1. Who We Are

Reverse Chronic Pain Ltd is a digital chronic pain recovery programme. We are committed to protecting your personal data and handling it responsibly and transparently.

For the purposes of UK data protection law, Reverse Chronic Pain Ltd is the data controller for the personal information you provide through this programme.

Company registration number: 17308600 Registered in: England and Wales

If you have any questions about this policy or how we handle your data, please contact us at: hello@reversechronicpain.co.uk

2. What Data We Collect

We collect the following categories of personal data:

Basic personal information: your name, email address, date of birth, gender, occupation, and living situation.

Health information: details about your pain experience, medical history, previous injuries or pain episodes, investigations and treatments you have tried, medications, managed health conditions, and your emotional and psychological responses to pain. This is classified as special category data under UK GDPR and is handled with additional care.

Personality and lifestyle information: responses to questions about your personality, daily life, hobbies, stress levels, coping strategies, and recovery goals.

Programme interaction data: your daily check-in responses, including pain levels, mood, energy, sleep quality, movement patterns, and free text notes collected on an ongoing basis during the programme.

Feedback data: your responses to programme feedback forms submitted during and after the programme.

3. Why We Collect It

We collect this information solely to provide you with a personalised chronic pain recovery experience. Specifically, your data is used to:

• Assess whether this programme is appropriate and safe for you

• Create a personalised user profile that drives the content, tone, and focus of your programme

• Generate personalised educational content, guided audio sessions, and daily session recommendations

• Generate personalised weekly audio sessions based on your check-in patterns over time

• Track your progress over time and adapt the programme accordingly

• Identify when clinical review or medical referral may be appropriate

• Improve the quality of the programme based on aggregated, anonymised feedback

We do not use your data for marketing purposes, and we do not sell your data to third parties.

4. The Legal Basis for Processing Your Data

We process your personal data on the basis of your explicit consent, which you provide when completing the intake questionnaire.

For special category health data, we rely on your explicit consent under Article 9(2)(a) of UK GDPR.

We separately ask for your explicit consent to the use of AI systems to process your data and generate personalised content, given the role artificial intelligence plays in delivering this programme.

You have the right to withdraw your consent at any time by contacting us at hello@reversechronicpain.co.uk. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

5. The Use of Artificial Intelligence

This programme uses artificial intelligence to generate personalised content based on your questionnaire responses and ongoing programme data. This includes your User Profile, educational modules, daily session recommendations, weekly progress summaries, and personalised audio sessions.

Your data is processed by Anthropic (Claude AI) to generate written content, and by ElevenLabs to convert that content into audio. Neither provider uses your data to train their AI models. Full details of how these providers handle data are set out in Section 6 below.

We apply pseudonymisation before any data is sent to third-party AI providers. This means only your first name (not surname) and approximate age (not date of birth) are included in AI processing calls — your email address is never transmitted to AI providers. All other data processed by AI relates to your pain experience, personality, and lifestyle rather than directly identifying information. The complete record linking your identity to your programme data is held only within our own secure systems and is never shared with AI providers in identifiable form.

6. How Your Data Is Stored

Your data is processed and stored across the following platforms:

Google Forms — used to collect your questionnaire responses at intake, during daily check-ins, and in feedback forms. Google’s privacy policy applies to data processed through their systems.

Google Sheets — used to store your questionnaire responses and programme data in a structured format for processing.

Google Drive — used to host and deliver audio content to users. Audio files are stored securely and shared via private links.

Make.com — used to automate the flow of your data between systems. We have a Data Processing Agreement in place with Make.com governing how your data is handled.

Anthropic API (Claude) — your profile data is processed by Anthropic’s AI systems to generate personalised educational content, session recommendations, weekly progress summaries, and audio session scripts. Data sent to the Anthropic API is not used to train AI models and is processed in accordance with Anthropic’s API terms and privacy policy.

ElevenLabs — used to generate personalised audio sessions from AI-generated scripts. Audio content is generated in accordance with ElevenLabs’ data processing policies.

Gmail — used to deliver programme content, audio session links, and communications to your email address.

All platforms we use operate under appropriate data processing agreements and privacy frameworks consistent with UK GDPR requirements.

7. How Long We Keep Your Data

We retain your personal data for up to 3 years from the end of your participation in the programme. This period allows us to maintain appropriate clinical records, respond to any concerns that may arise after your programme ends, and support you if you choose to return to the programme.

Some records — such as clinical safety logs relating to pre-screening — may be retained in anonymised form for longer, for governance and safety review purposes.

If you request deletion of your data, we will acknowledge your request within 72 hours and complete deletion within 30 days. Full details of our retention and deletion practices are available on request.

8. Who Has Access to Your Data

Your data is accessible only to the Reverse Chronic Pain team members directly involved in delivering and reviewing the programme. Access to identifiable health information is limited to what is necessary to deliver the programme safely.

It is not shared with any third parties for commercial purposes.

Data is processed by the third-party platforms listed in Section 6 above, each of which operates under appropriate data protection agreements.

No other person will read your questionnaire responses, check-in data, or generated content unless you choose to share them, or unless disclosure is necessary to protect your safety (for example, where a clinical safety concern is identified during pre-screening).

9. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the data we hold about you

• Right to rectification — you can ask us to correct inaccurate data

• Right to erasure — you can ask us to delete your data

• Right to restrict processing — you can ask us to limit how we use your data

• Right to data portability — you can request your data in a portable format

• Right to withdraw consent — you can withdraw your consent at any time

• Right to object — you can object to certain types of processing

To exercise any of these rights, please email hello@reversechronicpain.co.uk with the subject line “Data Request.” We will acknowledge your request within 72 hours and respond fully within 30 days.

10. Sensitive Health Data

The health information you provide is classified as special category data under UK GDPR. We treat this data with the highest level of care and process it only for the purposes described in this policy, on the basis of your explicit consent.

We do not share your health data with insurers, employers, or any other third parties.

11. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including encrypted device storage, two-factor authentication, and restricted access controls.

All third-party platforms we use maintain their own security standards consistent with industry best practice.

Audio content is delivered via private links that are not publicly searchable or discoverable.

12. Data Breaches

In the unlikely event of a data breach affecting your personal data, we will assess the risk to you and, where required, notify the Information Commissioner’s Office within 72 hours and notify you directly without undue delay if the breach is likely to result in a high risk to your rights and freedoms.

13. International Data Transfers

Some of the platforms we use, including Anthropic and ElevenLabs, may process data outside the United Kingdom. Where this occurs, appropriate safeguards are in place, including reliance on UK GDPR-compliant data transfer mechanisms.

14. Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We would also welcome the opportunity to address your concerns directly before you contact the ICO — please email hello@reversechronicpain.co.uk.

15. Changes to This Policy

We may update this policy from time to time. Any significant changes will be communicated to active users by email. The date at the top of this policy indicates when it was last updated.

16. Contact Us

Reverse Chronic Pain Ltd Company number: 17308600 Registered in England and Wales

Email: hello@reversechronicpain.co.uk

© 2026 Reverse Chronic Pain Ltd. All rights reserved.