Privacy policy
Beyond the Mind UK
Data Controller: Nikita Sharma
Email: nikita@beyondtheminduk.com
Business telephone/WhatsApp: 07427 246 606
Last reviewed: October 2026
Information I Collect
Your privacy and confidentiality are important to me. This notice explains what personal information I collect as part of my therapeutic practice, why I need it, how it is stored and protected, when it may need to be shared, how long it is retained and your rights in relation to your information.
I, Nikita Sharma, sole trader of Beyond the Mind UK, am the Data Controller responsible for the personal information collected and processed within my private practice.
I am an accredited hypnotherapist and a student psychotherapist undertaking UKCP training. I work in accordance with the professional, ethical and confidentiality requirements applicable to my practice and training.
If you enquire about therapy
If you contact me to enquire about therapy, I may collect:
Your name.
Your telephone number and/or email address.
Information you provide through email, telephone, text message, WhatsApp Business or another agreed method of communication.
Brief information about what you are seeking support with.
Information needed to arrange an initial consultation or appointment.
If you decide not to proceed with therapy, I will only retain your information for as long as reasonably necessary for administrative, professional or legal purposes.
If you become a client
If you book and attend therapy with me, I may collect and retain:
Your name, date of birth and contact details.
Emergency contact details, where appropriate.
Relevant GP or healthcare information, where appropriate.
Information provided during your initial assessment and subsequent sessions.
Information relating to your physical and mental health, wellbeing, personal circumstances and therapeutic goals.
Relevant personal history that you choose to share as part of therapy.
Appointment dates and attendance records.
Clinical/session notes.
Records of therapeutic approaches or interventions used where relevant.
Relevant emails, text messages and WhatsApp Business communications between us.
Information provided by relevant third parties, such as a GP, healthcare professional, insurer, EAP or occupational health provider, where applicable.
Payment, invoicing and transaction information.
Consent forms, assessments and other documents relevant to our therapeutic work.
I aim to collect only the information that is reasonably necessary to provide therapy safely and effectively and to meet my professional, legal and administrative responsibilities.
Why I use your information
I use personal information where necessary to:
Respond to enquiries about therapy.
Assess whether my service is appropriate for you.
Provide and manage therapy.
Maintain appropriate and accurate clinical records.
Arrange, confirm, cancel or rearrange appointments.
Communicate with you about your therapy.
Maintain records of consent and assessment.
Manage payments, invoices and business records.
Meet professional, ethical, insurance and legal requirements.
Maintain appropriate clinical supervision.
Respond appropriately to safeguarding concerns or serious risks to you or another person.
Establish, exercise or defend legal claims where necessary.
I do not use your therapeutic information for marketing, sell client information to third parties, or use automated decision-making or profiling in relation to clients.
Lawful basis for using your information
UK data protection law requires me to have a lawful basis for processing your personal information.
Depending upon the particular information and the reason it is being processed, this may include:
Contract – where processing is necessary in order to provide the therapeutic service you have requested or to take steps at your request before entering into our therapeutic agreement.
Legitimate interests – where information is reasonably necessary for the safe, effective and appropriate operation of my private practice, provided that these interests do not override your rights and freedoms.
Legal obligation – where I am required to process or retain information in order to meet a legal requirement.
Vital interests or other appropriate lawful grounds – in limited circumstances, such as where information needs to be processed in connection with a serious and immediate risk.
Some information disclosed during therapy is considered special category data under UK data protection law. This can include information concerning your physical or mental health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation or sex life.
Where I process special category information, I will only do so where an appropriate condition under UK data protection legislation applies and where the processing is necessary for the provision of my therapeutic services, professional practice, safeguarding, legal claims or another appropriate purpose.
How your information is stored - Sessionly
Sessionly is my main electronic practice-management and clinical record system.
Your Sessionly record may contain:
Contact information.
Assessment information.
Consent forms.
Appointment records.
Clinical/session notes.
Relevant correspondence.
Relevant documents relating to your therapy.
My Sessionly account is managed by me and access is restricted to me. It is protected using a strong, private password and appropriate security measures.
