Phoenix
Phoenix Data Protection Impact Assessment: summary
Before and while running Phoenix, NeuroHub Community Ltd carried out a Data Protection Impact Assessment (DPIA). A DPIA is a structured check, required by the UK GDPR and EU GDPR when processing could put people at high risk, of what could go wrong for the people who use a service and what we do about it. This is a plain-language summary. It sits alongside the Phoenix AI Policy and the privacy page.
Why we did one
Phoenix uses AI, is used by people who may be vulnerable or in distress, and can touch health information. Those are all reasons the Information Commissioner’s Office (ICO) says to carry out a DPIA.
How we did it
- We followed the ICO’s seven-step DPIA template: need, description of the processing, consultation, necessity and proportionality, risks, measures, and sign-off.
- We mapped every way data moves in Phoenix, from what stays on your device to what is sent to our AI provider.
- We took informal feedback from community members and collaborators. We plan a structured review of our consent wording with autistic users (see below).
- The assessment is led by NeuroHub’s data protection lead, David Gray.
What we found
With the safeguards below, we judge the remaining risk to be medium, and lower once our planned actions are complete. We do not need to ask the ICO for prior consultation.
| Main risk | What reduces it |
|---|---|
| An AI reply that is wrong or unhelpful when someone is distressed | Crisis detection and the Help panel run on your device, not through the AI. Helplines are checked and verified. Medicine questions get a careful built-in answer. A Report button and a pause switch let us act fast. |
| Private or health information being seen by others | Chats stay on your device by default. Optional accounts are encrypted and we do not store your email address in readable form. We do not store or log what you send to the AI. We do not use cookies. |
| The AI provider keeping messages | Messages go to Anthropic only to write a reply, are not used to train models, and only the most recent messages are sent. We are checking and tightening the provider’s retention period. |
| Wellbeing sharing identifying someone | It is off unless you turn it on, for ages 16 and over. We keep only a random ID, the date and seven numbers, never any text. Results are shown only for groups of five or more and deleted after two years. |
| Someone feeling watched or pressured | Nobody monitors conversations and we say so. Phoenix does not profile you, show adverts or make decisions about you. You can switch the AI off at any time. |
| The optional supporter plan: a payment not applied, or saved data deleted unexpectedly | Payments are taken by Stripe, never by NeuroHub, and matched to an account by an anonymous fingerprint, not an email address. The terms, refund and what happens to your data are stated before you sign up. Saved data is kept read-only for 30 days after a plan ends, with a download option, before it is deleted. |
| Admin access and key loss | The private backend needs a password and an authenticator code, locks out repeated failures and logs sign-ins. Encryption keys are backed up. |
What we are still doing
- Confirming and shortening our AI provider’s data retention, and stating it here and in the AI Policy.
- Having autistic users review the wording of the wellbeing-sharing consent, and adding a preview of exactly what is shared.
- Keeping copies of provider data-protection agreements and transfer safeguards on file.
- Writing down our personal data breach procedure and improving key backup and admin access reviews.
- Testing crisis and sensitive replies each time the AI model or its instructions change.
We expect to complete these by the end of November 2026, and we will review the whole assessment in April 2027 or sooner if Phoenix changes how it uses data.
Questions
Write to enquiries@neurohubcommunity.org with “Phoenix DPIA” in the subject line. NeuroHub Community Ltd is registered with the ICO, reference ZC088866.