Date: Last Updated: September 2026

Artificial Intelligence (AI) & Data Privacy Policy

At Paul Matthews Hypnotherapy, your privacy, confidentiality, and emotional safety are my highest priorities. To provide you with the most focused and effective care, I utilise select technology and Artificial Intelligence (AI) tools in my practice.

This policy explains exactly how these tools are used, how your data is protected, and your rights under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

Fathom AI Note-Taker

To ensure I can give you my complete, undivided attention during our online Google Meet sessions, I use an AI meeting assistant called Fathom.

What it does: Fathom securely records and transcribes our conversation, allowing me to generate accurate clinical notes without the distraction of writing while you are speaking.

Your Consent is Mandatory: Because health information is classified as Special Category Data under GDPR, Fathom is only ever activated with your explicit, prior consent. At the beginning of our work together, you will be asked if you are comfortable with this.

Your Right to Opt-Out: You have the absolute right to decline the use of the note-taker at any time, for any session, with no impact on the quality of your care. If you opt out, I will simply take handwritten notes.

Security: Transcripts and recordings processed by Fathom are stored securely, are fully encrypted, and are never sold or used to train public AI models.

Children and young people

Children’s information requires particular care. I do not use Fathom to record under 18 sessions unless its suitability and permitted use for this purpose have been confirmed, and the necessary data protection safeguards and consent arrangements are in place.

Where any AI processing of a young person’s information is proposed, it will be explained in age appropriate language. Their understanding, wishes and applicable parent or guardian involvement will be considered. Parent or guardian permission alone does not remove the need to assess the provider’s terms or the child’s rights.

How AI is Used During Your Sessions

I also use AI as a general administrative and creative assistant. No client data is ever used in these processes.

AI generated images and audio

AI created images are illustrative. They are not presented as photographs of actual clients, genuine testimonials or evidence of treatment results.

I do not use identifiable client photographs, recordings or personal histories to create public promotional images or audio under this policy.

Where I use a synthetic voice or AI generated audio, I make its nature clear. I do not clone a client’s voice.

General educational audio does not require your personal information. If I offer a personalised audio summary, I will explain what information will be used, whether another provider will receive it and how it will be delivered.

Personalised summaries are reviewed before being provided. They support our work together and do not replace individual discussion or appropriate medical advice.

AI-generated or materially altered content is labelled where required by law, including realistic synthetic content that could otherwise be mistaken for an authentic recording or image.

Research and confidentiality

My use of AI for research means supporting reading, learning and preparation. It does not mean enrolling clients in research studies or using their sessions to develop AI models.

I use general questions or genuinely anonymised information wherever possible. Removing a name alone does not necessarily anonymise a personal history.

I do not enter identifiable client information into general-purpose AI research or creative tools under this policy. Any proposed additional use involving identifiable information would require its own assessment, appropriate safeguards and advance explanation to you.

Please avoid identifying other people unnecessarily during recorded conversations. Your consent does not automatically authorise processing someone else’s sensitive information.

Social media content and campaigns

Helping draft and develop some social media posts, captions, images and marketing campaigns. I review and approve this content before publication to check its accuracy, tone and suitability. I do not use identifiable client information, session recordings or transcripts to generate marketing content.

Client testimonials and Google reviews

I sometimes republish genuine Google reviews or client testimonials after obtaining the client’s permission. I agree with the client where their testimonial may appear and how they wish to be identified. Where a testimonial includes health or other sensitive information, I obtain explicit consent to publish those details.

Testimonials reflect clients’ own experiences. I do not use AI to invent testimonials or alter their meaning.

Permission to publish a testimonial does not authorise me to upload it to an AI service. Any proposed AI processing of identifiable testimonial content would require a separate explanation, appropriate safeguards and specific consent beforehand.

Clients may withdraw permission for republication by contacting me. I will remove the testimonial from channels I control without undue delay. This does not delete the client’s original Google review or guarantee removal of copies shared independently by others.

How AI is Used for Practice Administration

No Public AI Training: I will never input your name, contact details, medical history, or identifying personal stories into public generative AI platforms (such as the public version of ChatGPT or Gemini) where the data could be used to train external algorithms.

No AI Decision Making: AI is used solely as an administrative support tool. All clinical decisions, therapy plans, and therapeutic interventions are made entirely by me, relying on over 20 years of human professional experience.

AI training and information security

My policy is not to permit client session content to be used to train general purpose AI models or for optional provider model improvement. I check relevant provider terms and disable optional training or improvement settings before processing client information.

I use appropriate safeguards, including restricted account access, strong authentication, secure devices and controlled sharing. Session recordings and transcripts are not published or made available through unrestricted public links.

Access is limited to me and authorised service providers where necessary to deliver the agreed service, subject to any lawful disclosure obligations explained in my Privacy Policy.

No online service can guarantee absolute security. If a personal data breach occurs, I will assess it and notify the Data Protection Commission and affected individuals where legally required.

What I Will Never Do (My Promise to You)

Subject to the conditions and exceptions in data Vprotection law, you may request:

Access to your personal information.
Correction of inaccurate information.
Erasure of information.
Restriction of processing.
Data portability where applicable.
An objection to processing where the relevant right applies.

You may also withdraw consent to consent-based processing.

Contact me using the details at the beginning of this policy. I normally respond to rights requests within one month. If a lawful extension is necessary, I will explain this within that first month.

You can complain directly to Ireland’s Data Protection Commission at www.dataprotection.ie. You do not have to raise the matter with me first.

Your GDPR Rights

In accordance with the General Data Protection Regulation (GDPR) and Irish professional therapeutic guidelines, we only retain your data for as long as is strictly necessary:

Adults: All clinical notes, AI-generated summaries, and session records are retained securely for 7 years after your final session, after which they are permanently and securely destroyed.
Children & Teens (Under 18): By law, records for minors must be retained until the client reaches 25 years of age (or 26 if they were 17 at the conclusion of therapy), to ensure they have access to their own medical history as an adult.
AI Transcripts (Fathom): The raw audio recordings and transcripts generated by our secure AI note-taker are used solely to create your clinical notes. Once the clinical notes have been accurately documented, the raw AI transcripts are routinely deleted and are not kept for the full 7-year term.

Data Retention: How Long Do We Keep Your Records?

If you have any questions, concerns, or wish to discuss how your data is handled, please do not hesitate to reach out. I am always happy to explain the technology I use to ensure you feel completely safe and supported.

📧 Email: paul@paulmatthewshypnosis.ie 📱 WhatsApp / Phone: +353 87 778 0391

Contact Information

Based in Dublin, providing confidential online hypnotherapy worldwide via Google Meet.
Clinical Hypnotherapist & Nutritional
Therapist specialising in PTSD, anxiety, addictions, and medical hypnotherapy for pain & IBS.
Mission: help 20,000 people reclaim calm, confidence, and control with structured, outcome-tracked programmes.