Privacy Policy

Rooted Calm Hypnotherapy — Tamara Miller
Last updated: September 2026

Your privacy and confidentiality are extremely important to me.

This Privacy Policy explains how Rooted Calm Hypnotherapy collects, uses, stores and protects personal information when you visit the website, make an enquiry, book a consultation or receive hypnotherapy services.

1. Who I am

Tamara Miller trading as Rooted Calm Hypnotherapy is the data controller for the personal information described in this Privacy Policy.

Business: Rooted Calm Hypnotherapy
Practitioner: Tamara Miller
Location: Bournemouth and Poole, Dorset, UK, with online services available across the UK
Email: tamaramillercounselling@gmail.com

If you have questions about this Privacy Policy or the information I hold about you, please contact me using the email address above.

2. Confidentiality

Information shared within hypnotherapy is treated confidentially.

There are limited circumstances in which confidentiality may need to be broken, including where:

• there is a serious concern about your safety or another person's safety;

• there is a safeguarding concern;

• disclosure is required by law or court order;

• information is required for the establishment, exercise or defence of a legal claim; or

• another professional needs to be involved and disclosure is appropriate and lawful.

Where it is safe and appropriate to do so, I will normally discuss this with you before information is shared.

3. Personal information I may collect

Identity and contact information

This may include:

• your name;

• email address;

• telephone number;

• address where required;

• date of birth where relevant to the service; and

• emergency contact details where appropriate.

Appointment and booking information

I may process information including:

• consultation and appointment dates;

• booking history;

• payment information;

• cancellations or rescheduling information; and

• communications relating to your sessions.

Full payment-card details are normally handled by the payment provider rather than stored by Rooted Calm.

Client and therapy information

If you become a client, I may collect information relevant to providing hypnotherapy, including:

• the reason you are seeking support;

• your goals for therapy;

• information you voluntarily share about your experiences, behaviours, emotions or circumstances;

• relevant history;

• session notes;

• progress information;

• agreed therapeutic approaches;

• referrals or recommendations where relevant; and

• other information reasonably necessary to provide the service safely and appropriately.

Health and special-category information

Hypnotherapy clients may choose to disclose information about:

• physical health;

• mental and emotional wellbeing;

• medication or treatment;

• disabilities;

• diagnoses;

• sleep;

• eating behaviours;

• previous therapy;

• traumatic or significant experiences; or

• other sensitive aspects of their life.

Information concerning health is considered special-category personal data and receives additional protection under data-protection law.

Where I intentionally process special-category information as part of providing hypnotherapy, I rely on an appropriate lawful basis under UK data protection law and an additional special-category condition, including explicit consent where appropriate.

If consent is the applicable condition, you may withdraw that consent. However, if information is reasonably necessary to provide hypnotherapy safely, withdrawing consent may mean that I am unable to continue providing the service.

Hypnotherapy recordings

Where a personalised hypnotherapy recording is created for you, it may include information tailored to your goals or circumstances.

Recordings are provided for your personal use. Copies may be retained temporarily where necessary to produce or deliver the recording and will not be used for unrelated purposes without your permission.

Communications

I may keep relevant communications sent by:

• email;

• contact forms;

• text or messaging services;

• social media; or

• other communication channels.

Website and technical information

The Rooted Calm website may automatically process technical information such as:

• IP address;

• browser and device information;

• operating system;

• pages visited;

• referring pages;

• website interactions; and

• cookie or similar technology information.

Please see the separate Cookie Policy for further information.

4. Why I use your information

To respond to enquiries and consultation requests

I use your contact details and information you provide to answer questions, arrange a consultation and determine whether my service may be appropriate.

Lawful basis: legitimate interests and taking steps at your request before entering into a contract.

To provide hypnotherapy

I process information necessary to arrange, personalise and provide your sessions.

Lawful basis: performance of a contract.

Where special-category information is processed, an additional Article 9 condition is also required, including explicit consent where appropriate.

To maintain appropriate client records

I maintain proportionate client notes to support continuity of care, professional practice, safety, confidentiality and appropriate record keeping.

Lawful basis: legitimate interests in maintaining appropriate professional records, performance of a contract and, where relevant, legal obligations.

Special-category information is only processed where an additional lawful condition applies.

To manage safeguarding or serious safety concerns

Information may be used or disclosed where necessary to respond to a safeguarding concern, serious risk or legal requirement.

The precise lawful basis will depend on the circumstances.

To administer payments and financial records

I process transaction and invoice information for accounting, tax and business administration.

Lawful basis: performance of a contract and compliance with legal obligations.

To operate and secure the website

Technical data may be used to operate the website, protect it from spam or abuse and understand website performance.

Lawful basis: legitimate interests in maintaining a safe and effective website, together with consent where required for optional cookies or similar technologies.

Marketing

If I offer newsletters or promotional communications, I will only send them where permitted by applicable electronic-marketing and data-protection law.

Therapy information will not be used for unrelated marketing profiling.

You can opt out of marketing at any time.

