Mindbalance – Privacy Policy #2.0

24th May 2018


Section A
Aim and Purpose
Information Governance Framework Principles for Mindbalance

Section B
Privacy Notice: Use of information
Retention Schedule
Data Processing

Section C
Data Breach
Subject Access Request
Right to Erasure
Safeguarding your privacy


Section A


Data held by Mindbalance will be held lawfully and for the retention periods set out in section B of this policy document.

This document refers to:

  • Written Documents
  • Spreadsheets
  • Hardcopy case notes and files
  • Database entries
  • Images
  • Recordings
  • Emails
  • Text messages
  • Supervision notes
  • Visits to the organisation’s website
  • Social media communication


Aim and Purpose

The purpose of this document is to ensure that Mindbalance has a framework that ensures the rights and freedom of individuals in relation to their personal data and adheres to best practice in the management of client information and business records.

Information Governance sets out the way in which information collated by an organisation is managed and ensures that any information collected;

  • is the right information
  • is in the right place
  • at the right time
  • with the right people
  • for the right reasons

This is a live document and may be updated at any time to reflect changes in law or growth of the business, and therefore should be revisited regularly to check for any updates. Mindbalance is fully committed to ensuring clients privacy and data protection rights.

For the purpose of this policy Lindsay Rogers is the named Data Protection Officer/Controller and Head of Organisation.


Information Governance Framework Principles for Mindbalance

1. Assessment needs for Information Governance (IG) Training have been identified and fully met, with a 75-minute GDPR CPD Course provided by the Clinical Hypnotherapy School (www.clinicalhypnotherapyschool.com) completed.

2. Any changes to the business processes and/or operations will be planned and will comply with the framework to ensure any risks to personal and sensitive information are minimised.

3. Any data collected is solely for the purpose of providing a person-centred service to an individual client. We use cookies to collect data for a third party tracking service where the data is anonymised and process only by the third party, and not shared with anyone else.

4. All technology [Microsoft Office products including Outlook] used to store or facilitate information and communication is maintained according to the Data Retention Policy for Mindbalance.

5. All records are identifiable, locatable, retrievable, and intelligible according to regulations set out by GDPR.

6. It is the responsibility of the Data Controller to ensure sufficient resources are in place to prioritise adhering to Data Protection Legislation in the business.

7. Any electronic devices where personal or sensitive, confidential information is held will be password protected.

8. Procedures have been put in place to ensure the General Data Protection Regulations are met. These can be found in Section C.


Section B

Privacy Notice: Use of information

Mindbalance is committed to protecting & respecting your privacy. This notice aims to give you information of how your information is collected & processed.

Under the General Data Protection and Retention (2018) legislation, regarding how your personal data is processed, all individuals have:

  • the right to be informed;
  • the right of access;
  • the right to rectification;
  • the right to erasure;
  • the right to restrict processing;
  • the right to data portability (excludes paper files) ;
  • the right to object; and
  • the right not to be subject to automated decision-making including profiling.

General information about how Mindbalance collects & processes your data;

  • Personal & Special category information collected by Mindbalance which form client records is collated and processed in a paper file format. These paper files are stored in a locked filing cabinet behind a locked door.
  • Any document containing personal or special category data will state “Official-sensitive, private and confidential” clearly.
  • All emails correspondence will contain a privacy statement.
  • On some occasions anonymised personal data will be retained whereby a client has provided a testimonial for use on the organisation’s website. When data is non-identifiable GDPR law is no longer applicable. [Non-identifiable means that if this data was left on a bus, no one, including the data subject would be able to identify that this data was relating to them.]
  • Mindbalance does not use automated decision-making tools, including profiling.

Third Parties that process or hold information used for the business of Mindbalance


BPWEB provide hosting services for our website – their privacy policy is published @ bpweb privacy policy


FASTHOSTS provide hosting services for emails – their privacy policy is published @ fasthosts privacy policy


My PC  is backed up using – Knowhow Cloud backup

Apple icloud – used for my phone – their privacy policy is published @ apple privacy policy.

