Thrive Therapeutic Software Ltd (Thrive) is committed to protecting your personal information and being transparent about how we use it, whether you use our App, Thrive Mental Wellbeing (Thrive App), or are applying for a job with us, or we have a commercial relationship.
This Privacy Notice gives you a clear explanation about how Thrive collects personal information (or “personal data”), the types of personal information we collect, how we use it (or “process” it) and whether we share it with anyone else. It also explains your legal rights and choices regarding the information you provide to us.
Children's Privacy: Our services are not aimed at children. In the limited circumstances where we may collect and use personal information about children, we will comply with relevant law and guidelines.
Please take the time to read this information carefully and if you have any questions about it please contact Thrive's Data Protection Officer (DPO), whose contact details can be found below.
If you need to contact us about this Privacy Notice or have any query relating to your personal information, you can contact us by email or post. Please contact our Data Protection Officer using any one of the contact details below.
Data Protection Officer
Thrive Therapeutic Software Limited
Celixir House
Stratford Business & Technology Park
Innovation Way
Banbury Road
Stratford Upon Avon
Warwickshire
CV37 7GZ
dpo@thrive.uk.com
Thrive is responsible for how and why your personal data is used. The legal phrase for this is Data Controller (or “Controller”).
Thrive is a limited liability company incorporated in England & Wales with registration number 07928073.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. For example:
We have also put in place procedures to deal with any suspected or actual personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We restrict access to your personal data to those employees, agents, contractors and third-party service providers that have a legitimate requirement to be able to access your information. In any event, we have taken the necessary measures to ensure that these other parties handle your information securely and only on our instructions.
No data transmission over the internet can be guaranteed to be completely secure. So, whilst we strive to safeguard your personal data, we cannot guarantee the security of any information you provide online and you do this at your own risk.
If you would like more specific information about our security measures please contact our DPO.
By using our website, you agree that we can use cookies for the purposes described below on your device unless you adjust your browser to manage or prevent cookies.
In addition to the information which you supply to us, our website uses some standard technology to automatically collect further information from your visit, through the use of cookies.
Cookies are small text files which are downloaded to your device when you visit our website. Software on your device, for example, a web browser, stores the cookies and sends them back to our website next time you visit. Cookies allow websites to recognise your device and preferences and provide information to the owners of sites which can be used to improve your online experience. Cookies allow us to manage user preferences, enable content, recognise repeat users and gather analytic and usage data so we can observe behaviour and compile aggregate data to improve our website for you.
We do not use cookies to deliver targeted advertising.
Please see our cookie policy to learn more about how we use cookies and how to opt out of using them.
Our website may contain links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their Privacy Notices. When you leave our website, we recommend that you read the Privacy Notice of any website you visit.
Some of our service providers are located outside the UK, and so to use their services your personal data may be transferred outside the UK.
Whenever we transfer your personal information to countries outside the UK, we will process and safeguard your information in accordance with this Privacy Notice, ensure that it is adequately protected and that the transfer complies with data protection law.
We only transfer personal information to other countries when it is necessary for the services we provide you, or it is necessary for the establishment, exercise or defence of legal claims or subject to safeguards that assure the protection of your personal information. For example, we will ensure that your data is transferred:
If you would like more information about the safeguards and mechanisms we deploy to ensure your information is adequately protected when it is transferred outside the UK, please contact Thrive's DPO.
You have the following legal rights in relation to the processing of your personal information:
You may exercise any of the above rights, at any time, by emailing dpo@thrive.uk.com together with a proof of your identity, i.e. a copy of your ID card, or passport, or any other valid identifying document.
If you believe that your information protection rights may have been breached, you have the right to lodge a complaint with the applicable supervisory authority, or to seek a remedy through the courts.
If any of the personal data that you have provided to us changes, for example, if you change your email address or if you wish to cancel any request you have made of us, or if you become aware we have any inaccurate personal data about you, please let us know by sending an email to dpo@thrive.uk.com.
We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.
If we were to sell or transfer Thrive to another organisation, your records would also transfer to the new owner. Limited information may also be shared, where required, with legal and other professional advisors involved in that transaction.
The reason we would transfer your records is to minimise the disruption to the ongoing operation of Thrive and to ensure we and a new owner were able to comply with our legal obligations regarding the retention of such records, including the ongoing delivery of care to our members and others.
We will update and change this Privacy Notice from time to time to reflect any significant changes to how we process your personal data or changing legal requirements. Any changes we may make to this Privacy Notice in the future will be posted on our website on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates to our Notice to make sure you are happy with any changes.
The type of personal information we collect and how we use it will vary depending on our relationship. To find out more about how we use your personal information, you should select and read the detailed Privacy Notice that applies to our relationship.
