Privacy Policy

Version 2.3 (website edition, based on v2.2 of 24 September 2026) · Effective date: [confirm]

Applies to clients, prospective clients, website visitors, newsletter subscribers and professional contacts.

In plain language

I collect only what I reasonably need to support you and run my practice safely. Anything you share about your health and wellbeing is treated as sensitive and kept private. Marketing consent is always separate from your therapy, and I never use your story or details for marketing without your separate permission. I don’t sell your information.

1. About this policy and the law

Wakeful Journey respects the privacy, dignity and autonomy of everyone who engages with its therapeutic, coaching, educational and digital services. This policy explains how personal information is collected, used, stored, protected and shared, and how you can exercise your rights. It is written mainly with reference to South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA) and, where relevant, the Promotion of Access to Information Act 2 of 2000 (PAIA). Other privacy laws, such as the UK/EU GDPR, may also apply depending on where you live [confirm]. Nothing in this policy limits rights you have under applicable law. For clients, it should be read with the Working Together Agreement and consent records.

2. Who is responsible for your information

Wakeful Journey is the responsible party under POPIA.

Information Officer: Adele Diamond

Email: adele@wakefuljourney.com (please use the subject “Privacy Request”)

Telephone: (+27) 74 524 8671 · (+27) 87 700 5421

Address: 38 Osborne Drive, Salt Rock, KwaZulu-Natal, South Africa [confirm whether to show the full street address publicly or only ‘Salt Rock, KwaZulu-Natal’; POPIA requires contact details, and a postal address or PO Box may be used]

Information Officer registration with the Information Regulator: [confirm registered]

3. Information I may collect

What I collect depends on how you engage with Wakeful Journey, and I keep it to what is relevant and reasonably necessary:

• Identity and contact details: name, preferred name, date of birth, location, time zone, phone number and email.

• Emergency-contact details, and your consent about when that person may be contacted.

• Health and wellbeing information you choose or are asked to share for suitability, safety and session planning, such as physical and mental health, medication, previous care, life experiences, current wellbeing and support network.

• Your goals, preferences, reflections and progress.

• Clinical records I create, such as intake review, session planning, session notes and progress notes.

• Consent and agreement records.

• Booking, package, payment and transaction details. Card details are handled directly by the payment provider (PayPal or PayFast), not stored by me. Invoicing records are kept in QuickBooks.

• Messages, emails and form responses.

• Personalised hypnosis recordings and other resources made for you.

• Website and technical information, such as IP address, browser and device details, cookies (see section 13) and anything you submit through website forms.

• Newsletter details: your first name, email address and your sign-up consent record.

Sensitive information: under POPIA, health information is special personal information. I treat it with extra care, collect only what’s relevant to safe work, and rely on your consent or another lawful authorisation, recording consent where required.

4. How information is collected

• Directly from you: through the free chat, booking, intake and consent forms, check-ins, sessions, email, website forms and the newsletter sign-up.

• From me, through records created during our work together.

• From an emergency contact or healthcare professional, only where you’ve authorised it or where the law permits or requires it for safety.

• From service providers that help with bookings, payments, forms, video sessions, email and the website (see section 9).

• Automatically, when you use the website, through essential cookies and, if you agree, analytics cookies.

Client forms: my client Google Forms (for example intake, consent, pre-session check-in, post-session reflection, ending and welcome-back forms) ask you to type your email address. No Google sign-in is needed. Your email is used to match your responses to your client record. Responses are stored in Google Sheets and may be organised by a Google Apps Script automation that I control. Pre- and post-session forms may be sent around your Zoom sessions.

5. Why I use your information

• To reply to enquiries and see whether Wakeful Journey is a good fit for you.

• To check suitability, consent, safety and scope of practice before and during our work.

• To provide RTT® clinical hypnotherapy, RTC® coaching and other agreed approaches, and to plan and adapt sessions and between-session practices.

• To keep proportionate records and continuity of care.

• To communicate about appointments, follow-up, recordings and support.

• To take payments, issue invoices and keep accounting records.

• To meet professional, insurance, safeguarding, legal and record-keeping duties.

• To keep my systems and the website secure, and to understand how the website is used (analytics, only with your consent).

• To send the free 7-day starter and occasional newsletters, only if you’ve signed up.

Depending on the situation, I rely on your consent, what’s needed to provide the service you asked for, legal obligations, protecting your or someone else’s legitimate interests, or my legitimate interests where POPIA allows. Clinical consent and marketing consent are always separate.

6. Confidentiality and its limits

What you share in sessions is confidential. Confidentiality is not absolute. Information may need to be shared if I reasonably believe there’s a serious risk to you or someone else, if the law or a court requires it, if you’ve asked me to liaise with another professional, or if a service provider needs limited information to do its job. I’ll share only what’s necessary and, where safe and possible, talk with you first.

Forms, emails and messages aren’t monitored around the clock. If you’re in danger or need urgent help, please contact emergency services where you are (in South Africa: SADAG 0800 567 567) rather than waiting for a reply.

7. Personalised recordings

Where agreed, I create personalised hypnosis recordings and practices for you to use between sessions. These are not recordings of the whole session. Full sessions are not recorded unless we both agree in writing about why, how, and how long it’s kept. Your recordings are personal, so please store them carefully and don’t share or publish them.

8. Supervision and referrals

Professional supervision supports safe, ethical practice. Where client work is discussed, I remove or minimise identifying details. With your consent, where appropriate, I may speak with another professional involved in your care. In some safety or legal situations, information may be shared without prior consent where the law permits or requires it.

