Privacy policy

Who we are

Rephobia Limited (registered in Northern Ireland, NI715353) builds immersive graded-exposure experiences for phobia treatment. We are the data controller for the personal data described on this page. You can reach us about anything here at hello@rephobia.com.

What we collect, and why

Early-access requests. If you use the “Request early access” form we collect your name, your email address, and which route you came through (clinician or individual), so we know what kind of access you are asking about. Our lawful basis is your consent. You can withdraw it at any time by emailing us, and we will remove you.

Updates you opt in to. If you tick the box to receive occasional updates, we use your email address to send them. That consent is separate from asking for access, you do not have to give it, and every update includes a way to stop them.

Enquiries. If you use the enquiry form on our homepage we collect your name, email address, your message and the role you select (for example clinician, clinic, researcher, or someone living with a phobia). We use this only to reply to you and to understand who is getting in touch. Our lawful basis is our legitimate interest in responding to enquiries about our work.

Health information. If you tell us that you live with a phobia, or describe your situation in your message, that is information about your health and we treat it with extra care. We only ever have it because you chose to write it, we use it only to reply to you appropriately, and we rely on your explicit consent to hold it. You can ask us to delete it at any time.

Contact messages. If you use our contact form we collect your name, email address and message so we can reply. Our lawful basis is legitimate interests - responding to enquiries people send us.

Professional outreach. We sometimes contact UK clinics whose published work suggests Rephobia is relevant to them, using business contact details from public professional sources (a clinic's own website or public directories). We record where and when we found those details, we contact each clinic at most twice, and every email carries a working unsubscribe. Our lawful basis is legitimate interests - introducing a relevant professional tool.

Demo viewing. Clinic demo links on demo.rephobia.com are unique per clinic. When one is opened we record that the demo was viewed and how far through it got, tied to the clinic's link - not to cookies or advertising identifiers.

What we don't do

We do not sell personal data, share it with third parties for their marketing, or make automated decisions about anyone. This website does not use advertising or analytics cookies. We hold no patient or session data through this website - when Rephobia is used in therapy, session data resides with the treating clinic.

Who processes data for us

Website form data is stored in Rephobia's private PostgreSQL database on our managed server. Emails are delivered via Resend. Fonts are served by Google Fonts, which involves your browser requesting files from Google. Each external provider acts as a processor under our instructions.

How long we keep it

Early-access requests are kept until you ask us to remove you, or until the early-access programme ends. Enquiries are kept for up to 12 months after the conversation closes. Outreach contacts who never engage are deleted within 6 months; if you unsubscribe we keep only your email address on our suppression list, which is what stops us emailing you again.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct or delete it, object to our processing, or withdraw consent at any time - email hello@rephobia.com and we will act promptly. You can also complain to the Information Commissioner's Office at ico.org.uk.