Privacy Policy

How do we use your data?

• When you are invited to join the platform. If you receive an invitation to join our platform, this is because your employer has asked us to invite you to use MyMynd. Your employer will have sent us your name, work email address and employment data (role/team/department) in advance, so we can verify you are entitled to use MyMynd. Until you decide to register directly on MyMynd, we hold this data on behalf of your employer, as their data processor. This means that if you have any questions about this initial data transfer, we would suggest contacting your employer first, because they are the data controller in relation to the initial transfer of your data to us.
• When you undertake an assessment on the MyMynd platform. The assessment is designed to assess your overall behavioural health, which covers mental health and your ability to cope with life’s challenges. When you undertake the MyMynd assessment we will usually collect your name, gender and email address, as well as any additional information you provide as part of the assessment.
• We will process this only where you have provided us with your explicit consent to do so, in order for us to provide the assessment to you .We will only collect the minimum data items necessary to provide our services to you. You can withdraw your consent to this processing at any time, by contacting us at support@mymynd.co.uk.
• We provide reports to your employer covering how their staff are feeling at an aggregated level, but your employer will never be shown the individual responses you give to your specific assessment or any identifiable data.
• If your responses suggest you need support. If your responses to the questions asked by our platform indicate that you may benefit from a follow up call, such as counselling or speaking with a psychologist, we will make you aware of this when you use the platform. Any follow-ups with our psychologists will be to validate the results of your assessment, and to suggest next steps for you. We don’t provide therapy, or a clinical diagnosis.
  • If you consent, we will share your data with a third party to provide this additional support with you, and we will always make clear to you who we would introduce you to for this additional support before you consent. We will never report back to your employer that additional support has been recommended by us, or used by you, in a way that is identifiable to you.
  • Please keep in mind that if we or the psychologist [MyMynd Responder] consider it necessary to protect your life, we or our psychologists may share your data with the appropriate emergency services.
• We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. We will inform users of any changes to the policy and if the purpose of data processing changes, consent will be re-obtained before continued use of the service.
• When you contact us. When you contact us either by phone, email or via social media with general queries, we will usually collect your name, social media handle and contact details, because it’s in our legitimate interest to make sure we can properly respond to your query.
• For video communications with you we will always use secure encrypted connections via Google Meets or an alternative secure platform (e.g. Microsoft Teams, Zoom).
• When you have agreed to receive our news updates via our Website. We will handle your personal information (such as your name and email address) to provide you with our news updates in line with any preferences you have told us about. Where you have signed up to take a MyMynd assessment, this does not mean that we will then start providing you with our news updates – you can sign up to these separately if you would like to receive them.
• When we send you our news updates because you have opted-in to receive them, we rely on your consent to contact you. If you have not opted-in and we send you our news update emails, we do this because of our legitimate interest to promote our business.
• You can unsubscribe from our updates at any time by clicking the unsubscribe link at the bottom of any of our emails, or by emailing support@mymynd.co.uk.
• Technical information when you use our Website. When you consent, we collect information about how you use our Website, using PostHog. They help us improve our website by collecting and reporting information on how you use it. The PostHog cookies collect information in a way that does not directly identify anyone, and the technical filenames for these cookies on your device are the ones beginning with 'ph_'.
• If our business is sold. We process your personal information for this purpose because we have a legitimate interest to ensure our business can be continued by the buyer. We will notify you in advance of any data being shared to a buyer of our business, allowing you the opportunity to opt out of your data being shared; If you object to our use of your personal information in this way, the buyer of our business may not be able to provide services to you.

Who do we share your date with?

• We do not share data with other third parties, except for in any of the specific circumstances below.
• One of our registered psychologists. Where your results have highlighted patterns that may be as a result of an undiagnosed mental health problem, we will share your results with one of our registered psychologists. We only do this where you have provided us with your consent to do so, and you are under no obligation to speak to any of our psychologists that reach out to you.
• Your employer. We may provide aggregated and anonymised data back to your employer. We will not share personally identifiable data back to your employer related to your assessment.
• Business partners, suppliers and subcontractors where you have provided us with your consent to do so.
• Regulators/ Authorities/ Enforcement Agencies if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property or safety of our clients or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection.
• A buyer of our business. Under our legitimate interest to ensure our business can be continued by the buyer.

Where is my data stored?