Simply choose from the options below:
Thrive expects to collect your personal information directly from you and indirectly via third-party sources. For example:
The UK General Data Protection Regulation (UK GDPR) (and if applicable, the EU GDPR) requires us to have a legal basis to justify using your personal data. The legal basis used will vary, depending on why we are using your personal data. If we process “special categories of personal information” such as health or medical information, we must have an additional legal basis to justify using it.
The table below identifies the purposes for using your personal data together with the legal basis for doing so under UK GDPR (and EU GDPR if applicable):
| Purpose | Legal Basis for Processing |
|---|---|
| Processing your enquiry, online form or correspondence, setting up a new account, managing your consultations and other appointments. |
|
| Legal Basis for Special Category Personal Data | |
|
|
| Purpose | Legal Basis for Processing |
| Processing your personal data through the Thrive App. Managing your consultations and appointments. Providing you with healthcare, services through the Thrive App and other Thrive Services. |
|
| Legal Basis for Special Category Personal Data | |
|
|
| Purpose | Legal Basis for Processing |
| Liaising with other healthcare professionals about your care. Contacting others where necessary such as your support/emergency contacts. Sharing your personal data with external third-parties for regulatory or legal reasons such as safeguarding purposes. |
|
| Legal Basis for Special Category Personal Data | |
|
|
| Purpose | Legal Basis for Processing |
| For internal training, security and overall quality purposes. This may include monitoring phone calls and other correspondence and conducting surveys. |
|
| Legal Basis for Special Category Personal Data | |
|
|
| Purpose | Legal Basis for Processing |
| Investigating complaints or claims, defending or exercising our legal rights, complying with our legal and regulatory obligations including clinical guidelines provided by NHS Digital. |
|
| Legal Basis for Special Category Personal Data | |
|
|
| Purpose | Legal Basis for Processing |
| Managing our business: the retaining of client and patient records, maintaining and retaining accounting records, analysis of financial results, internal audit requirements, receiving professional advice (such as tax, financial, legal or public relations advice) |
|
| Legal Basis for Special Category Personal Data | |
|
|
| Purpose | Legal Basis for Processing |
| Disclosing and transferring some or all of your records to a third party where we sold or transferred all or part of our business or any of its assets |
|
| Legal Basis for Special Category Personal Data | |
|
We may share your personal data with third parties listed below for the purposes set out in the above table (Purposes/Legal Bases). Where your personal data is shared, only the minimum amount that is necessary to fulfil the purpose is shared. We always ensure that data is shared securely and strictly in accordance with the law.
Within the Thrive App we provide validated clinical questionnaires that screen for the presence of various mental health symptoms including symptoms of depression, anxiety, stress and other conditions. Once you complete one of these questionnaires we calculate your score and provide you with the questionnaire's standardised results. Based on these results we provide you with goals and recommendations and, where guided self-help is provided, one of our psychological therapists may reach out to you to confirm if you would like additional support. You are free to ignore or change any of these goals and recommendations. Where guided self-help is provided, you are also free to reach out to our psychological therapists at any time regardless of the results of those screening questionnaires.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Thrive follows the Records Management Code of Practice for Health and Social Care 2021 where it processes personal data in connection with the Thrive App and other Thrive services.
By law, we are required to retain basic information about our customers such as contact details, identity, financial and transaction data for six years after they cease being our customers for tax purposes.
In some circumstances, you have the legal right to ask us to delete your personal data. More information about this right can be found above in the section called “Your Legal Rights”.
If you would like more information about how long we retain specific records relating to you please contact Thrive's DPO.
For general information about how we collect and process your personal data including for example, how we keep it secure, your legal rights and who to contact if you have any questions about this Privacy Notice or your personal data, please click here.
The following information forms part of our Privacy Notice for job applicants. It sets out further important information about the personal data that Thrive Therapeutic Software Ltd, holds about you and how that information may be used.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
Special Category Personal Data specifically means personal data relating your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data.
We may collect and hold the following special categories of information about you: Information about your health such as details of medical conditions, sickness records, Occupational Health records; race; ethnicity; sex life or sexual orientation; religious or philosophical beliefs and details of trade union membership.
We may also record any criminal convictions (including offences and alleged offences and any court proceedings or sentence) if you have given this information to us or we have obtained it from a third party such as the Disclosure and Barring Service.
In most cases, Thrive collects personal data directly from candidates, through the application and recruitment process. However, sometimes, your personal data is obtained indirectly from third parties such as an employment agency. For example:
Thrive collects your personal data directly from you in these ways:
Thrive may occasionally collect your personal data indirectly from third parties in these ways:
If you provide personal information to us about others you should inform the individual about the contents of this Privacy Notice. We will process such information in accordance with this Privacy Notice.
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (including an employment contract). In this case, we may have to cancel the contract we have with you or are trying to enter into with you, but we will notify you if this is the case at the time.