Where a text message, WhatsApp Business message or email contains information that is relevant to your therapy, safety, appointments or therapeutic relationship, an appropriate record of the communication may also be entered into your Sessionly record.
Not every routine administrative message will necessarily be copied into your clinical record.
Handwritten notes
I may take handwritten notes during or immediately following a therapy session.
These notes are kept securely in a locked cabinet when not in use and are not left accessible to other people.
Where appropriate, relevant information from handwritten notes may subsequently be recorded within your secure Sessionly client record.
Any handwritten records retained as part of your clinical record will be stored securely and disposed of confidentially when they are no longer required.
WhatsApp Business and telephone communication
Beyond the Mind UK uses a dedicated business telephone number and WhatsApp Business account, separate from my personal telephone number.
WhatsApp Business may be used for:
Initial enquiries.
Arranging appointments.
Appointment reminders or changes.
Brief administrative communication.
Other appropriate communication agreed between us.
Relevant messages may be documented within your Sessionly record where they form an important part of your therapeutic or administrative record.
My business device is protected by appropriate security measures, including a passcode and/or biometric security where available.
WhatsApp is provided by a third-party service and therefore operates under its own privacy and data-processing arrangements. Although reasonable steps are taken to protect your information, no electronic communication method can be guaranteed to be completely secure.
For this reason, WhatsApp is primarily intended for appropriate and brief communication rather than extensive therapeutic discussions or emergency support.
My main business email address is:
This is used for appropriate business and client communication.
Access to my email account and the devices used to access it is password protected.
Where an email contains information relevant to your therapy or clinical record, an appropriate record may also be stored within Sessionly.
Social media
Beyond the Mind UK may maintain professional social media accounts for marketing and educational purposes.
Social media is not intended to be used for therapeutic communication or the discussion of confidential clinical information.
If you contact me through social media regarding therapy, I may ask you to continue the conversation through my business email, telephone number or WhatsApp Business account.
I will not publicly acknowledge that you are or have been a client.
Payments and financial information
I may retain records of payments, invoices and transactions where necessary for accounting, taxation and business administration.
If you make a payment by bank transfer or through another payment provider, the relevant financial institution or payment provider will also process information relating to that transaction under its own privacy arrangements.
I do not routinely hold full debit or credit card details.
Financial information provided to an accountant or other professional service provider will be limited to information reasonably necessary for accounting, taxation and legal purposes.
Confidentiality and sharing information
Information discussed during therapy is treated as confidential.
I will not normally share your personal or therapeutic information with another person or organisation without your knowledge or agreement.
There are, however, limited circumstances where confidentiality may need to be broken or information disclosed. These may include:
Where I believe there is a serious or immediate risk of harm to you or another person.
Where there are safeguarding concerns relating to a child or an adult at risk.
Where disclosure is required by law.
Where disclosure is required by a court or other lawful authority.
Where information is necessary for the establishment, exercise or defence of a legal claim.
Where communication with your GP or another healthcare professional is considered appropriate and there is an appropriate basis for doing so.
Where information must be processed by a service provider used in operating my practice, such as my practice-management, payment or accounting services.
Where reasonably possible and appropriate, I will discuss a disclosure with you before information is shared.
There may, however, be circumstances where this is not possible or appropriate, particularly where informing you could increase a safeguarding risk or where I am legally prevented from doing so.
Only information that is reasonably necessary will be disclosed.
Clinical supervision
Clinical supervision is an important part of safe and ethical therapeutic practice.
I attend regular professional supervision and may discuss aspects of my client work with my clinical supervisor.
Wherever reasonably possible, identifying information is minimised and only information relevant to the supervision of my therapeutic work is discussed.
My clinical supervisor is also bound by professional confidentiality requirements.
How long your records are kept
Clinical records relating to clients will generally be retained for a minimum of seven years following the end of therapy, in line with my professional and insurance requirements.
Certain circumstances may also require records to be retained for longer, for example where this is necessary to meet professional or insurance requirements or for the establishment, exercise or defence of legal claims.
