Privacy notice
Who is responsible
When you ask for care through ReAnxiety, Rephobia Limited is responsible for your information. That makes us the data controller, and in this notice “we” and “us” mean Rephobia Limited. Rephobia Limited is registered in Northern Ireland, company number NI715353, and its registered office is C/O Pacem Advisory, 3rd Floor, 2-10 East Bridge Street, Belfast BT1 3NQ. Rephobia Limited trades as Rephobia, ReOCD, RePTSD and ReAnxiety, and as ReHabituation, the workspace therapists use. This one notice covers all five. To ask about your information or to use your rights, email hello@reanxiety.com.
What you tell us
To ask for care, you write a short description of what you want help with. What you write can include information about your health, and you decide how much to share. You can choose a broad category if one fits. We ask for your region, confirmation that you are 18 or over and your general availability, and you can add preferences or access needs. Until you create your account, what you type stays in your browser tab and is not sent to us.
Your account
To create your account we ask for your name and email address, and we email you a six-digit code to confirm the address. Once you are signed in, we save a draft of a new request as you write it, so you do not lose it. Because ReAnxiety is a service for anxiety, even the fact that you have an account can say something about your health, so we protect your account details with the same care as your request.
What your workspace keeps
Your workspace keeps your request, any question a therapist asks and your answer, the offers you receive, and the appointments you book, change or cancel. It also keeps the treatment plans you agree and the reflections you write after a session. Your therapist records whether each appointment took place and what happens next. If you change your request or a plan changes, the earlier version is kept with it, so there is a clear record of what was shared and agreed. We also log the main steps, such as when a request was sent or an appointment booked. If you answer a feedback question about how a step worked, we keep your answer, any comment and whether you are happy for us to contact you about it. No clinical notes are kept in the workspace.
Who sees your request
Your request summary goes to up to two therapists at a time, each approved by Rephobia Limited for anxiety. They see what you wrote, your category, region, availability and preferences. Your name and email address are stored apart from the summary. A therapist can ask you a question, offer you a first video appointment or decline. If they decline, they can record a short reason for our team. You do not see it in your workspace, and you can ask us for a copy. A coordinator at Rephobia Limited sees your request if you ask for help, or if it needs following up, for example when no therapist can take it on or a therapist asks you a question. Before you book, you see the therapist’s name, profession and introduction.
Who else can see it
Once you book, your therapist sees your appointments, the plans you agree and the reflections you write. We share with your therapist only what they need to hold the video appointment with you. A small number of Rephobia Limited staff can reach our systems to keep the service running and safe. The reports we use to run the service show counts and reference numbers, without your name, contact details or what you wrote.
AI and automated decisions
We do not send any information about you to a generative AI model. No decision about you is made by a computer on its own. The system picks which therapists see your request by matching it to therapists whose approved scope fits and who have appointment times open. A therapist then decides whether to offer you care.
Your therapist’s own records
Your therapist is an independent professional. They keep their own clinical records of your care, outside the workspace, under the rules of their profession. They are responsible for those records and can tell you how they handle them.
Why we use it
Data protection law (the UK GDPR and the Data Protection Act 2018, and the EU GDPR for people in Ireland) says we need a lawful basis for each use of your information. We use your account details and your request to take the steps you ask for before and while we provide the service (Article 6(1)(b)). We use health information only with your explicit consent (Article 9(2)(a)), which you give by ticking the box when you send your request. We keep web server logs for security, which is in our legitimate interests (Article 6(1)(f)). When we keep records after your care ends so that we can answer a question or complaint about it, we rely on our legitimate interests (Article 6(1)(f)) and, for health information, on the condition that lets us keep information needed to deal with legal claims (Article 9(2)(f)).
Withdrawing your consent
You can withdraw your consent at any time. Withdraw your request in your workspace, or email us and we will delete it. Withdrawing does not affect anything that happened before you withdrew. Sharing your request depends on your consent, so once you withdraw, we cannot pass your request to therapists.