We store your data with Amazon Web Services on their London servers. Whenever we transfer your personal information outside of the UK and the EU, we ensure it receives additional protection as required by law. To keep this privacy policy as short and easy to understand as possible, we haven’t set out the specific circumstances when each of these protection measures are used. You can contact us at mydata@mymynd.co.uk for more detail on this.

How long do we keep your data for?

We will only retain your personal information for as long as we need it, while you are active on our platform and while you remain an employee of a MyMynd client unless we are required to keep it for longer to comply with our legal, accounting or regulatory requirements. Where we no longer need to hold your personal information it will be deleted from all MyMynd systems

In some circumstances we may carefully anonymise your personal data so that it can no longer be associated with you, and we may use this anonymised information indefinitely without notifying you. We use this anonymised information to analyse our programmes and support other similar programmes around the world.

What are my rights under data protection laws?

You have various other rights under applicable data protection laws, including the right to:

• access your personal data (also known as a “subject access request”);
• correct incomplete or inaccurate data we hold about you;
• ask us to erase the personal data we hold about you;
• ask us to restrict our handling of your personal data;
• ask us to transfer your personal data to a third party;
• object to how we are using your personal data; and
• withdraw your consent to us handling your personal data.

Your individual rights as a data subject

Under the UK GDPR you have certain rights regarding the data which we gather and hold about you.

• Right to be Informed Individuals have the right to be informed about the collection and use of their personal data. This Privacy Policy provides the information you need to understand our approach to managing personal data. The policy sets out:
  • Why we need to access your personal data?
  • How long we will hold that data after your interaction with MyMynd has completed?
  • Who we share your data with?
• Right of access You have the right at any time to ask for a copy of the information that MyMynd holds about you, and MyMynd will supply that data to you in line with its legal requirements to do so.To request access to your data please place your request in an email to dpo@mymynd.co.uk quoting ‘Right of Access’ in the email header.
• Right to rectification If any information that MyMynd holds about you is wrong, you have the right to ask MyMynd to make the necessary corrections.To request amendments to your data please place your request in an email to dpo@mymynd.co.uk quoting ‘Right to Rectification’ in the email header.
• Right to erasure You have the right to ask MyMynd to remove all personal data we hold about you from our systems.To request that your personal data is securely deleted from our records, please place your request in an email to dpo@mymynd.co.uk quoting ‘Right to Erasure’ in the email header.
• Right to restrict processingYou have the right to request that your data is not used for specific forms of processing that MyMynd undertakes.To request limits to be placed on how your data is processed by the MyMynd team, please place your request in an email to dpo@mymynd.co.uk quoting ‘Right to Restrict Processing’ in the email header.
• Right to data portability The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.The data that MyMynd holds about you can be delivered directly to you, or to external organisations you grant permission to, in a variety of electronic formats depending on your request. This data will only be delivered when a written request is received from a validated user.To request that your data can be shared/transferred to another system external to MyMynd, by the MyMynd team, please place your request in an email to dpo@mymynd.co.uk quoting ‘Right to Data Portability’ in the email header.
• Right to objectThe UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances.To request that your data is not processed under certain circumstances, please place your request in an email to dpo@mymynd.co.uk quoting ‘Right to Object’ in the email header. It is important to understand that certain types of processing are essential to ensure that MyMynd can deliver its services and requesting to be excluded from these processing tasks may limit your ability to access all of the functionality provided by the MyMynd platforms.
• Right to withdraw consent Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time.Consent preference can be changed through accessing the User Profile page at any time.Alternatively, you can email dpo@mymynd.co.uk to request that your consent is withdrawn. Please use ‘Consent Management’ in the header of the email you send for this purpose.
• Rights related to automated decision making, including profiling The UK GDPR has provisions on:Please inform us if you do not want your data to be used in this way.
  • automated individual decision-making (e.g. making a decision solely by automated means without any human involvement)
  • profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process

The MyMynd team will acknowledge all requests as soon as possible, and aims to address any queries you may have within 7 working days. However under UK GDPR we have up to 30 days to respond to requests.

You also have the right to lodge a complaint with your relevant supervisory authority, you can find which one applies to you here.

Please keep in mind that privacy law is complicated, and these rights will not always be available to you all of the time.

Questions, comments and more detail

Your feedback and suggestions on this policy are welcome.

We’ve worked hard to create a policy that’s easy to read and clear. But if you feel that we have overlooked an important perspective or used language which you think we could improve, please let us know. You can contact us about anything relating to your rights mentioned within the policy by email at mydata@mymynd.co.uk.