Information relating only to an initial enquiry where therapy does not proceed may be retained for a shorter period.
Information will not be kept for longer than is reasonably necessary for the purpose for which it is held.
At the end of the relevant retention period, electronic records will be securely deleted and paper records will be confidentially destroyed.
Keeping your information secure
I take reasonable and proportionate steps to protect personal and clinical information held by Beyond the Mind UK.
These include:
Using Sessionly as my main electronic clinical record system.
Protecting Sessionly with a strong, private password.
Keeping handwritten notes in a locked cabinet.
Using a dedicated business telephone number and WhatsApp Business account.
Protecting relevant devices and accounts with passwords, passcodes and/or biometric security.
Limiting access to client information.
Keeping client information outside the main clinical record system to a minimum.
Maintaining appropriate security practices when communicating electronically.
Securely deleting electronic information and confidentially destroying paper information when it is no longer required.
No electronic system can be guaranteed to be completely secure, but reasonable precautions are taken to protect your information against unauthorised access, accidental loss, disclosure or misuse.
Data breaches
If a personal data breach occurs, I will assess the nature of the breach and the potential risk to the people affected.
Where required by data protection legislation, I will notify the Information Commissioner's Office (ICO) within the applicable timeframe.
Where a breach is likely to result in a high risk to your rights and freedoms, I will also inform you without undue delay and take reasonable steps to minimise any potential impact.
Your rights
Under UK data protection law, you have a number of rights in relation to your personal information. The particular rights that apply can depend upon the circumstances and the lawful basis on which your information is being processed.
These may include:
The right to be informed
You have the right to understand how your personal information is collected and used.The right of access
You may request a copy of the personal information I hold about you.The right to rectification
You may ask for inaccurate or incomplete personal information to be corrected.The right to erasure
In certain circumstances, you may ask for your personal information to be deleted. This right is not absolute and some records may need to be retained where there is a professional, legal, regulatory or insurance reason for doing so.The right to restrict processing
In certain circumstances, you may ask for the way your information is used to be restricted.The right to data portability
In certain circumstances, you may have the right to receive information you have provided in a structured and commonly used format or have it transferred to another organisation.The right to object
Where processing is based on legitimate interests, you may have the right to object to that processing.Rights relating to automated decision-making and profiling
Beyond the Mind UK does not currently use automated decision-making or profiling in relation to therapeutic clients.
Requests relating to your personal information will be handled in accordance with the timescales and requirements set by UK data protection legislation.
Concerns or complaints
If you have any questions or concerns about how your personal information is being handled, please contact me:
Nikita Sharma
Beyond the Mind UK
Email: nikita@beyondtheminduk.com
Telephone/WhatsApp Business: 07427 246 606
I would welcome the opportunity to address any concerns directly.
You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent data protection regulator as well as United Kingdom Council of Psychotherapy (UKCP).
Changes to this privacy notice
I may review and update this privacy notice from time to time to reflect changes to my practice, professional requirements, the systems I use or data protection legislation.
The most recent version will be made available through Beyond the Mind UK.
Last reviewed: October 2026
Cookies
Like many websites, I use cookies. A cookie is a small amount of data that is sent to your computer or mobile phone browser from a website’s computer and is stored on your device’s hard drive.
Cookies record information about your online preferences. They help me understand how visitors engage with my sites so that I can improve your online experience with me at Beyond the Mind UK I do not use cookies to collect personally identifiable information about you.
Each website you visit can send its own cookie to your browser if your browser’s preferences allow it. To protect your privacy, your browser only permits a website to access the cookies it has already sent to you, not the cookies sent to you by other websites.
How to control and delete cookies.
You may restrict or block the cookies which are set by our website, or any other website, through your browser settings. You can also ask your browser to alert you when a cookie is issued.
For more information about cookies and how to manage them is available at www.aboutcookies.org
I use Google Analytics to understand how visitors engage with my websites. It collects information anonymously and reports website trends without identifying individual visitors. For more information visit Google Analytics privacy and security information.