Note: Information is also backed up from my PC on to an encrypted portable hard drive

Audio files

Dropbox  -Is used as a third party to share audio files with my clients – their privacy policy is published @ dropbox privacy policy

Audio files are edited using audacity

Audio files are stored on my computer (password protected) during the retention period

Retention Schedule

Information Asset Information Owner Asset Retention Trigger for Disposal
Email (including sent items) Head of organisation Annual review period every January.Emails of an administrative nature are deleted

Emails containing sensitive data are printed off & retained with client records (see below) prior to deleting the electronic copy

Any remaining email live data is untouched until following review period.

End of retention period
Contact details /text /email communication details held on mobile devices Head of organisation All entries to be deleted/wiped prior to decommissioning of mobile device or reissue of device End of retention period
Recordings Head of organisation 8 years or earlier if consent is withdrawn End of retention period
Promotional materials Head of organisation Until superseded – Consent to be rechecked prior to reissue End of retention period
Paper Diaries Head of organisation 8 years from the period in which its use ends. End of retention period
Policies Head of organisation Until new policy has been put into place End of retention period
Client records including session notes, initial consultation notes and client overview form Head of organisation In accordance with CNHC regulation, 8 years after final treatment session has ended. Child records should be held until after 25th birthday, or 26th birthday if aged 17 when treatment ends. End of retention period
Service evaluation records Head of organisation Transfer to anonymised data within 6 months of collection. End of retention period
Complaints Head of organisation 2 years from complaint being resolved End of retention period
Right to Erasure Request Head of Organisation 8 years from request being submitted and completed. End of retention period
Subject Access Request Head of organisation 8 years alongside session notes, or plus 2 years from case closure if request is made after 6 years of storing data. End of retention period



In accordance with this data retention schedule there may be occasions when data is not destroyed due to ongoing investigation, ligation or enquiry. The data will be deleted upon confirmation that it is no longer required.

Hard copy data will be destroyed via a cross cut shredding machine owned by the organisation, electronic data will be permanently deleted.

Data Processing

The lawful basis’s for processing personal data at Mindbalance are;

  • Consent : The individual has given clear consent for their data to be processed for the specific purpose/s detailed in the consent form stored in their personal file.
  • Contract : to process personal data to fulfil contractual obligations.

1. Special category information: Includes personal information about racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. To process this type of information you require a separate condition for processing special category information.

2. Mindbalance processes special category information under the condition of ‘provision of health care’ (h)  Article 9 (2) of GDPR

 (h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems & services on the basis of Union or Member State law or pursuant to contract with a health professional & subject to the conditions & safeguards referred to in paragraph 3

3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

This means that Lindsay Rogers of Mindbalance does not require consent to hold your data (section B8 of the Complementary & Natural Healthcare Council (CNHC) Code of conduct requires Lindsay Rogers of Mindbalance to keep client records safely for eight years from the date of the client’s last visitor or, if the client is a child until their 25thbirthday, or 26th  birthday if the client was 17 when the treatment ended).  This means  Mindbalance has a ‘ legitimate interest’ in retaining client records for this period. However, Mindbalance does require your consent to contact you for specific purposes. 

If information is required to be passed on to an indemnity or insurance provider the condition of use is ‘for the establishment, exercise or defence of legal claims’

Vital interest: the processing is necessary to protect someone’s life. This would only occur where Mindbalance believed a client posed a serious risk to themselves or others. In this situation  Mindbalance is legally obliged to report the matter to your GP or the appropriate authority.

Description of processing

The following is a broad description of the way this organisation/data controller processes personal information. Clients wishing to understand how their own personal information is processed may choose to read the FAQ’s / Terms and Conditions for treatment document, which compliments the policies detailed here. –

Click here to see the Description of Processing

Reasons/purposes for processing information

Mindbalance processes personal information to enable the provision of therapeutic services including Hypnotherapy, Stress Management services, to advertise services and to maintain accounts and records.