We will process your personal information in accordance with this Privacy Notice and only where we are legally permitted to do so. The main purposes for collecting and using your personal data are to facilitate your application for employment with us and so that we can comply with our legal and regulatory requirements. More information about how we use your personal data is set out below.
Data protection law requires us to have a legal basis to justify using your personal data. The legal basis used will vary, depending on why we are using your personal data. If we process more sensitive personal data, known as “special category personal data”, we must have an additional legal basis to justify using it.
You will find details of the “legal bases” we rely upon for each of our processing purposes set out below.
Thrive will use your personal data to assess your suitability for the role you have applied for including your qualifications, skills and experience. We may carry out background checks, take up references, confirm your qualifications and, where relevant confirm that you have the right to work in the UK. We will use your name and contact details to correspond with you about your application and for monitoring outcomes generally. Your information may be used to comply with our equal opportunity monitoring and reporting obligations are met. We will retain some of the recruitment records for a certain period in accordance with our Data Retention Policy.
Legal Bases:
Additional legal bases for special categories of personal data:
Legal Bases:
Thrive does not use your personal information for automated decision making or profiling purposes.
Automated decision-making is the process of using personal data to make a decision that produces significant legal effects for the individual involved, and that decision is made solely by automated means without a human being involved at all.
Profiling means the analysis of certain characteristics of an individual's personality, behaviour, interests and habits to find out more about their preferences or to make predictions about their behaviour and/ or to make decisions about them.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances, we may pseudonymise or anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
In some circumstances, you have the legal right to ask us to delete your personal data. More information about this right can be found above in the section called “Your Legal Rights”.
If you would like more information about how long we retain specific records relating to you please contact Thrive's DPO.
For general information about we collect and process your personal data including for example, how we keep it secure, your legal rights and who to contact if you have any questions about this Privacy Notice or your personal data. Please click here.
The following information forms part of our Privacy Notice for Thrive's commercial contacts (Including our Corporate Partners or employees of a Corporate Partner or any other person which Thrive contacts or interacts with in the context of establishing, developing, maintaining, servicing or otherwise furthering the business relationship). It sets out further important information about the personal data that Thrive Therapeutic Software Ltd, holds about you and how that information may be used.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
Special Category Personal Data specifically means personal data relating your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data.
Thrive does not expect to routinely process any special category personal data in relation to its business contacts.
Most of the personal data we process, you have provided directly to us. Other personal data may be provided by your employer, our corporate partners or other instances involved in the initiation of your business relationship and/or the execution of contracts with our corporate partners.
In addition, we may process personal data which we permissibly obtain from publicly accessible third-party sources (such as LinkedIn) or that are legitimately transmitted to us by third parties (such as credit agencies).
If you provide personal information to us about others you should inform the individual about the contents of this Privacy Notice. We will process such information in accordance with this Privacy Notice.
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel the contract we have with you or are trying to enter into with you, but we will notify you if this is the case at the time.
We will process your personal information in accordance with this Privacy Notice and only where we are legally permitted to do so. Thrive processes personal data of its business contacts for various business purposes in connection with your business relationship with Thrive or our corporate partners. These primarily include:
Data protection law requires us to have a legal basis to justify using your personal data. The legal basis used will vary, depending on why we are using your personal data. If we process more sensitive personal data, known as “special category personal data”, we must have an additional legal basis to justify using it.
Thrive processes personal relating to its Business Contacts based on multiple different legal bases: Most commonly, we will use your personal data in the following circumstances:
Generally, we would not routinely expect to rely on consent as a legal basis for processing your personal data other than in exceptional circumstances. For example, where we propose to publish an image of you on our website taken at one of our events. Where we do rely on consent to process your personal data, you have the right to withdraw that consent at any point in time. Details of how to do that can be found here.
We may share your personal data with third parties listed below for the purposes set out above (Purposes/Legal Bases). Where your personal data is shared, we only share the minimum amount of information required to fulfil the purpose of sharing. It is shared securely and strictly in accordance with the law.
Automated decision-making is the process of using personal data to make a decision that produces significant legal effects for the individual involved, and that decision is made solely by automated means without a human being involved at all.
Profiling means the analysis of certain characteristics of an individual's personality, behaviour, interests and habits to find out more about their preferences or to make predictions about their behaviour and/ or to make decisions about them.
Thrive does not use your personal information for automated decision making or profiling purposes.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances, we may pseudonymise or anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
In some circumstances, you have the legal right to ask us to delete your personal data. More information about this right can be found above in the section called “Your Legal Rights”.
If you would like more information about how long we retain specific records relating to you please contact Thrive's DPO.
For general information about we collect and process your personal data including for example, how we keep it secure, your legal rights and who to contact if you have any questions about this Privacy Notice or your personal data. Please click here.