5. How I collect personal information

Information may be collected:

• directly from you;

• through the Rooted Calm website;

• when you book through a scheduling service;

• during consultation and therapy sessions;

• through email, telephone or messaging;

• from payment providers;

• through website technologies; or

• in limited circumstances, from another person or professional where you have authorised this or where another lawful basis applies.

6. Cookies and website technologies

Rooted Calm uses cookies and similar technologies to support:

• website functionality;

• security;

• preferences;

• analytics where enabled; and

• website performance.

Where consent is legally required, optional technologies will be used in accordance with the choices you make.

Please see the separate Cookie Policy for further information.

7. Google reCAPTCHA

Certain Rooted Calm website forms may use Google reCAPTCHA to protect the website and forms against spam, fraud and automated abuse.

Technical and interaction data may be processed for security and risk-analysis purposes.

For reCAPTCHA customer data, Rooted Calm acts as the data controller and Google processes relevant information as a data processor on behalf of Rooted Calm.

8. Who I may share information with

I do not sell client information.

Personal information may be shared only where reasonably necessary with:

• Squarespace or other website and hosting providers;

• scheduling providers such as Calendly;

• payment processors;

• email and communications providers;

• video-conferencing providers used for online sessions;

• secure cloud-storage or IT providers;

• professional advisers such as accountants, insurers or lawyers;

• professional supervisors where applicable, normally using anonymised or minimised information wherever reasonably possible;

• medical or other professionals where you have authorised a referral or where another lawful basis permits disclosure;

• safeguarding authorities, emergency services, courts, regulators or law-enforcement bodies where disclosure is required or justified by law.

Only the minimum information reasonably necessary for the particular purpose will be shared.

9. Professional supervision

Professional supervision may be used to support safe, ethical and effective practice.

Where a client situation is discussed in supervision, information will normally be anonymised or minimised so that you are not unnecessarily identifiable.

If identifiable information needs to be shared, I will ensure there is an appropriate lawful basis for doing so.

10. International transfers

Some technology providers used by Rooted Calm may process or store information outside the UK.

Where personal information is transferred outside the UK, I take reasonable steps to ensure that the transfer is covered by a legally recognised transfer mechanism.

This may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK International Data Transfer Addendum;

• other approved safeguards; or

• another permitted transfer mechanism.

You may contact me if you would like further information about safeguards applying to a particular service provider.

11. How long I keep information

I do not keep personal information for longer than reasonably necessary.

Retention periods depend on the type of information, the purpose for which it is held, professional requirements, insurance requirements and applicable law.

As a general guide:

• initial enquiries that do not progress to therapy will be deleted when they are no longer reasonably required;

• appointment and administrative information will be kept for as long as necessary to manage the client relationship;

• therapy and client records will be retained for an appropriate period after therapy ends, taking account of professional, insurance, safeguarding and legal requirements;

• financial records will be kept for the period required by tax and accounting law;

• marketing information will be retained until you unsubscribe or the relevant mailing list is discontinued; and

• website and cookie information will be retained according to the settings and retention periods of the relevant website technologies.

Information may be retained for longer where necessary in relation to safeguarding, complaints, litigation, regulatory matters or other legal obligations.

When information is no longer needed, it will be securely deleted, anonymised or disposed of appropriately.

12. Data security

I take appropriate steps to protect client information and maintain confidentiality.

Measures may include:

• password-protected devices and accounts;

• appropriate access controls;

• secure storage;

• confidentiality procedures;

• limiting access to people with a genuine need to know; and

• using reputable service providers.

While no electronic system can be guaranteed to be completely secure, reasonable technical and organisational safeguards are used to reduce risk.

13. Your rights

Depending on the circumstances, you may have the right to:

• request access to information held about you;

• ask for inaccurate information to be corrected;

• request deletion of information;

• request restriction of processing;

• object to certain uses of your information;

• request data portability where applicable; and

• withdraw consent where processing is based on consent.

These rights are subject to legal conditions and exemptions.

For example, I may need to retain certain information despite a deletion request where there is a legal, safeguarding, insurance or professional reason for doing so.

Your right to object

Where I rely on legitimate interests, you may have the right to object to the processing.

You always have the right to object to your information being used for direct marketing.

To exercise any of your rights, contact:

tamaramillercounselling@gmail.com

I may need to verify your identity before releasing personal information.

14. Complaints

If you have concerns about how your information has been handled, please contact me first so I have the opportunity to address them.

Email: tamaramillercounselling@gmail.com

15. Third-party websites

The Rooted Calm website may contain links to third-party websites or platforms.

Those third parties are responsible for their own privacy practices. I recommend reviewing their privacy information before providing personal information directly to them.

16. Children and young people

The website is not specifically directed at children under 13 and I do not knowingly collect personal information from children under 13 through the website.

Where therapeutic work with a young person is considered, additional consent, confidentiality and safeguarding arrangements may apply.

17. Automated decision-making

Rooted Calm does not use solely automated decision-making or profiling to make decisions about clients that produce legal or similarly significant effects.

18. Changes to this Privacy Policy

This Privacy Policy may be updated when the service, website, technology, professional requirements or applicable law changes.

The latest version will be published on the Rooted Calm website together with the date it was last updated.