Type/classes of information processed

Mindbalance processes information relevant to the above reasons/purposes. This information may include:

  • personal details
  • family, lifestyle and social circumstances
  • goods and services
  • financial details
  • employment and education details

Mindbalance also processes sensitive classes of information that may include:

  • physical or mental health details
  • racial or ethnic origin
  • religious or other beliefs of a similar nature
  • offences and alleged offences

Mindbalance processes personal information about:

  • clients
  • suppliers
  • business contacts
  • professional advisers
  • supervisors


Section C

Data Breach

All personal and sensitive data held by Mindbalance is held securely. Electronic data is stored on a password protected computer. Data is backed up to knowhow cloud, apple icloud & a portable encrypted hard drive. This supports the ability to retrieve data in the event of computer failure.

Password protected documents are used where required to protect the identity of clients. Hardcopy data is held securely in a locked cabinet behind a locked door.

In the case of a data breach Mindbalance shall comply with the regulations set out under Article 33 of the GDPR;

1.In the case of a personal data breach, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the ICO, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the individual. Where the notification to the ICO is not made within 72 hours, it shall be accompanied by reasons for the delay.

2.The notification referred to in paragraph 1 shall at least:

(a)  describe the nature of the personal data breach including where possible, the approximate number of data subjects concerned and the categories (e.g. sessions notes, phone numbers) and approximate number of personal data records concerned;

(b)  communicate the name and contact details of the data controller where more information can be obtained;

(c)  describe the likely consequences of the personal data breach;

(d)  describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

4.Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.

5.The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.

6.In the event that a data breach will likely cause a risk to the rights and freedoms of client data, the data controller must communicate the nature of the breach in clear, concise and plain language, to the client/s involved, without delay.

7.If a breach occurs but the data controller has gone to appropriate lengths to protect the data held on the client (e.g. password encryption of electronic files), or if the data controller has taken subsequent action to prevent the risk (e.g. immediately blocking a mobile device) then notifying the client will not be required.

Subject Access Request

A Subject Access Requests (SAR) permits individuals to request a copy of their personal information.

A SAR must be acted upon within one month, at the most within two months, any longer and reasonable reason must be provided. There are no fees unless there is a disproportionate fee to the organisation for sending out the information. Application for SAR should be held alongside session records, unless application was made after six years of the end of treatment. In which case the SAR will be held for a further two years after closure of SAR.

A SAR request will include information we hold about you, Mindbalance will:

  • give you a description of it;
  • tell you why we are holding it;
  • tell you who it could be disclosed to; and
  • let you have a copy of the information in an intelligible form.

SAR requests should be put in writing to Mindbalance. A response may be provided initially informally over the telephone with your agreement, or formally by letter or email. Verification of your identity will be required prior to releasing copies of personal or special category information to you. If any information held is noted to be incorrect an individual can request a correction be made to their own personal information.If you wish for your data to be provided to another service provider, you may also request this in writing.I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to Mindbalance.

Right to Erasure

Any person may put in a request for their personal data to be removed (the ‘right to be forgotten’ or the ‘right to erasure’). In this instance hard copy data will be shredded using a cross shredding machine owned by the organisation and any electronic data will be permanently deleted. The client will be notified of the completion. The request for deletion of data and the confirmation of completion will be held securely until eight years after the request was made. Please be aware that I may have a legal basis to continue to hold your data and will notify you of this if that is the case. Any requests should be made in writing to Mindbalance.


Mindbalance hopes to the meet the highest quality standards when processing personal and sensitive data. These Information Governance Policy documents were created to be as transparent and understandable as possible. However, if you would like further information about a specific process, please contact Mindbalance.

If you feel you would like to make a complaint about how your personal and sensitive data is handled by Mindbalance you can contact Mindbalance directly. In the event that Mindbalance cannot resolve your complaint to your satisfaction you can contact the Information Commissioners Office on 0303 123 1113.

Safeguarding your privacy

In the event of my death or sudden illness, Mr Paul Cutler will contact existing clients and archive any client files in accordance with General Data Protection Regulations.

Request for Information
Request for Erasure