Privacy Policy

Health Screening

Within the Thrive App we provide validated clinical questionnaires that screen for the presence of various mental health symptoms including symptoms of depression, anxiety, stress and other conditions. Once you complete one of these questionnaires we calculate your score and provide you with the questionnaire's standardised results. Based on these results we provide you with goals and recommendations and, where guided self-help is provided, one of our psychological therapists may reach out to you to confirm if you would like additional support. You are free to ignore or change any of these goals and recommendations. Where guided self-help is provided, you are also free to reach out to our psychological therapists at any time regardless of the results of those screening questionnaires.

How Long We Keep Your Personal Data For

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Thrive follows the Records Management Code of Practice for Health and Social Care 2021 where it processes personal data in connection with the Thrive App and other Thrive services.

By law, we are required to retain basic information about our customers such as contact details, identity, financial and transaction data for six years after they cease being our customers for tax purposes.

In some circumstances, you have the legal right to ask us to delete your personal data. More information about this right can be found above in the section called “Your Legal Rights”.

If you would like more information about how long we retain specific records relating to you please contact Thrive's DPO.

Other General Information About How We Process Your Personal Data

For general information about how we collect and process your personal data including for example, how we keep it secure, your legal rights and who to contact if you have any questions about this Privacy Notice or your personal data, please click here.

Privacy Notice for Job Applicants

The following information forms part of our Privacy Notice for job applicants. It sets out further important information about the personal data that Thrive Therapeutic Software Ltd, holds about you and how that information may be used.

The Personal Data We Collect About You

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: such as your name, marital status and dependants, title, date of birth and gender, name of next of kin;
• Contact Data: includes billing address, delivery address, email address and telephone numbers, next of kin contact details;
• Recruitment Information: such as “right to work” permit documentation (if relevant), current or former employment details, professional qualifications, references and other information included in a Curriculum Vitae or cover letter or application form as part of the application process, photograph ID, work history and experience and interview records including the output from tasks performed during the recruitment process;
• Financial Data: We may process information about your current remuneration and benefits should you choose to provide this;
• CCTV footage: and other information obtained through electronic means such as swipe card records;
• Other Data: Where your interview was conducted by video conference, we may retain a digital recording together with other information produced during the recruitment process.

Special Categories of Personal Data

Special Category Personal Data specifically means personal data relating your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data.

We may collect and hold the following special categories of information about you: Information about your health such as details of medical conditions, sickness records, Occupational Health records; race; ethnicity; sex life or sexual orientation; religious or philosophical beliefs and details of trade union membership.

We may also record any criminal convictions (including offences and alleged offences and any court proceedings or sentence) if you have given this information to us or we have obtained it from a third party such as the Disclosure and Barring Service.

Where Do We Obtain Your Personal Data From?

In most cases, Thrive collects personal data directly from candidates, through the application and recruitment process. However, sometimes, your personal data is obtained indirectly from third parties such as an employment agency. For example:

Thrive collects your personal data directly from you in these ways:

• When you apply direct for a job with Thrive;
• When you submit an enquiry via our website, or correspond with us by telephone, email or post about your application or prospective application.

Thrive may occasionally collect your personal data indirectly from third parties in these ways:

• The Disclosure and Barring Service;
• Overseas Police agencies (in the context of a job application);
• Referees that have sent us a reference about you;
• Professional and educational bodies such as the Nursing and Midwifery Council (NMC), Health and Care Professions Council (HCPC) in the context of confirmation of qualifications or professional regulatory matters;
• A family member or other person communicating with us on your behalf;
• Occasionally, government agencies such as HMRC or the Home Office.

If You Provide Us with Personal Information About Others

If you provide personal information to us about others you should inform the individual about the contents of this Privacy Notice. We will process such information in accordance with this Privacy Notice.

If You Fail to Provide Personal Data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (including an employment contract). In this case, we may have to cancel the contract we have with you or are trying to enter into with you, but we will notify you if this is the case at the time.

How We Use Your Personal Data

We will process your personal information in accordance with this Privacy Notice and only where we are legally permitted to do so. The main purposes for collecting and using your personal data are to facilitate your application for employment with us and so that we can comply with our legal and regulatory requirements. More information about how we use your personal data is set out below.

Data protection law requires us to have a legal basis to justify using your personal data. The legal basis used will vary, depending on why we are using your personal data. If we process more sensitive personal data, known as “special category personal data”, we must have an additional legal basis to justify using it.

You will find details of the “legal bases” we rely upon for each of our processing purposes set out below.

Purpose: The Recruitment Process

Thrive will use your personal data to assess your suitability for the role you have applied for including your qualifications, skills and experience. We may carry out background checks, take up references, confirm your qualifications and, where relevant confirm that you have the right to work in the UK. We will use your name and contact details to correspond with you about your application and for monitoring outcomes generally. Your information may be used to comply with our equal opportunity monitoring and reporting obligations are met. We will retain some of the recruitment records for a certain period in accordance with our Data Retention Policy.

