Privacy Policy

This notice explains how Nirvana Therapies uses personal data through this website and its general enquiry form. Separate treatment and client records are not collected through that form. We provide separate privacy information when we collect those records.

Who is responsible for your data?

Nirvana Therapies is the data controller. Email gemma@nirvana-therapies.co.uk or write to Nirvana Therapies, 439 Bolton Road, Darwen, BB3 2JQ.

What we use and why

Enquiries: we use your name, email address, chosen subject, message, submission time and our read status to reply and manage your enquiry. Our lawful basis is our legitimate interest in answering enquiries and running the business. If you ask about booking a treatment, we may also use the information to take steps you request before a contract. You do not have to use the form, but we need its required fields to reply. Please do not include medical details or other sensitive health information.
Website operation and security: technical information can include your IP address, requested page, browser or device details, time and security signals. We use it to deliver the site, diagnose faults, prevent abuse and keep it secure. Our lawful basis is our legitimate interest in operating and protecting the website.
Privacy choices: your browser stores your accepted or rejected analytics choice for 12 months so the site can respect it. This is necessary for the privacy controls to work.
Website administration: authorised administrators use account, session and security information to manage the site. Our lawful basis is our legitimate interest in controlling access.
Public content: we may publish images and related information for a genuine business purpose. If this identifies someone, we use consent where that is the appropriate lawful basis.

Optional analytics

If you accept analytics, Google Analytics and Ahrefs Web Analytics receive information about visits, pages, referrals, general location, browser or device details and interactions. Google may also use online identifiers and set the cookies listed in our Cookie Policy. Ahrefs says its Web Analytics service does not use cookies or retain raw IP addresses.

Our lawful basis is your consent. Analytics does not load before you accept it. You can reject it or withdraw consent at any time through Cookie Settings in the footer. Withdrawal stops further analytics loading and removes the first-party Google Analytics cookies that this site can remove. It does not affect earlier processing.

Our legitimate interests

These interests are answering enquiries people choose to send, running the business website, keeping it accurate and secure, preventing abuse and limiting administration to authorised people. We use only what is reasonably needed for those purposes. We may also use limited information where the law requires it or to establish, exercise or defend a legal claim.

Who receives the data?

Website hosting and security services receive technical request information needed to deliver and protect the site.
Enquiry storage services hold information sent through the form.
Email delivery and the business mailbox receive a copy of each valid enquiry so Gemma can reply.
Administrator sign-in and security services receive the information needed to protect the administration area.
Optional analytics providers: Google and Ahrefs receive analytics information only after you accept analytics.
Website visitors receive content intentionally published on the public website.
Professional advisers, regulators, courts or law-enforcement bodies may receive limited information where this is reasonably necessary for advice, a legal claim or a legal duty.

Social and Messenger links take you to another service only when you click them. That service then handles the visit under its own privacy information.

International transfers

Website enquiry records are stored in the UK. Some providers handle other personal data outside the UK: website hosting and security, enquiry email delivery, administrator sign-in and Google Analytics can involve the United States. The verified arrangements for those services use the UK Extension to the EU–US Data Privacy Framework where it applies, or contracts incorporating the UK International Data Transfer Agreement or UK Addendum.

Ahrefs handles optional analytics through its Singapore company and subprocessors that include services in Singapore and the United States. Its standard terms include a data transfer agreement for customers outside the EEA, but we have not verified it as a UK-approved transfer safeguard. We do not treat ordinary analytics consent as a substitute for a transfer safeguard.

Email us if you want details of the destination and arrangement relevant to your information, or a copy or summary of the applicable safeguard.

How long we keep data

Enquiries: the website record and mailbox copy are kept for no more than 12 months and may be deleted sooner. Information needed for an ongoing client or business matter moves to the appropriate separate record and follows its own retention information.
Email delivery records: these are kept only as needed to deliver and secure the service, meet legal duties and resolve disputes.
Website, security and administrator records: these are kept only as long as needed to operate the service, investigate faults or security incidents, meet legal duties and control authorised access. Administrator access is removed when it is no longer authorised.
Analytics: Google Analytics keeps user and event data for 14 months, and its first-party cookies can last up to two years. Ahrefs says it does not retain raw IP addresses. Aggregate Ahrefs reports are kept while we use the service and their need is reviewed at least annually.
Privacy choice: the record in your browser lasts for 12 months unless you change it sooner or clear browser storage.
Public content: images and related information are kept while current and supported by the relevant lawful basis.

Your rights

Depending on the circumstances, you may ask for access to your personal data, correction, erasure, restriction of use or a portable copy. You can withdraw analytics consent through Cookie Settings. We do not make solely automated decisions about website visitors that have legal or similarly significant effects. You can also complain to the Information Commissioner's Office.

Your right to object

You can object at any time to our use of your personal data based on legitimate interests. We will stop unless we have compelling reasons to continue that override your interests, rights and freedoms, or the information is needed for a legal claim.

To exercise a right or ask a privacy question, email gemma@nirvana-therapies.co.uk. We may need enough information to verify your identity and find the relevant record.

Cookies and the map

Our Cookie Policy explains browser storage and analytics choices. The contact page shows a map image hosted by this website using OpenStreetMap road data. Viewing it does not contact Google Maps or OpenStreetMap. Clicking the map image or the separate Open in Google Maps link opens Google Maps in a new tab, where Google handles the visit under its own privacy information.

Last updated: 23 September 2026