Privacy Policy

Last updated: September 2026

What is the purpose of this policy?

I recognise that you trust me with your personal information and I take my data protection responsibilities seriously. This privacy notice explains how I handle any personal information about you, what I do with your information, why, and what rights you have. I have tried to keep it plain. If anything here is not clear, please ask me.

If we work together, this notice sits alongside the written contract we agree at the start — the therapy contract, or the supervision or group contract. Those set out confidentiality and the practical arrangements between us. This notice explains what happens to your information.

1. Who I am

I am Robert Garrett. I work as a Sole Trader under my name, beyondmasking@hotmail.com. I offer one-to-one therapy sessions which are provided online via Teams.

I also work as an addiction therapist at a third sector addiction agency.

The company is the data controller for the information held about you. That means it is responsible for deciding how your information is held and used, and accountable for looking after it. In practice, I am the only person who sees it, apart from the people named in section 7.

  • Registered name: Robert Garrett

  • Registered in Scotland, company number

  • Email: beyondmasking@hotmail.com

  • Text or WhatsApp: 07584 133929

  • My UKCP registration as a psychotherapist:

  • ICO registration: ZB956302

  • BACP Membership No: 01030995

  • PPS Insurance: US18984

Email or WhatsApp is the best way to reach me about anything in this notice.

2. Who this notice is for

This notice covers everyone I hold information about in the course of my work:

  • people who contact me but do not go on to become clients or supervisees

  • individual psychotherapy clients

  • people who come for specialist consultation

  • people who have signed up to my mailing list

Where something applies only to one of these groups, I have said so.

3. What information I hold

When you first get in touch, I hold your name, email address, phone number and whatever you choose to tell me about what is bringing you to therapy, supervision or a group, together with the messages between us. If you do not go on to work with me, I delete this after six months.

If you are a psychotherapy client

I also hold:

  • notes of our sessions — I keep these brief, and I use reasonable efforts not to include information that would identify you

  • a short record of your name, email address, phone number, GP details, and the number of sessions we have had

  • emails and messages between us, and appointment details

  • a record of payments and invoices

Much of what you tell me in therapy is what data protection law calls special category information. This is information that needs extra protection — for example, your health and mental health, your ethnicity, your religious or philosophical beliefs, your sexual orientation, your gender identity, and your relationships. You are not obliged to tell me any of it. It comes up because it is part of the work.

Your notes may also mention other people — a partner, a family member, a colleague. I keep what I record about them to the minimum needed to make sense of our work.

4. Where I get information about you from

Almost always I get this information directly from you: by email, by text or WhatsApp, through the contact form on my website, in sessions, or when you sign up to my mailing list. Occasionally someone is referred to me by a colleague, a training institute or another professional. I only keep that information if we go on to have a professional relationship.

5. Why I use your information, and my lawful basis

Under UK data protection law, I need a lawful basis for everything I do with your information.

  • Arranging and providing therapy, supervision, consultation, groups and workshops, and communicating with you about it: Contract; and for special category information, Article 9(2)(h) UK GDPR with paragraph 2, Schedule 1 of the Data Protection Act 2018 (health or social care purposes, provided by someone under a duty of confidentiality)

  • Keeping clinical records: Contract, and my legitimate interests in practising safely and being able to answer a complaint or claim

  • Discussing my work in my own supervision, as my professional body requires: My legitimate interests in ethical and competent practice

  • Invoicing, payments and tax records: Contract, and legal obligation

  • Sending my newsletter, and letting you know about groups, workshops and waiting list availability: Your consent

  • Corresponding with colleagues about editorial, training and professional work: My legitimate interests in meeting my commitments to the organisations I work with

  • Contacting someone else if I believe you or another person is at serious risk of harm: Vital interests, and where it applies, the safeguarding condition in paragraph 18, Part 2, Schedule 1 of the Data Protection Act 2018

  • Responding to a legal requirement, court order, complaint or claim: Legal obligation, and my legitimate interests in defending legal claims

I do not sell your information, and I do not use it for automated decision-making or profiling. The only marketing I do is my own newsletter, which you have to ask to receive and can stop at any time.

6. How I store and protect your information

Some of my session notes are handwritten and kept securely at home. The rest are electronic, held on my own device rather than in the cloud, in password-protected files on an encrypted device, with two-factor authentication on the accounts I use.

Text and WhatsApp messages are held on my phone, which is passcode-protected. I keep individual messages to practical matters, such as arranging or changing an appointment. Section 3 explains how the WhatsApp groups work.

Online sessions are held on Teams.

Invoices are created using Word and controlled by all the above-mentioned security features.

Your name and contact details only are held for the arrangements described in section 10.