Legal Bases:

• Where the use is necessary in connection with your employment contract with us.
• Where the use is necessary in order for us to comply with our legal obligations. For example, we may have a legal duty to carry out background checks.
• Where the use is necessary for our legitimate interests including carrying out our assessment to see if you are suitable for the role you have applied for, complying with our legal obligations and developing our recruitment process, providing these interests are not overridden by your privacy rights and freedoms.

Additional legal bases for special categories of personal data:

• Where the use is necessary in order for us to comply with our obligations as an employer. For example, we may need to process your health information to determine if we need to make reasonable adjustments so that you can attend the interview and carry out the job you have applied for and also to confirm your fitness to perform the job in question.
• Where the use is necessary for reasons of substantial public interest based upon law. For example, where the job you are applying for entitles or requires us to carry out criminal records checks, to deal with insurance-related matters or fraud prevention and detection.
• Occasionally, where the use is necessary to establish, exercise or defend our legal rights.

Purpose: Complying with our legal obligations and regulatory requirements

Legal Bases:

• Where the use is necessary for us to comply with a legal obligation. For example, we may have a legal duty to carry out background checks or report certain concerns to a regulatory body.
• Where the use is necessary for fulfilling our legitimate interests including compliance with relevant statutory, regulatory or legal requirements, providing those interests are not overridden by your privacy rights and freedoms.

Additional legal bases for special categories of personal data:

• Where the use is necessary in order for us to establish, exercise or defend our legal rights.
• Where the use is necessary for reasons of substantial public interest on the basis of law. For example, where it is necessary to process your personal information for the purposes of crime prevention or safeguarding purposes or to protect any individual from neglect or harm.

Who Do We Share Your Personal Data With?

• We may share your personal data with third parties listed below for the purposes set out above (Purposes/Legal Bases). Where your personal data is shared, we only share the minimum amount of information required to fulfil the purpose of sharing. It is shared securely and strictly in accordance with the law.
• Other internal staff at Thrive that are involved in the recruitment process, management of staff and record keeping.
• Your previous employers, referees, other current employers, staffing agencies, educational establishments and professional bodies.
• Disclosure and Barring Service or Disclosure Scotland.
• Professionals, clinicians, other staff and our advisors in order to deal with questions, complaints or claims, including those made by yourself.
• HM Revenue and Customs, our regulators such as the Care Quality Commission and the Information Commissioner's Office (ICO) and other authorities based in the UK and other relevant jurisdictions who require us to report processing activities in certain circumstances.
• The police and other regulatory third parties in connection with the prevention and detection of crime or for safeguarding purposes.
• Certain external third-party service providers whom we have engaged to perform services on our behalf and under our instructions. For example, our cloud service provider who provides our virtual servers. We select our third-party service providers with care and only share the information that is necessary to provide the service. We have a contract with them that requires these third- party service providers to process your personal data only on our instructions, securely and in accordance with relevant data protection laws.
• Third-party professional advisors including lawyers, accountants, auditors and insurers.
• Anyone that has been appointed or you have asked to communicate with us on your behalf, such as your insurer, individuals you have named as an emergency contact, such as your next of kin.
• Third parties to whom we may sell, transfer or merge parts of our business or assets.

Automated Decision-Making and Profiling

Thrive does not use your personal information for automated decision making or profiling purposes.

Automated decision-making is the process of using personal data to make a decision that produces significant legal effects for the individual involved, and that decision is made solely by automated means without a human being involved at all.

Profiling means the analysis of certain characteristics of an individual's personality, behaviour, interests and habits to find out more about their preferences or to make predictions about their behaviour and/ or to make decisions about them.

How Long We Keep Your Personal Data For

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, we may pseudonymise or anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

In some circumstances, you have the legal right to ask us to delete your personal data. More information about this right can be found above in the section called “Your Legal Rights”.

If you would like more information about how long we retain specific records relating to you please contact Thrive's DPO.

Other General Information About How We Process Your Personal Data

For general information about we collect and process your personal data including for example, how we keep it secure, your legal rights and who to contact if you have any questions about this Privacy Notice or your personal data. Please click here.

Privacy Notice for Commercial Contacts

The following information forms part of our Privacy Notice for Thrive's commercial contacts (Including our Corporate Partners or employees of a Corporate Partner or any other person which Thrive contacts or interacts with in the context of establishing, developing, maintaining, servicing or otherwise furthering the business relationship). It sets out further important information about the personal data that Thrive Therapeutic Software Ltd, holds about you and how that information may be used.

The Personal Data We Collect About You

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: such as your name, information about your job title and hierarchical position; and educational level or work experience;
• Business Contact Data: including company address, business telephone number and e-mail address;
• Information you provide us during the course of our business relationship, including in response to corporate surveys or questionnaires or other correspondence;
• Data from initiation, maintenance and execution of our business relationship, including performed and planned orders and related data such as delivery modalities or insurance coverages; user login and subscription data; use of our web services or newsletters; and data about your budget;
• Company data of our Corporate Partners, such as company name and company business registration number; information from our due-diligence or other onboarding procedures; or our Corporate Partner's business needs;
• Data relating to the assertion or defence against legal claims, including the prevention of misconduct; compliance checks or investigations; and information regarding compliance violations or other infringements;
• Personal contact details such as your mobile phone number where you choose to provide these to us;
• Other Data: Where we conduct meetings via video conference, we may retain the recording together with other notes relating to our meeting.

