EverRhythm for Work — Privacy Policy

Policy status: governance and external review required

At EverRhythm, privacy is not a feature—it is the foundation of our platform. This Privacy Policy outlines how data is collected, processed, and protected within the EverRhythm for Work environment, explicitly detailing the strict boundaries between employer access and employee private medical data.

1. Data Controller & Processor Roles

Controller, joint-controller and processor roles depend on the actual Work deployment and data flow. The following describes the intended separation, not a universal legal allocation:

Organisational processing: An employer will commonly determine purposes for HR and organisational processing, but the executed agreement must document the actual role allocation.
Private Personal processing: Private health tracking is not made available to an employer merely because the user is linked to that employer. The lawful role and basis for this processing must be assessed independently of the employment relationship.

2. Categories of Data Collected

We collect several categories of data to operate the platform:

Organisational Data: Company name, billing details, and administrator contact info.
Employment Data: Employee names, work emails, department affiliations, leave balances, and shift schedules.
Wellbeing Data: Sleep metrics, mood ratings, heart rate variability, medical conditions, and symptom logs (kept strictly confidential from the employer).
Research Data: Anonymised participation data for workplace wellbeing studies (if the employee explicitly opts in).

3. What Employers Can See

Employers have access to specific, limited datasets necessary for HR operations and high-level organisational planning:

HR records, contracts, and uploaded compliance documents.
Leave requests, approvals, and absence records.
Organisational wellbeing reporting: Any reporting must use an expressly authorised privacy-preserving route. Aggregation, anonymisation and any minimum-group rule must match the implemented and tested reporting design; a fixed threshold is not published here as a universal anonymity guarantee.

4. What Employers CANNOT See

An employment relationship does not itself authorise access to an individual's private Personal health data. EverRhythm's intended authorization boundary prevents employer access through the Work relationship alone. Subject to the exact implemented route and any separate explicit user-authorised disclosure, employers do not receive:

Individual mood logs, stress logs, or journal entries.
Medication records, prescriptions, or treatment plans.
Menstrual cycle data, fertility information, or pregnancy logs.
Individual symptom records or chronic illness details.
Crisis activity, safeguarding alerts, or counselling usage.
Raw wearable device data (e.g., specific heart rate readings).
Research decisions, survey responses, or AI health coaching conversations.

5. Data Processing Legal Basis

We process data under the following legal bases as defined by the GDPR and UK DPA:

Contract Performance: To provide HR management tools and platform access.
Legitimate Interest: To secure the platform and improve the software.
Special-category processing: A valid Article 6 basis and separate Article 9 condition must be documented for the actual purpose. Employee consent is not treated as the default answer where power imbalance prevents freely given consent.
Other lawful bases: Contract, legitimate interests, legal obligation or another basis may apply only where the statutory conditions for the specific purpose are met.

6. Data Retention & Deletion

Retention and deletion depend on the data category, purpose, contract and applicable law. EverRhythm is reconciling purpose-specific retention periods and evidence of disposal. Ending an employment or customer relationship must not silently grant the employer control over private Personal data, and any continuation of a Personal service requires its own valid user relationship and privacy basis.

7. GDPR / UK DPA Compliance

EverRhythm assesses Work processing against applicable UK data-protection requirements. High-risk employee wellbeing, health and AI processing is subject to DPIA governance; publication of this policy is not evidence that every deployment-specific assessment has been approved.

8. Employee Rights

Employees may have rights including access, rectification, erasure, portability, objection and restriction, subject to the applicable law, processing purpose and legal conditions. Requests can be made through available product controls or the privacy contact below; EverRhythm does not infer a formally appointed DPO from this contact route.

9. International Data Transfers

Provider locations and transfer routes must be verified for the actual deployment. Where UK restricted-transfer rules apply, the applicable transfer route and assessment must be evidenced before it is represented as approved.

10. Third-Party Sub-processors

EverRhythm maintains a technical-provider reconciliation process. A provider is not described as an approved sub-processor solely because its technology appears in the codebase; legal role, contract, processing scope, location, security review and transfer position require separate evidence.

11. Data Breach Response

EverRhythm assesses each personal-data breach against the applicable legal thresholds and timing rules. Under UK GDPR, regulator notification and communication to affected individuals use different risk thresholds. Incident records must preserve the assessment, decision, timing and actions rather than applying a universal 72-hour promise to every recipient.

12. Contact Information

For privacy questions about EverRhythm for Work, contact privacy@everrhythm.health. Formal privacy roles and postal contact details are governed separately and should be published only when verified.