Privacy Notice

This notice explains what personal information I collect through chrismurrayhypnosis.com and in the course of working with clients, why I collect it, how I keep it safe, and the rights you have over it. I have tried to write it in plain English. If anything is unclear, please email me.

Who I Am

I am Christopher Murray, a cognitive hypnotherapist trading as Chris Murray | Precision Hypnosis, based in Galle, Sri Lanka and working with clients worldwide. I am the data controller for the personal information described in this notice, which means I decide how and why it is used.

Because I offer my services to people in the United Kingdom and my client agreement is governed by the laws of England and Wales, I follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

You can contact me about anything in this notice at [email protected].

The Contact Form

When you use the contact form on the homepage, I receive your name, your email address, the topic you choose under "What brings you here?" and anything you write in the message box. I use this only to reply to you and to arrange a free consultation if you want one.

The form is processed by Formspree, a form-handling service that delivers your message to my email inbox. Formspree acts on my behalf and stores submissions in line with its own privacy policy.

Please do not include detailed health information in the contact form. If you do mention something about your health, I will treat it as confidential and use it only to respond to your enquiry. We can discuss details properly in a consultation.

Website Analytics and Cookies

The homepage uses the HubSpot tracking code to help me understand how visitors use the site, for example which pages are visited and how people arrive. HubSpot sets cookies in your browser to do this, including:

__hstc: the main cookie for tracking visitors, which HubSpot says expires after six months.
hubspotutk: keeps track of a visitor's identity, expiring after six months. If you later submit a HubSpot form, such as the newsletter sign-up, this can link your earlier visits to your email address.
__hssc: keeps track of sessions, expiring after 30 minutes.
__hssrc: helps determine whether you have restarted your browser, expiring at the end of the session.

These cookies are not strictly necessary for the site to work, so under PECR I ask for your consent before setting them, through the cookie banner shown on your first visit. You can change your choice at any time using the Cookie settings link at the bottom of the homepage, and you can also block or delete cookies in your browser settings. HubSpot's own privacy policy explains how it handles data.

If you sign up for my newsletter, I will collect your email address and a record of when and how you gave consent. The newsletter will be sent using HubSpot, which also records whether emails are opened and which links are clicked, so that I can see what readers find useful.

I will only send you the newsletter if you have actively opted in. Every email includes an unsubscribe link, and you can also email me to be removed. Unsubscribing does not affect any other relationship we have.

The Course Waitlist

If you join the waitlist on the Courses page, I will collect your email address, the courses you picked and whether you also asked for the newsletter. This is stored in HubSpot. I will only use it to tell you when those courses open, and I will only send you the newsletter if you ticked that box. Every email includes an unsubscribe link.

The Client Portal and Your Health Information

Before we begin working together, I ask clients to create an account in the client portal and complete a confidential intake form. The portal is built on Google Firebase: Firebase Authentication manages your login, and Cloud Firestore stores your form.

The intake form asks for:

your name, date of birth, nationality or location, email address and mobile or WhatsApp number
the name and contact number of your next of kin, and your GP or doctor if applicable
information about your physical and mental health, including any diagnoses, relevant mental health history, prescribed medications and whether you have epilepsy
what brings you to hypnotherapy, what you have tried before and what success would look like
your answers to an optional NLP preference questionnaire, your agreement to the client terms, and your marketing preference

Information about your health is special category data under UK GDPR and needs extra protection. I collect it because I need it to work with you safely and responsibly: for example, to know whether hypnosis is appropriate for you, whether you are under the care of another professional, and when I may need to suggest medical support.

Your password is handled by Firebase Authentication, and I never see it. Your intake form is stored against your own account, and access to client records is limited to me: no one else working on the website can view them.

I also keep session notes, which may contain health information. These are kept securely and confidentially in line with professional guidelines, and you can ask to see them.

Sessions, Messages and Payments

Online sessions take place by video using Zoom, Google Meet, Microsoft Teams or WhatsApp video, depending on what suits you. Each of these services processes the call under its own privacy terms. Sessions are only recorded with your prior written permission, as set out in the client agreement. If we agree to record a session, the recording is shared only with you and stored securely.

If your package includes WhatsApp check-ins, our messages will be handled by WhatsApp, which is end-to-end encrypted. I use email for session-related correspondence.

Payments are made by bank transfer or an invoiced payment link. Your bank or the payment provider processes your payment details. I keep records of invoices and payments for tax purposes.

Lawful Bases

UK GDPR requires me to have a lawful basis for each use of your data. These are the bases I rely on:

Replying to enquiries and arranging a consultation: taking steps at your request before entering into a contract, and my legitimate interest in responding to people who contact me.
Providing sessions, managing your account and keeping client records: performance of our contract.
Health information in the intake form and session notes: your explicit consent, which you give when you complete the intake form. You can withdraw consent, but I may then be unable to continue working with you safely, and I may need to keep some records for the reasons set out under retention.
Contacting your GP or next of kin when clinically necessary: only with the permission you give on the intake form, or where there is a serious risk of harm to you or others.
Invoices and financial records: legal obligation, to meet tax requirements.
Verifying practice hours with my professional bodies: my legitimate interest in maintaining my professional registration.
Analytics cookies: your consent, as required by PECR.
The newsletter and information about future programmes or publications: your consent, as required by PECR for electronic marketing. You can withdraw it at any time.

I do not sell your data, and I do not share it with anyone for their own marketing. I share it only where necessary:

with the service providers described above (Formspree, HubSpot, Google Firebase, my email provider, the video platform we use, WhatsApp and payment providers), who process it on my behalf or as part of providing their service
with the National Council for Hypnotherapy (NCH) and the Quest Cognitive Hypnotherapy Practitioners’ Association (QCHPA), to verify practice hours, which may involve your name, email and session dates
with clinical supervisors and peer-support groups, using anonymised case material only
with your GP or next of kin, only as described above
where the law requires it, for example under a court order, or where there is reasonable cause to believe that not disclosing would result in serious harm to you or others

International Transfers

I am based in Sri Lanka, and some of the services I use store or process data in the United States and other countries outside the UK. Where personal data is transferred outside the UK, I rely on the safeguards those providers offer, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or, where a provider is certified, the UK Extension to the EU-US Data Privacy Framework.

How Long I Keep Data

Enquiries that do not lead to working together: 12 months from our last contact, then deleted.
Client records, intake forms and session notes: 8 years after our last session, in line with professional guidelines, then securely deleted.
Financial records: as long as tax law requires, usually 6 years.
Course waitlist: until the courses you picked have opened and you have been told, or until you unsubscribe, whichever comes first.
Newsletter: until you unsubscribe. After that I keep only your email address on a suppression list, so that you are not contacted again.
Analytics cookies: for the periods described above.

Your Rights

Under UK GDPR you have the right to:

ask for a copy of the personal data I hold about you
ask me to correct data that is inaccurate or incomplete
ask me to delete your data, where there is no overriding reason for me to keep it
ask me to restrict how I use your data, or object to my using it
ask for your data in a portable format, where this applies
withdraw consent at any time, where I rely on consent

To use any of these rights, email [email protected]. I will respond within one month. There is normally no charge.

If you are unhappy with how I have handled your data, please tell me first so that I can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint. If you live outside the UK, you may also be able to complain to the regulator in your own country.

Changes and Contact

I may update this notice when the way I work changes, for example when the newsletter launches. The date at the top shows when it was last updated.

Questions about privacy are welcome. Email [email protected].

Last updated: 21 October 2026.