Privacy Policy

Policy version: 08/10/2026

UNLOOP TECHNOLOGIES LTD - PRIVACY POLICY

  1. Introduction

    This Privacy Policy is provided by Unloop Technologies Ltd (trading as Unloop), a company registered in England and Wales under company number 17152358 with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (we, our or us). It applies to our website at www.unloop.tech, our web app at app.unloop.tech, the Unloop mobile app and any related support or account communications (together, the Services).

    We know that the information you share with Unloop can be deeply personal. Please read this policy carefully. It explains how and why we collect, store, use and share information relating to you (your personal data), your rights, and how to contact us or the regulator if you have a complaint. Our use of your personal data is regulated by law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

    We are the controller of personal data obtained through the Services, meaning we are legally responsible for deciding how and why it is used.

    The Services are only for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you think someone under 18 has given us their personal data, please contact us so that we can delete it.

  1. What this policy applies to

    This policy relates to your use of the Services only.

    The Services may link to other websites or services (for example, crisis support services) that we do not control. Those organisations have their own privacy policies, which you should read before giving them your personal data.

  1. Personal data we collect about you

    The personal data we collect depends on how you use the Services. We collect and use:

If you do not provide personal data that we ask for where it is required, we may not be able to provide the Services to you.

  1. Health information (special category data)

    Some of the personal data you give us relates to your mental health. This is special category data under the UK GDPR and receives additional protection. We only process it with your explicit consent, which we ask for when you create your account and before you use features that need it.


    Depending on the features you use, this may include:

    (a) your answers to onboarding and assessment questions, including the OCD themes you select and information about how severe your symptoms are;

    (b) journal entries, including descriptions of intrusive thoughts, obsessions and compulsions;

    (c) exposure (ERP) records, including exposure plans, anxiety ratings before and after an exposure, the duration and difficulty of an exposure, and whether you resisted compulsions;

    (d) reflections, and notes or summaries you create to share with your therapist;

    (e) messages you exchange with the AI Companion; and

    (f) your selections and any personalised content in the audio exercises.

    You choose what you enter into the Services. Please only share what you need to use the Services, and avoid including information that identifies other people.

    You can withdraw your consent at any time in Settings > Privacy or by contacting us. Withdrawing consent will not affect our processing before you withdrew it. Because health information is central to how the Services work, you will no longer be able to use features that depend on it, and we will delete that information in line with section 11.

    We do not use your health information for advertising, we do not sell it, and we do not share it with third parties for their own purposes.


  2. How your personal data is collected

    We collect personal data:

    (a) directly from you, when you create an account, complete onboarding, use features such as the journal, exposure tools and AI Companion, or contact us; and

    (b) automatically, when you use the Services (see ‘Technical data’ in section 3 and ‘Cookies and similar technologies’ in section 9).

    If you create an account using a single sign-on provider such as Apple or Google, we receive your name and email address from that provider.


  3. How and why we use your personal data

    Under data protection law, we can only use your personal data if we have a proper reason (a lawful basis), for example:

    (a) where you have given consent;

    (b) where we need to perform our contract with you;

    (c) where we need to comply with a legal obligation; or

    (d) for our legitimate interests, where these are not overridden by your rights and interests.

    For health information, we also need an additional condition. In most cases this is your explicit consent.

    The table below explains what we use your personal data for and why.

  1. The AI Chat and audio features


    The AI Chat function is powered by a large language model provided by OpenAI. When you use it, we send your messages and relevant context from your account to OpenAI so that it can generate a response. This context may include your onboarding answers and recent journal entries, so that responses are relevant to you.

    OpenAI processes this information on our behalf, under a data processing agreement. OpenAI does not use your information to train its models, and it deletes it within 30 days (or immediately, where zero data retention applies).

    Responses are generated automatically and may not always be accurate. The AI Companion does not make decisions about you that have legal or similarly significant effects.

  2. Marketing


    We would like to send you occasional emails about new features, content and offers. We will only do so where you have agreed, or where you are an existing user and did not opt out when you signed up.

    You can opt out at any time by using the ‘unsubscribe’ link in any marketing email, changing your settings in the Services, or contacting us.

    We never sell your personal data or share it with other organisations for their marketing.

  3. Cookies and similar technologies

    Our website and web app use cookies and similar technologies. Some are strictly necessary, for example to keep you signed in.

    We will only use non-essential cookies, such as analytics cookies, with your consent.

  4. Who we share your personal data with


    We share personal data with service providers that help us run the Services. They act on our instructions under written contracts and may only use your personal data to provide services to us. Our current key providers are:

We may also share personal data with:
(a) professional advisers, such as lawyers and accountants, who are bound by confidentiality obligations;
(b) law enforcement agencies, courts, regulators and other authorities, where required by law;
(c) other parties in connection with a sale, merger, investment or restructuring of our business. We will anonymise information where possible, and the recipient will be bound by confidentiality obligations; and
(d) anyone else, where you have asked us to, for example if you choose to share a summary with your therapist.

We may share aggregated or anonymised information that does not identify you, for example to report on how the Services are used.

  1. How long we keep your personal data

    We only keep personal data for as long as we need it. In summary:

When we no longer need your personal data, we delete it or anonymise it so that it can no longer identify you.

  1. Transferring your personal data out of the UK

    Some of our service providers process personal data outside the UK, as shown in section 10. Where they do, we make sure your personal data is protected by:

    (a) transferring it only to countries that the UK Government has confirmed provide an adequate level of protection (adequacy regulations), which include the European Economic Area and, for organisations certified under the UK Extension to the EU-US Data Privacy Framework, the United States; or

    (b) using the International Data Transfer Agreement or International Data Transfer Addendum approved under UK data protection law, together with any additional safeguards needed.

    Please contact us if you would like more information about the safeguards we use.

  2. Your rights

    You generally have the following rights, which you can usually exercise free of charge:

To exercise any of these rights, email us at contact@unloop.tech. We may ask you for information to confirm your identity. We will respond within one month, although this may be extended in some circumstances. For more information about your rights, visit the Information Commissioner’s Office (ICO) website at www.ico.org.uk.

  1. Keeping your personal data secure

    We use appropriate technical and organisational measures to protect your personal data. These include encryption in transit and at rest, access controls that limit access to staff who need it, strong authentication, and choosing service providers that meet recognised security standards.


    No system is completely secure. To protect your information, keep your device and login details secure.

    We have procedures to deal with any suspected data breach, and will notify you and the ICO where we are legally required to do so.

  2. How to complain

    Please contact us first if you have any concerns about how we use your personal data. We will acknowledge your complaint within 30 days and try to resolve it promptly.

    You also have the right to complain to the ICO at www.ico.org.uk/make-a-complaint or by calling 0303 123 1113.

  3. Changes to this privacy policy


    We may change this privacy policy from time to time. If we make significant changes, we will tell you through the Services or by email before they take effect. Where a change affects how we use your health information, we will ask for your consent again where required.

  4. How to contact us


    If you have any questions about this privacy policy or your personal data, or want to exercise your rights or make a complaint, contact us at:

    § Email: contact@unloop.tech

    § Post: Unloop Technologies Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