This policy should be reviewed by a qualified legal professional before relying on it in any contractual or regulatory context. Placeholders marked [INSERT] must be completed before this policy is published to end users.
1. Who we are
Wellbeing Solved ("we", "us", "our") operates the employer wellbeing platform available at wellbeingsolved.com and its associated subdomains (the "Platform").
Our registered details are:
Company name: [INSERT registered company name]
Registered address: [INSERT registered address]
Company number: [INSERT company/registration number]
Contact email: privacy@wellbeingsolved.com
For questions about this policy or your personal data, please contact us at privacy@wellbeingsolved.com.
2. Data controller and data processor
The way GDPR and UK GDPR apply to Wellbeing Solved depends on the context in which your data is processed:
When we act as a data controller
We act as a data controller in respect of: data you provide when registering for or enquiring about the Platform (such as your name and email address); data collected through our marketing activities; and data relating to the administration of our business relationship with employer clients.
When we act as a data processor
When an employer organisation (the data controller) deploys the Platform to its employees, Wellbeing Solved acts as a data processor on that employer's behalf. In this capacity we process personal data strictly in accordance with the employer's instructions and the Data Processing Agreement (DPA) between Wellbeing Solved and that employer.
If you are an employee accessing the Platform via your employer, your employer is the data controller for your personal data. Please refer to your employer's own privacy notice, or contact your HR team, for information about how your employer processes your data and your rights in that context.
3. What personal data we collect
Account and contact data
- Name (first name and last name)
- Email address
- Username
- Job title or department (where provided)
- Company name and employer organisation details
Platform usage data
- Login timestamps and session duration
- Pages viewed and features accessed
- Onboarding completion status
- Pulse survey responses (aggregated and, where necessary, individual)
- Wellbeing scores and mood data entered via the Platform
Special category data (health and wellbeing)
Wellbeing, mood, and mental health data constitutes special category personal data under Article 9 of the UK GDPR and EU GDPR. We process this data only where a lawful Article 9 condition applies, which will be documented in the DPA with the relevant employer. The processing of this data requires the highest standard of care and security, and we apply appropriate technical and organisational measures accordingly.
HR and workforce metrics
Employers may submit workforce metrics through the Platform's Data Entry feature, including sickness absence rates, staff turnover figures, and related HR indicators. This data is processed on behalf of the employer to generate wellbeing trend reports and insights.
Technical and device data
- IP address
- Browser type and version
- Operating system
- Cookies and session identifiers (see our Cookie Policy for details)
Communications data
If you contact us by email, through a contact form, or via any other channel, we retain a record of that correspondence including any personal data you choose to share.
4. How we collect your data
- Directly from you when you register for an account, complete a survey, or contact us
- From your employer, where your employer has deployed the Platform to its workforce and has provided your details to grant you access
- Automatically via cookies and similar tracking technologies when you use the Platform (see our Cookie Policy)
- From email marketing interactions where you have subscribed to our communications
5. Lawful basis for processing
We rely on the following lawful bases under Article 6 UK GDPR / EU GDPR:
| Purpose | Lawful Basis |
|---|---|
| Providing the Platform and its features | Contract (Article 6(1)(b)) |
| Administering employer and user accounts | Contract (Article 6(1)(b)) |
| Sending service-related notifications and alerts | Contract (Article 6(1)(b)) |
| Marketing communications (where you have opted in) | Consent (Article 6(1)(a)) |
| Improving and developing the Platform | Legitimate interests (Article 6(1)(f)) |
| Fraud prevention and platform security | Legitimate interests (Article 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Article 6(1)(c)) |
Where we process special category data (health and wellbeing data) under Article 9, we rely on explicit consent and/or employment-related processing conditions as agreed with the relevant employer in the DPA. The specific Article 9 conditions applicable in each employer deployment are documented in the relevant DPA.
6. How we use your data
- To create and manage your user account
- To deliver wellbeing programme features including pulse surveys, trend dashboards, and reporting
- To generate employer reports, ROI analysis, and early warning alerts on aggregated workforce wellbeing
- To generate AI-assisted insights and recommendations using our AI features (see Third-Party Processors below)
- To send you transactional emails relating to your account, such as password resets and alert notifications
- To send you marketing communications where you have given consent, including newsletters and programme updates
- To improve the Platform, diagnose technical issues, and develop new features
- To comply with our legal and regulatory obligations
- To protect the security and integrity of the Platform
7. Third-party processors
We share personal data with carefully selected third-party processors who provide services that are integral to operating the Platform. All processors are bound by data processing agreements and are required to process data only on our documented instructions.
