Privacy Policy

This policy explains how Bliss Hypnotherapy (“Bliss”, “we”, “us”) handles personal information. We are an Australian practice and handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information we collect

• Account and booking details — your name, email address and phone number, along with the session type, time and any message or subject you add when you book.
• Session and health information — the notes your practitioner keeps about your sessions. Because hypnotherapy is used for wellbeing, these notes (and what you write in your booking message) may include health information, which is sensitive information under the Privacy Act.
• Payment information — the fact and amount of a payment, the Stripe payment reference and refund history. Card numbers are handled by Stripe and never reach our servers.
• Technical information — IP address, browser user-agent and session identifiers, needed to keep your account secure and to prevent misuse of the booking system. See our Cookie Policy.
• Communications — emails or messages you send us, and the transactional emails we send you (confirmations, reminders, payments and refunds).

2. How we use your information

• to create and manage your account and bookings;
• to deliver confirmations, reminders and other service messages;
• to take payment and process refunds;
• to provide your practitioner with the context needed to run your sessions;
• to keep clinical records as required for a health service;
• to protect the service against spam, fraud and abuse;
• to meet our legal and accounting obligations; and
• to respond to your enquiries and complaints.

We do not sell your personal information, and we do not use it for advertising. We only send marketing messages if you have asked for them, and you can opt out at any time.

3. Consent

We collect and use your information with your consent, which you give by creating an account and booking a session. You can withdraw consent at any time, but we may not be able to continue providing a service without the information that makes it possible.

4. Who we share it with

We share personal information only with service providers that help us run the practice, and only so they can provide their service to us:

• Stripe — payment processing and refunds.
• Resend — delivery of transactional email (such as your sign-in link).
• Vercel — website hosting.
• Turso — database hosting.
• Upstash — rate limiting and short-lived infrastructure data.
• Google — embedded YouTube video, served from youtube-nocookie.com.

We may also disclose information where the law requires it, to protect someone from serious harm, or in connection with the sale or reorganisation of the practice. Your practitioner may be required to break confidentiality in limited circumstances (for example, a serious risk to you or another person). Those limits are set out in our Terms & Conditions.

5. Overseas storage

Some providers store data outside Australia, including in the United States. Before using a provider we take reasonable steps to confirm it handles data consistently with the APPs, and we remain responsible for the information we hold.

6. How long we keep information

Clinical records are kept for at least seven years from the last entry for adults, and for longer for clients who were minors when the record was made, in line with Australian health-records guidance. Account and booking records are kept while your account is active and for as long as needed for our legal, tax and record-keeping obligations. Technical and security logs are kept for shorter periods.

7. Security

We use HTTPS for all traffic, keep passwords and keys out of the codebase, restrict who can access records, and rely on Stripe for card processing. If we become aware of a data breach that is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

8. Access, correction and deletion

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete information we are not required to keep. Email hello@bliss-therapy.com and we will respond within a reasonable period, usually within 30 days.

9. Complaints

If you are concerned about how we have handled your information, contact us first so we can try to resolve it. If you are not satisfied, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

10. Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it last changed. If a change is significant, we will take reasonable steps to let you know.