If something goes wrong and your information is lost, disclosed or accessed when it should not be, I will tell you and the Information Commissioner’s Office where the law requires it.

7. Who I share your information with

I will not share your information with anyone else without your consent, except in the situations below.

People I share with in the ordinary course of the work

  • My own supervisor. I discuss my client work in supervision, as my professional body requires. I use first names only and keep identifying detail to a minimum. My supervisor is a registered psychotherapist bound by a professional ethical code.

  • My Clinical Executor, but only if I die or become incapacitated. See section 10.

  • My accountant, who has access to my invoicing and accounting records. They are bound by a confidentiality and data processing agreement, and they see names and amounts, never anything about the content of our work.

People I share with only where I have to

  • Emergency services, your GP, or another appropriate person, if I reasonably believe you or someone else is at serious risk of harm. Wherever it is possible and safe, I will discuss this with you first.

  • A court, or another body I am legally required to disclose to, including under legislation on safeguarding, terrorism or criminal activity.

  • My professional body or insurer, if there is a complaint or claim.

  • My legal advisers, if I need legal advice.

Service providers who handle information on my behalf

These act on my instructions and cannot use your information for their own purposes:

  • Google Workspace: email, calendar and file storage

    Squarespace: my website and its contact form

  • Teams: online sessions

WhatsApp sits slightly differently. It is not acting on my instructions, and Meta holds information about messages sent through it, so I keep what I use it for to a minimum. Section 3 explains this in more detail.

Some of these providers store information outside the UK, including in the United States. Where that happens, the transfer is covered by safeguards approved under UK data protection law, such as the UK International Data Transfer Addendum.

If you are outside the UK

Workshop participants and group members join me from many different countries. Wherever you are, I handle your information in the way this notice describes, and you can contact me about it in the same way. Depending on where you live, your own country’s data protection law may give you additional rights.

8. How long I keep your information

  • Enquiries from people who do not go on to work with me: 6 months

  • Client records: 7 years after our work ends

  • Invoices and financial records: 7 years, to meet tax requirements

  • Emails, texts and WhatsApp messages: deleted in line with the periods above

  • Mailing list details: until you unsubscribe or ask me to stop

  • Contact details held for waiting lists: until you ask me to stop, or one year, whichever is sooner

I keep client records for seven years because my professional body and my indemnity insurer require it, and because I need to be able to show I have acted properly if a complaint or claim is ever made. This means there are periods during which I cannot delete some information even if you ask me to. I will always explain why if that comes up. Anything I no longer have a reason to keep, I delete or destroy securely.

9. Your rights

You have the right to:

  • ask for a copy of the information I hold about you

  • ask me to correct anything inaccurate or incomplete

  • ask me to delete it, in some circumstances

  • ask me to restrict or stop using it, in some circumstances

  • object to how I am using it

  • ask me to transfer it to you or someone else, where that applies

  • withdraw your consent at any time, where I have relied on your consent — for my newsletter, or for keeping you on a waiting list

  • complain, both to me and to the ICO. See section 11

Please make requests by email. I will respond within one month. If I need to ask you for more information before I can deal with your request, that time limit pauses until you reply. Withdrawing consent will not affect the quality of the work between us, although it may affect what I can offer safely and ethically.

10. If I die or become incapacitated

My professional body requires me to have arrangements in place so that clients are not left without support if something happens to me. This is often called a clinical will. I have appointed a psychotherapist as my Clinical Executor, in accordance with UKCP requirements. If I die or become incapacitated, they can access your name, email address and phone number — and nothing else — in order to contact you, let you know what has happened, and help you find support elsewhere. They are bound by the same kind of ethical code and duty of confidentiality that I am.

11. How to complain

If you are unhappy with how I have handled your information, please tell me. You can use the form below, email me at beyondmasking@hotmail.com., or tell me directly. You do not need to use any particular form of words, or call it a complaint. I will:

  • acknowledge your complaint within 30 days

  • look into it without undue delay

  • keep you updated on progress

  • tell you the outcome, and what you can do if you are not satisfied

I keep a record of complaints and how they were dealt with.

You can also complain to the Information Commissioner’s Office at any time, whether or not you have raised it with me first: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113

12. Cookies and this website

My website uses only the cookies it needs to function. I do not use analytics, tracking or advertising cookies of my own, and nothing about your visit is monitored by me. The sign-up form for my mailing list is provided by MailerLite and is embedded in the page. It sets its own cookies. MailerLite explains which ones it uses and what each of them does here. If anything about this changes, I will update this notice first.

13. Changes to this notice

I review this notice at least once a year, and whenever my practice or the law changes. The current version will be on this page.

beyondmasking@hotmail.com. 2026