Privacy & Confidentiality Notice

Who is responsible for your information?

Data controller: Cheryl Jones. Contact: Cheryl@epione-psychotherapy.co.uk. Address: 124 City Road, London, EC1V 2NX.

Information we may hold

• Contact and identity information, including your name, contact details and preferred way of communicating.
• Information you provide in an enquiry, referral, assessment, therapy session, supporter consultation or supervision.
• Health and disability information, including needs linked to conditions such as autism or attention difficulties. We may also need information about safety concerns or other sensitive matters when it is relevant to the support we provide.
• Appointment, correspondence, consent, reasonable-adjustment, payment and invoicing information.
• Clinical records, formulations, goals, outcome measures, care-coordination information and reports where these form part of the service.
• Information supplied by another person or professional about you, including a supporter, referrer, family doctor, employer, occupational health professional or third-party payer.
• Website information generated by the technologies actually used on the live website, as described in Cookie Settings.

Why we use personal information

The table below explains when we may use information. “Legitimate interests” means a reasonable need to run the practice or protect people, after checking that using the information is fair and respects your rights. Health information needs extra legal protection. The rules that apply depend on why we need the information.

Confidentiality and sharing

Information from therapy is not made available to an employer, supporter, referrer or person paying for therapy simply because they are involved in arranging or funding the work. Where information is requested, the purpose, lawful basis, professional duty and the amount of information genuinely needed are considered before anything identifiable is shared.

There are circumstances in which information may need to be shared without your agreement, for example where this is required by law, necessary to protect someone's life or safety, needed to protect someone from harm, or necessary in connection with a legal claim. Where it is safe and lawful to do so, the reason and intended sharing will usually be discussed with you.

When somebody else gives us information about you

We may receive information from another person before or during our work with you. We do not treat the sender as automatically entitled to receive information back.

We record the source and purpose, consider what is relevant, and provide privacy information to you within the required period unless a lawful exception applies. Our Third-Party Information Procedure explains this in more detail.

Services we use to handle information

• Webflow: public website hosting. The current website routes self-referrals to Mayden Bacpac without using a Webflow clinical enquiry form.
• Microsoft 365: email, Teams, OneDrive and SharePoint.
• Mayden Bacpac: clinical records.
• FreeAgent: accounting and invoicing.
• Bilateral Base: video used for appropriate clinical work.

These providers have their own legal responsibilities and contracts. Where they handle personal information for us, we check their privacy and security arrangements, any other companies they use, and whether information may be handled outside the United Kingdom. We do not assume that all information stays in the United Kingdom unless we have checked.

Plausible Analytics provides aggregate website statistics, including page visits and the use of referral or enquiry links. It does not place analytics cookies or receive the contents of clinical enquiry forms. Plausible processes website analytics information in the European Union. Visitors can exclude their visits using the control on our Cookie Settings page.

Recordings and transcripts

Clinical or supervision recordings are made only where there is an identified professional purpose and the required information and agreement have been provided.

Supervision recordings and transcripts are normally reviewed within 30 days, after which they are deleted from active systems and recovery locations under our control where practicable, unless a professional or legal requirement justifies retention. The enduring professional record is retained separately under the Master Retention & Disposal Schedule.

How long we keep information

We use a Master Retention & Disposal Schedule rather than keeping everything for the same period. Clinical records are ordinarily retained for seven years after the end of the work, subject to any longer period justified by professional, legal, the need to protect people from harm or special rules for children and young people.

Enquiries that do not proceed, complaints, accounting records, recordings and website information have different periods. Information is deleted or anonymised earlier where there is no continuing need to identify the person.

Your rights

• To be informed about how your information is used.
• To ask for access to personal information we hold about you.
• To ask for inaccurate information to be corrected.
• To ask for erasure or restriction where the legal conditions are met.
• To object, in the circumstances allowed by law, when we use your information for our legitimate interests (our reasonable needs in running the practice, balanced against your rights).
• To receive a copy of information you provided in a format that allows you to move it to another service, where the law gives you that right.
• To challenge certain important decisions made about you by a computer without meaningful human involvement, where the law gives you that right. Ēpiónē does not use computer systems alone to make decisions about your clinical care.

Some rights are qualified. For example, information may need to be withheld where disclosure would adversely affect another person’s rights, where an exemption applies, or where information must be retained for legal or professional reasons.

Questions, concerns and complaints

Please contact Cheryl Jones at Cheryl@epione-psychotherapy.co.uk if you want to exercise a right to access or control your personal information or ask how your information has been handled. The Concerns & Complaints page explains the practice route. You may also complain to the Information Commissioner’s Office.

More information about the law

Information Commissioner’s Office. Right to be informed

Information Commissioner’s Office. Legitimate interests

Information Commissioner’s Office. Storage limitation

When we provide clinical supervision

Clinical supervision is a separate service. The supervisee is the person receiving the service and we may hold their contact information, supervision agreement, professional background, areas of practice, reflective material, supervision notes, agreed actions, feedback on clinical work and information needed for professional or accreditation requirements.