9. Service providers and international transfers

I use trusted providers to help run my practice. They only get the information they need for their function:

• Google Workspace: email, Drive, Calendar, Forms, Sheets and Apps Script automation.

• Zoom: online video sessions.

• Acuity Scheduling (Squarespace): online booking, intake questions and appointment reminders [confirm].

• PayPal: payment processing and refunds in US dollars (via Acuity).

• PayFast (South Africa): payment processing and refunds in rand [confirm current operator and terms].

• Squarespace: website hosting, website forms and essential cookies [confirm].

• Google Analytics 4: website usage statistics, only with your cookie consent [confirm, or remove if analytics are switched off].

• Email marketing provider for the free starter and newsletter: [confirm, e.g. Squarespace Email Campaigns or MailerLite].

• formsubmit.co: form delivery for the movement assessment form [confirm if kept; recommended to replace with a Squarespace form].

• QuickBooks: invoicing and accounting data only.

• [confirm any others, e.g. WhatsApp for support messages or a backup service]

Some of these providers, including Google, Zoom, Squarespace/Acuity and PayPal, store or process information outside South Africa (for example in the United States or EU). Where information is transferred across borders, I rely on a basis permitted by POPIA section 72, such as adequate protection in the recipient country, contractual safeguards, your consent, or what’s needed to provide the service you asked for. I don’t sell personal information.

10. Keeping your information safe

I use proportionate safeguards against loss, misuse and unauthorised access. These include separating client-facing and therapist-only records, using client IDs and pseudonymisation where appropriate, restricting access, using secure features of my providers (such as encryption and two-step sign-in [confirm]), collecting only what’s needed, and human review of sensitive information. No system can be completely secure, but I take this responsibility seriously.

11. How long I keep information

I keep information in identifiable form only as long as reasonably needed, subject to legal, professional, insurance, accounting and safeguarding requirements. My professional indemnity insurance requires accurate records of professional services to be kept for at least 10 years from the date of treatment [confirm on each renewal].

• Clinical records (session notes, suitability and risk notes, session plans, recording records where kept): 10 years from the relevant session.

• Consent and agreement records: 10 years from the last related session or agreement.

• Client contact details after our work ends: 10 years from the last session, then deleted or fully de-identified.

• Form responses: kept in line with the clinical and consent periods above, or de-identified earlier if a complete record is kept elsewhere.

• Accounting and invoicing (QuickBooks): 5 years from the relevant tax return (Tax Administration Act 28 of 2011, s29), longer if an audit or dispute is ongoing.

• Enquiries from people who don’t become clients: [confirm, e.g. 12 months].

• Newsletter subscribers: until you unsubscribe, then a minimal suppression record so you aren’t emailed again [confirm].

• Website analytics: according to the retention setting in Google Analytics [confirm, e.g. 14 months].

• De-identified reflective material: may be kept for professional learning, without re-identification.

If you ask me to delete information, I may not be able to delete everything immediately where I’m legally, professionally or contractually required to keep it. I’ll explain why where appropriate.

12. Your rights

Under POPIA and PAIA, you can ask whether I hold your information and request a copy; ask me to correct or update it; ask me to delete it where I’m no longer allowed to keep it; object to certain processing, including direct marketing; withdraw consent at any time (this doesn’t affect earlier lawful processing); and complain to the Information Regulator. I may need to verify your identity first. To make a request, email adele@wakefuljourney.com with the subject “Privacy Request”. I’ll respond within a reasonable time [confirm, e.g. 30 days]. My PAIA manual is available on request [confirm].

13. Website, cookies and emails

Essential cookies keep the website and booking working and secure. With your permission, analytics cookies (Google Analytics) help me understand which pages are helpful. You can accept or decline these in the cookie banner and change your mind at any time using ‘Cookie settings’ in the footer [confirm the Squarespace cookie banner is switched on with opt-in for analytics].

If you sign up for the free 7-day starter, I’ll send you that series and occasional newsletters. Every email has an unsubscribe link, and I’ll never share your email with other marketers. Booking a session doesn’t sign you up for marketing.

Testimonials: I’ll never publish your story, quote, image, recording or any health information without a separate, written permission, which you can decline or withdraw without affecting our work together. No photos of clients are used on this website.

14. Automation and AI

I use digital tools, such as Google Apps Script that matches form responses by email, to help with administration. They don’t replace my professional judgement. I don’t put identifiable client material into general-purpose AI tools for marketing or content creation, and decisions about suitability, risk and your sessions are always made by me, a human.

15. If something goes wrong

If I become aware that personal information may have been lost, accessed or disclosed without authorisation, I’ll act quickly to contain and assess it and reduce any risk. Where POPIA section 22 requires, I’ll notify the Information Regulator and anyone affected.

16. Children

My services and website are for adults. I don’t knowingly collect information from anyone under 18 [confirm].

17. Changes to this policy

I may update this policy when my services, systems or the law change. The version and date at the top show the latest version. If a change significantly affects how existing client information is used, I’ll let you know and ask for consent where needed.

18. Contact and complaints

Please contact me first with any question or concern (details in section 2), so I can put it right.

If you’re still not satisfied, you can complain to the Information Regulator (South Africa): inforegulator.org.za · POPIAComplaints@inforegulator.org.za · 010 023 5200 · toll-free 0800 017 160.