What we hold, why, and for how long

To invite someone to a survey we need one thing about them: a work email address. We do not ask employers for names, job titles, employee numbers, dates of birth or any HR record.

When a survey is submitted, the answers are stored without any reference to the person who gave them. There is no screen, export or report anywhere in Wellometry that shows your employer who said what. Results for any group of fewer than five people, or fewer than five answers, are withheld. Your employer sees averages for the organisation and for groups large enough to report.

The survey asks 20 questions about the experience of work: workload, support from managers and colleagues, safety at work, recognition, and morale. Questions read like “I can do my work well within my working hours” and “My effort is recognised”.

We do not ask about symptoms, diagnoses, medication, treatment, disability or any medical history, and none of the scored questions can collect it. The free text box is open, so if you choose to write about your health, that is your choice and we treat what you write as sensitive. Wellometry is not a medical service, does not provide clinical advice and does not diagnose anyone.

A submitted response is stored with no employee identifier on it. The invitation and the response are separate records, and the answers cannot be viewed per-person through the product: there is no screen, export or report anywhere in Wellometry that shows an employer who said what.

Results are also suppressed for small groups. We never show a result for a group of fewer than five people, or a group that gave fewer than five answers. Either one is enough for the result to be withheld. Those answers still count towards the organisation-wide figure, and nothing is reported about the group itself. This threshold is the same for every organisation using Wellometry. Your employer cannot change it, and cannot ask us to change it for them.

Free-text comments carry the greatest risk of someone identifying themselves by what they write. Your employer does not see them. We may in future analyse comments to produce group level themes, which would be reported to your employer as themes across a group and never as individual comments. If you write a comment, please avoid naming yourself or others.

Where an employer uses Wellometry to survey their staff, the employer is the data controller and Wellometry is the data processor. They decide who is surveyed and why; we process it on their instructions and for no other purpose. A data processing agreement is available to every client and forms part of the contract.

For this website, including demo requests, Wellometry is the controller of the details you send us.

We do not sell data and we do not share it with advertisers.

Employers typically rely on legitimate interests (understanding and improving working conditions), with the survey being voluntary and the results aggregated. Some rely on consent. That choice belongs to the employer as controller, and they are responsible for telling their staff which applies and for completing a legitimate interests assessment where relevant.

For our own contractual and billing records we rely on performance of a contract and on our legal obligations.

Survey answers are kept for as long as your employer is a client and after their account closes. They are stored against the survey round and the department, with no email address or other identifier attached. We do not delete them on a timetable, because the value of the tracker is the history it builds up.

Email addresses are kept only while they are needed. When someone leaves, your employer can deactivate them, which keeps the address and stops sending surveys, or erase them, which removes the address permanently. Erasing someone does not change any figure already reported, because the survey history is kept without the address attached. Your employer can also ask us to delete their whole email list at any time.

When your employer closes their account or stops paying, surveys stop at the end of the paid period: no new survey is sent after that, and a survey already open runs to its closing date. For 90 days after that, your employer can still log in and view past results. At the end of the 90 days, every email address on the employer’s list is deleted. Once the list is gone, nothing links any answer to a person. The answers are kept in that anonymous form and used only in aggregated research and benchmarks that identify no organisation, department or individual. Billing records are kept for six years, as HMRC requires.

Data is hosted in the UK: the database in London (Supabase, on AWS eu-west-2) and the application in London (Vercel). We use a small number of processors, each under contract and each with their own security commitments:

Where any processor transfers data outside the UK or EEA, that transfer is covered by the UK International Data Transfer Addendum or Standard Contractual Clauses.

Data is encrypted in transit and at rest. Each organisation’s data is isolated at the database level, so one client’s administrators cannot query another’s records. Survey links are single-use and expire when the round closes. Access to production systems is limited to named staff and protected by multi-factor authentication.

If we ever suffer a breach affecting personal data, we will notify the affected employer without undue delay and, where required, the ICO within 72 hours.

Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability.

If you are an employee: your employer is the controller, so please direct requests to them in the first instance, usually HR. We will support them in responding. Note that because survey answers are stored without any identifier linking them to you, we generally cannot locate or extract an individual’s answers on request; we can act on your email address, which is the identifiable record we hold.

If you are a client or contacted us through this site: email us at hello@wellometry.com. We respond within one month.

You can also complain to the Information Commissioner’s Office at ico.org.uk.

We use only what is necessary to run the service: a session cookie to keep administrators logged in, and a cookie that remembers a super-admin is viewing a client account for support. There is no advertising, no tracking across sites and no third-party analytics on the survey pages. Employees completing a survey are not tracked.

The marketing pages and the signup page use Vercel Web Analytics, which sets no cookies and records page views, referrers and countries. It does not identify anyone. It is not loaded on the survey pages, the login page or in the dashboard.

We will post changes to this page here and update the date at the top. Material changes affecting clients will be notified by email.