Privacy Policy
1. Who we are
The Pain Coach is operated by The Pain Coach Ltd, a company registered in England & Wales. Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. We are the data controller responsible for your personal data under UK data protection law (UK GDPR and the Data Protection Act 2018).
Contact for privacy matters: privacy@thepaincoach.app
We are registered with the Information Commissioner's Office (ICO), registration number ZC237554.
2. What the app is — and is not
The Pain Coach is an educational and coaching tool that supports self-management of chronic and persistent pain (including fibromyalgia), including evidence-based pain education, pacing, movement, sleep, and practical support around work. It does not provide medical diagnosis, treatment, or clinical advice, and it is not a substitute for care from your own doctor or healthcare team. Nothing in the app creates a doctor–patient relationship. The app is intended for adults aged 18 and over.
3. The information we collect
- Account information. Your email address, name (if provided), password (stored in encrypted form by our authentication provider), and the invite code used to join during the testing period.
- Coaching conversations and reflections. Messages you exchange with the in-app AI coach, and reflections you write in modules. Because the app concerns pain and wellbeing, these may include information about your health. This is special category data under UK GDPR, treated with additional protection as described below.
- Programme activity and check-ins. Which modules you have completed, your progress, and self-report check-ins (including work and social adjustment measures and work status) that you choose to complete.
- Technical data. Basic device and usage information needed to run and secure the service. We do not use advertising or third-party marketing trackers.
4. How we use your information, and our lawful bases
- To provide the service — managing your account, delivering content, and operating the AI coach. Lawful basis: performance of a contract (Article 6(1)(b)).
- To process health-related information in your conversations, reflections, and check-ins. Lawful basis: your explicit consent (Articles 6(1)(a) and 9(2)(a)), which we ask for when you create your account. You can withdraw consent at any time by deleting your account.
- To keep the service secure and fix problems. Lawful basis: our legitimate interests (Article 6(1)(f)).
- To evaluate and improve the programme, using aggregated, de-identified information that does not identify you. Lawful basis: legitimate interests.
We do not sell your data, use it for advertising, or share it for marketing.
5. Who processes your data on our behalf
- Supabase — provides our database, authentication, and secure backend. Your account data, progress, reflections and conversation history are stored here, protected by access controls so your data is accessible only to your account.
- Anthropic — provides the AI model powering the coach. When you message the coach or submit a reflection, that content is sent securely to Anthropic's API to generate a response. Anthropic does not use data submitted through its API to train its models.
- Apple and Google — distribute the app and handle app-store level data under their own privacy policies.
6. International transfers
Some providers process data outside the UK, including in the United States. Where this happens, transfers are protected by appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision (including the UK–US Data Bridge where the provider is certified).
7. How long we keep your data
- Account and health-related data: kept while your account is active, and deleted when you delete your account.
- Backups: deleted data may persist in encrypted backups for up to 30 days before permanent removal.
- Aggregated, de-identified statistics that cannot identify you may be retained for programme evaluation.
8. Deleting your account and data
You can delete your account at any time from within the app (Settings → Delete account). This permanently removes your account, conversations, reflections, and programme data from our systems, subject to the backup window above. You can also request deletion by emailing privacy@thepaincoach.app.
9. Your rights
Under UK GDPR you have the right to: access a copy of your data; correct inaccurate data; delete your data; restrict or object to certain processing; data portability; and withdraw consent at any time, without affecting processing before withdrawal. To exercise any of these, contact privacy@thepaincoach.app. We will respond within one month.
10. Security
All data is encrypted in transit (TLS) and at rest. Access to your data within the app is enforced by controls tied to your authenticated account. Administrative access to backend systems is limited and protected by credentials and two-factor authentication.
11. Children
The Pain Coach is not intended for, or directed at, anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
If we make material changes, we will update this page and notify you in the app before the changes take effect. The "last updated" date above shows the current version.
13. Complaints
If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the ICO: ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.