What we hold, why, and for how long

To invite someone to a survey we need one thing about them: a work email address. We do not ask employers for names, job titles, employee numbers, dates of birth or any HR record.

When a survey is submitted, the answers are stored without any reference to the person who gave them. Employers never see individual responses. They see averages, and only once enough people in a group have answered.

The survey asks 25 questions about the experience of work — job satisfaction, workload, support from managers and colleagues, physical safety at work, and opportunities to grow. Questions read like “My workload is manageable” and “I receive recognition for my work”.

It does not ask about symptoms, diagnoses, medication, treatment, disability or any medical history. Nothing collected is special category data under Article 9 of the UK GDPR, and Wellometry is not a medical service, does not provide clinical advice and does not diagnose anyone.

A submitted response is stored with no employee identifier on it. The invitation and the response are separate records, and the answers cannot be viewed per-person through the product: there is no screen, export or report anywhere in Wellometry that shows an employer who said what.

Results are also suppressed for small groups. By default, a department with fewer than five people, or fewer than five responses in the period shown, is not broken out at all — those answers still count towards the organisation-wide figure, but nothing is reported about the group itself. Employers can raise that threshold; they cannot lower it below five.

Free-text comments carry the greatest risk of someone identifying themselves by what they write. Employers can turn them off entirely, and where they are enabled they are subject to the same suppression rules. If you write a comment, please avoid naming yourself or others.

Where an employer uses Wellometry to survey their staff, the employer is the data controller and Wellometry is the data processor. They decide who is surveyed and why; we process it on their instructions and for no other purpose. A data processing agreement is available to every client and forms part of the contract.

For this website — including demo requests — Wellometry is the controller of the details you send us.

We do not sell data, we do not share it with advertisers, and we do not use survey answers to train machine learning models.

Employers typically rely on legitimate interests — understanding and improving working conditions — with the survey being voluntary and the results aggregated. Some rely on consent. That choice belongs to the employer as controller, and they are responsible for telling their staff which applies and for completing a legitimate interests assessment where relevant.

For our own contractual and billing records we rely on performance of a contract and on our legal obligations.

Results are kept for as long as the organisation is a client, and we do not delete them on a timetable. Comparing across years is the point of measuring on a cycle: an employer who has run Wellometry for five years can see all five. The trend history is built from per-round totals — a response count and a set of scores for each round and each department — which carry no email address, no comment text and no reference to any individual.

The individual answers behind those totals, and any free-text comments, are kept while the employer’s account is open. An employer can ask us to delete them at any point, and doing so does not affect the trend history above.

Email addresses are the exception, and are kept only while they are needed. An address is held while that person is on the employer’s list and is removed when the employer removes them or closes the account. Nothing about the long-term trend view depends on keeping it.

When an account closes we delete the employer’s email list within 90 days. Billing records are kept for six years, as HMRC requires.

Data is hosted in [TODO: confirm Supabase project region]. We use a small number of processors, each under contract and each with their own security commitments:

Where any processor transfers data outside the UK or EEA, that transfer is covered by the UK International Data Transfer Addendum or Standard Contractual Clauses.

Data is encrypted in transit and at rest. Each organisation’s data is isolated at the database level, so one client’s administrators cannot query another’s records. Survey links are single-use and expire when the round closes. Access to production systems is limited to named staff and protected by multi-factor authentication.

If we ever suffer a breach affecting personal data, we will notify the affected employer without undue delay and, where required, the ICO within 72 hours.

Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability.

If you are an employee: your employer is the controller, so please direct requests to them in the first instance — usually HR. We will support them in responding. Note that because survey answers are stored without any identifier linking them to you, we generally cannot locate or extract an individual’s answers on request; we can act on your email address, which is the identifiable record we hold.

If you are a client or contacted us through this site: email us at hello@wellometry.com. We respond within one month.

You can also complain to the Information Commissioner’s Office at ico.org.uk.

We use only what is necessary to run the service: a session cookie to keep administrators logged in, and a cookie that remembers a super-admin is viewing a client account for support. There is no advertising, no tracking across sites and no third-party analytics on the survey pages. Employees completing a survey are not tracked.

We will post changes to this page here and update the date at the top. Material changes affecting clients will be notified by email.