Privacy Policy

Who we are

Soma is a service in development that will let people keep their own therapy record. This policy covers our website at somatherapy.app — the waiting list and the journal. The Soma app does not exist yet, and this policy will be replaced before it does.

Soma is not yet an incorporated company. The service is currently operated by its founders, who are the data controller for the information described here. You can reach us at [email protected].

What we collect

Very little, because the site does very little. If you join the waiting list, we store:

• Your email address.
• Whether you ticked the box to receive marketing emails, and when.
• Whether you have since withdrawn that consent, and when.
• The date you joined, and whether you joined through the form or were part of the list imported from our previous site in August 2026.

That is the entire record. We do not ask for your name, and we have no way to know anything else about you.

If you do not join the waiting list, we store nothing about you in our database.

Why we can hold it, legally

Holding your email address so we can tell you when Soma is ready is our legitimate interest — you asked to be told, and telling you is the only reason we have it (UK GDPR Article 6(1)(f)).

Sending you anything beyond that — news, updates, progress on how Soma is coming along — relies on your consent (Article 6(1)(a)), which is the tick box on the form. It is optional, it is never pre-ticked, and you can join the waiting list without it.

Marketing, and how to stop it

We record when and how you consented so we can show it was freely given. You can withdraw at any time, and it takes effect immediately — email us at [email protected] and we will remove you from the marketing list the same working day.

Withdrawing consent leaves you on the waiting list, so you will still get the single email telling you Soma is ready. If you would rather come off the list altogether, say so and we will delete your record entirely.

How long we keep it

Until Soma launches and we have told you, or until you ask us to delete it — whichever comes first.

If the project is abandoned, we will delete the whole list rather than keep it. We are not going to sit on a list of people interested in therapy records indefinitely.

Who else can see it

We do not sell your data, and we do not share it with anyone for their own purposes. It reaches these companies only because they run the infrastructure the site sits on:

• Railway — hosts the site and the database that holds the waiting list.
• Cloudflare — sits in front of the site, handling DNS and traffic. It processes visitors' IP addresses.
• Google Analytics — tells us how many people visit and which pages they read.
• Adobe Fonts (Typekit) — serves one of the typefaces. Your browser requests it from Adobe, so Adobe receives your IP address.

We may also disclose information where the law requires it, such as a court order. If Soma is ever sold or merged, the waiting list may transfer with it, and this policy would continue to apply to it.

Where your data is held

Our database is hosted in the United States. That means your email address is transferred outside the UK.

Where we transfer personal data outside the UK, we rely on the safeguards permitted under UK data protection law — either that the destination has been found to offer adequate protection, or contractual protections with the provider. If you want the detail of the arrangement covering your data, ask us and we will explain it.

Cookies and analytics

The website does not need cookies to work, and joining the waiting list does not set one.

We would like to use Google Analytics to see how many people visit and which pages they read. It sets cookies to do that, so we ask first — the banner on your first visit has an Accept and a Reject button, and nothing analytics-related loads unless you choose Accept. Rejecting is one click, exactly like accepting, and the site behaves identically either way.

You can change your mind whenever you like using the "Cookies" link in the footer. If you switch from Accept to Reject, we delete the analytics cookies we set.

We remember your choice in your browser's local storage. That is not shared with anyone and never reaches our servers — it only exists so we stop asking.

We do not use advertising cookies, we do not run remarketing, and we do not share analytics data with advertisers.

Your rights

Under UK data protection law you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct it if it is wrong.
• Delete it.
• Restrict or object to how we use it.
• Provide it in a portable format.
• Withdraw your consent to marketing at any time.

Email [email protected] and we will respond within one month. There is no charge. Given that the only thing we hold is your email address, most of these requests take us minutes.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. We would rather you came to us first so we can put it right.

Children

The waiting list is not intended for children under 13. We do not knowingly collect their data, and if we learn that we have, we will delete it.

Changes to this policy

We will update this page when our practices change — in particular, it will be rewritten before the Soma app launches, because the app will handle far more sensitive information than an email address.

The date at the top always reflects the current version. If we change how we use data you have already given us, we will tell you rather than quietly amend this page.

Contact

Questions, requests, or complaints: [email protected].