers:

• LeadConnector – CRM, booking, email and SMS delivery
• Google – analytics, advertising, fonts, spam protection, document storage and backup
• Meta (Facebook/Instagram) – advertising and conversion measurement
• TikTok – advertising and conversion measurement
• Hyros – marketing attribution
• Cloudflare – website security and performance
• Our payment provider, accountants, and professional advisers

We may also disclose personal data where we are required to do so by law, by a court, or by a regulator; or where necessary to protect the rights, property or safety of ourselves, our clients or others.

We do not sell your personal data.

INTERNATIONAL TRANSFERS

Several of the providers listed above are based in the United States or process data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place — usually the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, or reliance on UK adequacy regulations (including the UK–US Data Bridge where the recipient is certified).

You may request a copy of the safeguard we rely on for any particular transfer by emailing [email protected].

HOW LONG WE KEEP DATA

• Enquiries that do not become clients – up to 24 months from last contact, then deleted.
• Client records and session notes – retained for the period required by our professional body and insurer, typically 7 years from the end of treatment.
• Financial and transaction records – 6 years plus the current financial year, as required by HMRC.
• Marketing consent records – for as long as you remain subscribed, plus 2 years to evidence the consent.
• Website usage and cookie data – as set out in our Cookie Policy, typically no more than 26 months.

When a retention period expires, data is securely deleted or anonymised.

SECURITY

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include access controls, encryption in transit, and limiting access to those who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours and, where the risk is high, we will notify you.

YOUR RIGHTS

Under the UK GDPR you have the right to:

• Be informed about how we use your data — this policy.
• Access a copy of the data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data, where there is no overriding reason for us to keep it.
• Restrict processing — ask us to stop using your data while a concern is resolved.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Object — to processing based on legitimate interests, and to direct marketing at any time, without giving a reason.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any right, email [email protected]. We will respond within one month. There is no charge, and we may ask you to verify your identity first.

Please note: if you ask us to erase your data and later wish to use our services again, you will need to provide the information required to deliver those services once more.

COMPLAINTS

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] so we can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk

PAYMENTS

Where you purchase a service, payment is processed by a third-party payment provider. We do not store or collect your full payment card details. Your payment information is provided directly to that provider, whose use of your information is governed by its own privacy policy.

COOKIES AND TRACKING

The Website uses cookies and similar technologies. Non-essential cookies are only set with your consent, which you can change or withdraw at any time. Full details, including a list of the cookies we use, are in our Cookie Policy.

The Website does not currently respond to “Do Not Track” browser signals. Please check the privacy policies of the third-party services we use to see whether they honour such signals.

LINKS TO OTHER SITES

The Website may contain links to sites we do not operate. We are not responsible for the content or privacy practices of those sites and we encourage you to read their privacy policies.

CHILDREN

Our services are not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

CHANGES TO THIS POLICY

We may update this policy from time to time. The current version will always be posted on this page with the date it took effect. Where a change is significant, we will bring it to your attention.

CONTACT

Controller: Tracy Maria Vose
Email: [email protected]

Last Updated: July 11th, 2026