Where it is stored
Your information is stored on Rephobia Limited’s own server in the UK. Two services help us as processors, which means they may use information only on our instructions, under a data processing agreement. Zoho provides our email mailboxes and stores messages in the European Union. Zoho ZeptoMail sends sign-in codes from the European Union. The UK and the European Union each recognise the other’s data protection as adequate, so information can move between them without extra safeguards.
Signing in and security
Sign-in codes expire after 15 minutes and work once. A sign-in lasts up to eight hours unless you sign out. The code email carries the code and nothing about your request. To stop misuse, we keep a coded form of your internet (IP) address with each code. Our web server logs each visit: the IP address, the page, the browser type and the time. We keep these logs for 14 days to protect the service.
Cookies
We use only the cookies the service needs to work. A sign-in cookie keeps you signed in for up to eight hours. A short-lived cookie ties your sign-in code to your browser for 15 minutes. While you use your workspace, your browser also keeps a small note in that tab so that an action is not sent twice if your connection drops. If you pick a situation on the homepage, your browser keeps your choice in that tab until the request form reads it, so the form can start with it. These notes stay in the tab and are cleared when you close it. We use no analytics or advertising cookies. These cookies are strictly necessary, so the law lets us use them without asking first.
Emails
We send no marketing emails. The service emails you sign-in codes, and our team may email you when we need to about your request or an appointment. Replies, offers and appointment updates appear in your workspace, so sign in to see them. If you email us, we receive your email address and what you write, and we use it to answer you and deal with what you ask, which is in our legitimate interests (Article 6(1)(f)). Share only what you are comfortable sharing. Emails to us are not watched around the clock. If you need help now, call 999 (112 in Ireland) or Samaritans free on 116 123.
How long we keep it
A request or saved draft that never leads to an appointment is deleted 12 months after your last activity. An account with no request is deleted after 12 months without a sign-in. Your appointments, the plans you agree and your reflections are kept while your account is open and for six years after your last appointment, so that we can answer questions or complaints about your care, and then deleted. Feedback, earlier versions and the log of steps are deleted along with the records they belong to. Sign-in codes are deleted after a day, web server logs after 14 days and emails two years after we last hear from you. You can ask us to delete your account and records sooner, and we will keep only what the law requires.
Your rights
You can ask us for a copy of your information, to correct it, to delete it or to restrict how we use it. You can object to how we use it, and ask for the information you gave us in a form you can take to another service. Where we rely on your consent, you can withdraw it at any time. Some rights depend on the lawful basis we use, and we will tell you if one does not apply. To use any of these rights, email us at the address at the top of this notice. If you are unhappy with how we handle your information, please tell us so we can try to put it right. You can also complain to the Information Commissioner’s Office in the UK at ico.org.uk (opens in a new tab), or to the Data Protection Commission in Ireland at dataprotection.ie (opens in a new tab).
If you are a therapist
If you work through ReHabituation as a therapist, we hold your name, email address, profession, the professional details you give us, the pathways you ask for and the scope a reviewer approves. We also hold the appointment times you offer, whether you have finished the training and online setup, and what you record in the workspace, such as questions, offers, reasons for declining, attendance and the plans you propose. People who ask for care see your name, profession and introduction before they book. Rephobia Limited staff who set up accounts and review scope can see your account. Your email address is used to send sign-in codes and is stored apart from the care record. We use this information to run the service with you (Article 6(1)(b)), and to check professional details and keep the service safe, which is in our legitimate interests (Article 6(1)(f)). We keep your account while you work with us. After you leave, we keep your professional details, approved scope and what you recorded about appointments for as long as we keep the records of those appointments, and delete anything else. The rights above apply to you too.
Changes to this notice
This notice was last updated on 1 November 2026 (version 2026-11-01). When what we do with your information changes, we update this notice and show the new date here.
Return to your next step
Write a few sentences about what you want to be able to do. A therapist who works with anxiety reads it and, if they can help, offers a first online appointment.
Sending a request is free, and you hear back either way.