Privacy Notice

Last updated: 2026

1. Introduction

Epiphany Therapy is committed to protecting your privacy and handling your personal information fairly, lawfully and transparently.

This Privacy Notice explains what personal data we collect, why we collect it, how we use it, how we keep it secure, and your rights under UK data protection law.

By using our services, website or contacting us, you acknowledge that we may process your personal information as described in this notice.

2. Data Controller

The data controller responsible for your personal information is:
Nika Nazarova-Evans
Email: anna@epiphanytherapy.co.uk
Telephone: 07498271360

ICO Reference: ZB589150

If you have any questions about this Privacy Notice or how your data is handled, please contact us using the details above.

3. What Information We Collect

We may collect and process the following categories of personal information:

Identity and Contact Information

  • Full name

  • Address

  • Email address

  • Telephone number

  • Date of birth

  • Emergency contact details

Health and Therapy Information

As part of providing RTT® and hypnotherapy services, we may collect:

  • Medical history

  • Physical and mental health information

  • Current medications

  • Details of symptoms or issues you wish to address

  • Lifestyle information relevant to therapy

  • Session notes and treatment records

Website Information

When you visit our website, we may collect:

  • IP address

  • Browser type

  • Device information

  • Website usage data

  • Cookie information

4. Special Category Data

Because RTT® and hypnotherapy services involve discussing health and wellbeing, we may process special category personal data, including information relating to your physical and mental health.

We only process this information where permitted by UK data protection law and where it is necessary to provide therapeutic services.

5. Why We Use Your Information

We use your personal information to:

  • Respond to enquiries.

  • Book and manage appointments.

  • Provide RTT® and hypnotherapy services.

  • Maintain clinical records.

  • Deliver session recordings and therapeutic materials.

  • Communicate with you regarding your treatment.

  • Manage payments and accounting records.

  • Comply with legal and regulatory obligations.

  • Protect our legal rights where necessary.

  • Improve our website and services.

6. Lawful Bases for Processing

We process personal information under one or more of the following lawful bases:

Contract

Processing is necessary to provide the services you have requested.

Legitimate Interests

Processing is necessary for the legitimate operation of the business, provided your rights do not override those interests.

Legal Obligation

Processing is necessary to comply with applicable legal or regulatory obligations.

Explicit Consent

Where required by law, we will obtain your explicit consent before processing certain categories of information.

Provision of Health Services

Where we process health-related information in connection with therapeutic services.

7. Who We Share Information With

We treat your information confidentially.

We may share your information only where necessary with:

  • Regulatory authorities, courts or law enforcement agencies where legally required.

We will never sell your personal information.

8. Confidentiality and Professional Standards

We understand the sensitive nature of the information shared during RTT® and hypnotherapy sessions and take confidentiality seriously.

Information disclosed during therapy sessions will be treated as confidential and will not be shared with third parties without your knowledge, unless:

  • You have given your consent;

  • Disclosure is required by a court order or regulatory authority;

  • There is a serious risk of harm to you or another person;

  • Disclosure is necessary to safeguard a child or vulnerable adult.

Where professional supervision is used to support safe and effective practice, client information will only be discussed on a confidential basis and identifying details will be minimised wherever possible.

9. How We Keep Your Information Secure

We take appropriate technical and organisational measures to protect personal information, including:

  • Password-protected systems and devices.

  • Secure storage of electronic records.

  • Restricted access to client information.

  • Secure email and file-sharing practices.

  • Appropriate data retention and disposal procedures.

Although we take reasonable steps to protect your information, no method of transmission or storage can be guaranteed to be completely secure.

10. How Long We Keep Information

We only retain personal information for as long as necessary.

As a general guide:

  • Client records may be retained for up to 8 years following the end of therapy services.

  • Financial records may be retained for up to 6 years to comply with tax and accounting requirements.

Records will then be securely deleted or destroyed unless a longer retention period is required by law.

11. Your Data Protection Rights

You have the right to:

Access

Request a copy of the personal information we hold about you.

Rectification

Request correction of inaccurate or incomplete information.

Erasure

Request deletion of your information where applicable.

Restriction

Request that processing of your information be restricted.

Objection

Object to certain types of processing.

Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Not all rights apply in every circumstance and certain legal exemptions may apply.

12. Subject Access Requests

You may request access to the personal information we hold about you at any time.

Requests should be made using the contact details provided above, in section 2.

We may request proof of identity before disclosing information.

We will respond within 30 days.

13. Right to Complain

If you have concerns about how your personal information has been handled, please contact us first and we will do our best to resolve the matter promptly. If you are unhappy with our response, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.

Information Commissioner's Office (ICO)
Website: Check if you can complain | ICO
Telephone: 0303 123 1113

Making a complaint to us first does not affect your right to then complain to the ICO.

14. Cookies

Our website may use cookies and similar technologies to improve functionality, analyse website usage, and enhance user experience.

You can control cookie settings through your browser preferences.

15. Automated Decision Making

Epiphany Therapy does not make any decisions about individuals based solely on automated processing.

16. Changes to This Privacy Notice

We may update this Privacy Notice from time to time in accordance with ICO regulations.