Published 21 September 2026 · 9 min read · by SuePrise

Data security in the hypnosis practice: GDPR-compliant client data management

Client recordings, session notes, appointment lists — a hypnosis practice accumulates sensitive data quickly. How to secure them GDPR-compliant without cloud risk and without data loss from a hard drive crash? Pragmatic backup workflow for solo practices.

Which data is sensitive

• Client recordings (MP3) — health data per Art. 9 GDPR, highest protection
• Session notes — what was discussed, suggestions, progression
• Appointment and contact lists — name, email, phone, often concern note
• Consent declarations — original signatures must be retained

GDPR requirements — the four pillars

1. Confidentiality: no unauthorised access. Disk encryption, password protection, access controls
2. Integrity: data may not be altered unnoticed. Backup with checksum
3. Availability: data must remain accessible (backups against hardware failure)
4. Deletion obligation: on client request, data deletable within reasonable timeframe (30 days)

3-2-1 backup strategy (industry standard)

3 copies of all important data, 2 different media, 1 off-site:

• Copy 1: original on practice computer (internal SSD)
• Copy 2: daily backup to external USB drive (encrypted)
• Copy 3: weekly backup to second external drive, stored off-site (home or safety deposit)

Recommended backup tools (all local)

• Veeam Agent Free (Windows/macOS)
• Duplicati (cross-platform, open source) — encrypted incremental backups
• Time Machine (macOS, integrated)

Macrium Reflect Free is deliberately not on this list: its maker has discontinued the free version. Security patches were only provided until 1 January 2024, it can no longer be downloaded, and Windows 10 and 11 are only supported up to version 22H2 (vendor notice). On Windows, Veeam Agent Free can also create an image backup of the whole computer.

Disk encryption

• BitLocker (Windows Pro)
• FileVault (macOS)
• VeraCrypt (cross-platform) — container encryption for more sensitive files

Cloud backup — if at all, then GDPR-compliant

If cloud backup is unavoidable: only GDPR-compliant providers with EU servers and client-side encryption:

• Strato HiDrive (DE servers)
• IONOS HiDrive (DE servers)
• Tresorit (CH servers, zero-knowledge encryption)
• NOT: Dropbox, Google Drive, OneDrive without additional client-side encryption — all three are US providers, and your data may end up on servers in the US

Where Hypnotika stores your data

Hypnotika stores all recordings, license data and settings locally on your computer. No cloud sync, no transmission of usage or analytics data. GDPR-compliant by design. Your sessions run without internet; the app only goes online for your license (activation, a check about once a week) and for updates. You need to include both the recording folder and the app-data folder in your backup system — Hypnotika itself doesn't back anything up to the cloud. The recording folder is Documents\Hypnotika Sessions by default; you can change it under Settings → Audio & Hardware → "Session recording (MP3)". If your Documents folder lives in OneDrive (Windows then redirects it there), recordings end up in OneDrive by default as well. Library, presets, history and settings live in the app-data folder %APPDATA%\hypnotika-trancedeck. Back it up while Hypnotika is closed: while the app is running, it writes changes with a delay, so a copy may be incomplete. Hypnotika has no export function for this data.