Special Categories of Personal Data

Special Category Personal Data specifically means personal data relating your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data.

Thrive does not expect to routinely process any special category personal data in relation to its business contacts.

Where Do We Obtain Your Personal Data From?

Most of the personal data we process, you have provided directly to us. Other personal data may be provided by your employer, our corporate partners or other instances involved in the initiation of your business relationship and/or the execution of contracts with our corporate partners.

In addition, we may process personal data which we permissibly obtain from publicly accessible third-party sources (such as LinkedIn) or that are legitimately transmitted to us by third parties (such as credit agencies).

If You Provide Us with Personal Information About Others

If you provide personal information to us about others you should inform the individual about the contents of this Privacy Notice. We will process such information in accordance with this Privacy Notice.

If You Fail to Provide Personal Data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel the contract we have with you or are trying to enter into with you, but we will notify you if this is the case at the time.

How We Use Your Personal Data

We will process your personal information in accordance with this Privacy Notice and only where we are legally permitted to do so. Thrive processes personal data of its business contacts for various business purposes in connection with your business relationship with Thrive or our corporate partners. These primarily include:

• For the initiation, performance and execution of a contract with you or our Corporate Partners, including to meet our contractual obligations; necessary due diligence and other onboarding requirements.
• For market analysis, including through surveys, to better understand the markets in which we do business; and for product and service development.
• For account management and maintenance of our supplier database.
• For business communication and promotion of our products and services.
• In order to comply with our legal and regulatory obligations.
• For the security of Thrives premises, IT security and in connection with data breach procedures.
• For asserting or the defence of legal claims or the prevention of misconduct, compliance violations or other infringements, such as routine inspections; internal investigations; or dispute resolution cases.
• In connection with our customer services activities, such as responding to your correspondence, queries or complaints.
• For customer relationship management, including listing important contacts for our business; connecting individuals with accounts of our corporate partners and for customers surveys.
• For the prevention and detection of crime.

Data protection law requires us to have a legal basis to justify using your personal data. The legal basis used will vary, depending on why we are using your personal data. If we process more sensitive personal data, known as “special category personal data”, we must have an additional legal basis to justify using it.

Thrive processes personal relating to its Business Contacts based on multiple different legal bases: Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform a contract that we are about to enter into or have entered into with you. For example:
  • Where we need to process your personal data in order to initiate or perform a contract between us.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example:
  • To grow the Company's business by networking and market research and analysis of potential business opportunities as well as through direct marketing, including marketing activities and communications or regarding product or service development processes.
• Where we need to comply with a legal obligation. For example:
  • Where we need to process your personal data to comply with a court order or a specific statutory obligation.

Generally, we would not routinely expect to rely on consent as a legal basis for processing your personal data other than in exceptional circumstances. For example, where we propose to publish an image of you on our website taken at one of our events. Where we do rely on consent to process your personal data, you have the right to withdraw that consent at any point in time. Details of how to do that can be found here.

Who Do We Share Your Personal Data With?

We may share your personal data with third parties listed below for the purposes set out above (Purposes/Legal Bases). Where your personal data is shared, we only share the minimum amount of information required to fulfil the purpose of sharing. It is shared securely and strictly in accordance with the law.

• Other internal staff within Thrive;
• Certain external third-party service providers whom we have engaged to perform services on our behalf and under our instructions. For example, our cloud service provider who provides our virtual servers. We select our third-party service providers with care and only share the information that is necessary to provide the service. We have a contract with them that requires these third-party service providers to process your personal data only on our instructions, securely and in accordance with relevant data protection laws;
• Third party professional advisors such as lawyers, accountants, auditors and insurers;
• Third parties to whom we may sell, transfer or merge parts of our business or assets.

Automated Decision-Making and Profiling

Automated decision-making is the process of using personal data to make a decision that produces significant legal effects for the individual involved, and that decision is made solely by automated means without a human being involved at all.

Profiling means the analysis of certain characteristics of an individual's personality, behaviour, interests and habits to find out more about their preferences or to make predictions about their behaviour and/ or to make decisions about them.

Thrive does not use your personal information for automated decision making or profiling purposes.

How Long We Keep Your Personal Data for

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, we may pseudonymise or anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

In some circumstances, you have the legal right to ask us to delete your personal data. More information about this right can be found above in the section called “Your Legal Rights”.

If you would like more information about how long we retain specific records relating to you please contact Thrive's DPO.

Other General Information About How We Process Your Personal Data

For general information about we collect and process your personal data including for example, how we keep it secure, your legal rights and who to contact if you have any questions about this Privacy Notice or your personal data. Please click here.