Google Gemini API (Alphabet Inc.)
We use the Google Gemini API to power AI-assisted features within the Platform, such as generating wellbeing insights and recommendations. Data submitted to the Gemini API may include anonymised or aggregated wellbeing metrics and non-personally identifiable content. We do not intentionally submit identifiable personal data to the Gemini API; however, you should be aware that AI processing occurs on Google's infrastructure.
Google is subject to the EU-US Data Privacy Framework. Further information: Google Privacy Policy
Flodesk (email marketing)
We use Flodesk to manage our marketing email list and send newsletters and programme update communications. If you have subscribed to our marketing communications, your name and email address are stored within Flodesk. You can unsubscribe at any time via the link included in every marketing email.
Further information: Flodesk Privacy Policy
Payment processing
Where online payment is offered, payment details are handled by the payment provider. We do not store full payment card details.
Hosting and infrastructure
The Platform is hosted on cloud infrastructure. Server infrastructure is operated in data centres that may be located outside the UK and European Economic Area. Where data is transferred internationally, we ensure appropriate safeguards are in place (see Section 9 below).
Other processors
We may use additional processors from time to time for purposes such as analytics, error monitoring, and customer support tooling. We will update this policy when material new processors are introduced.
8. Data retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our general retention standards are:
| Data Type | Retention Period |
|---|---|
| Active user account data | For the duration of the account, plus 12 months after closure |
| Pulse survey and wellbeing response data | 24 months rolling, then anonymised or deleted |
| Employer HR metrics and reports | For the duration of the employer contract, plus 12 months |
| Financial and billing records | 7 years (legal requirement) |
| Marketing contact data | Until consent is withdrawn or you unsubscribe |
| Support and correspondence records | 3 years from the last interaction |
Where Wellbeing Solved acts as a data processor on behalf of an employer, retention periods are governed by the applicable DPA and the employer's own retention policies.
9. International data transfers
Some of our third-party processors operate outside the UK and European Economic Area (EEA). Where personal data is transferred internationally, we ensure an appropriate transfer mechanism is in place, such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission or UK ICO
- An adequacy decision by the relevant data protection authority
- The EU-US or UK-US Data Privacy Framework (where applicable)
You can request a copy of the specific safeguards in place for any international transfer by contacting us at privacy@wellbeingsolved.com.
10. Data security
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
- Encryption of email addresses and sensitive data at rest using AES-256-CBC
- Encrypted data transmission via HTTPS/TLS
- Role-based access controls limiting who can view personal data within the Platform
- Regular database backups
- Access logging and monitoring
Despite these measures, no system is entirely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, will notify affected individuals without undue delay.
11. Your rights
Subject to applicable law, you have the following rights in respect of your personal data:
Right of access
You can request a copy of the personal data we hold about you (a Subject Access Request).
Right to rectification
You can ask us to correct inaccurate or incomplete personal data.
Right to erasure
You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
Right to restrict processing
You can ask us to pause processing of your data in certain circumstances.
Right to data portability
Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, machine-readable format.
Right to object
You can object to processing based on legitimate interests or for direct marketing purposes at any time.
Rights relating to automated decision-making
You have the right not to be subject to decisions made solely by automated means that produce legal or similarly significant effects.
Right to withdraw consent
Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
To exercise any of these rights, please contact us at privacy@wellbeingsolved.com. We will respond within one calendar month. We may need to verify your identity before fulfilling your request.
If you are an employee accessing the Platform through your employer, please also contact your employer, as they are the data controller for your employment-related data.
You also have the right to lodge a complaint with your national supervisory authority. In the UK this is the Information Commissioner's Office (ICO): ico.org.uk.
12. Cookies
We use cookies and similar tracking technologies on the Platform. For full details of what cookies we use, why, and how to manage them, please read our Cookie Policy.
13. Children's data
The Platform is intended for use by adults in a professional employment context. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided personal data through the Platform, please contact us immediately at privacy@wellbeingsolved.com and we will take steps to delete it.
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or via a notice within the Platform.
We encourage you to review this policy periodically to stay informed about how we protect your data.
15. Contact us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:
Email: privacy@wellbeingsolved.com
Website: wellbeingsolved.com
Post: [INSERT registered address], marked for the attention of Data Privacy