Data
Where your data lives
The page procurement asks for, written before they ask. Plain English, no annexes, and nothing claimed that the architecture does not enforce.
Who is responsible
Summ Signal is operated by Consult Blue Ltd, a UK company registered with the Information Commissioner’s Office, registration C1910715. For employee pulse data we process on behalf of the employer whose organisation runs the tool; for buyer account data we are the controller. Questions and requests: hello@summnutrition.co.uk.
What we collect, and what we refuse to
- Survey answers: workplace-framed responses with no name, no email, no employee number, and no IP address stored. There is nothing in a survey response that identifies a person.
- Optional employee accounts: a personal email or self-chosen handle, and a passphrase stored only as a salted hash. Work email addresses are refused at sign-up. The employer can never see who has an account or whether any person participated.
- Service ratings: linked to the pseudonymous account so the person can edit them, shown to the employer only as rounded totals.
- Buyer details: organisation name, the purchase email, and the survey configuration.
- We never collect symptom severity, diagnoses, or any clinical information. The pulse is a workplace assessment, not a health record.
Where it is stored
Primary storage is Cloudflare’s Western Europe region, with the website served by Vercel. All processing is subject to UK GDPR and the Data Protection Act 2018. Backups follow the same regional arrangements.
All timestamps are recorded in UTC, and configuration changes are covered by an audit trail.
Who else touches it
- Cloudflare: database and application hosting.
- Vercel: website hosting.
- Stripe: payments. Card details go to Stripe directly and never touch our systems. Buyers only.
- Resend: transactional email to buyers only. Employees are never emailed by us unless they created an account with an email and asked for something.
- Anthropic: powers the support assistant on the marketing site only. Survey responses, ratings and account data are never sent to it.
- We take no commission from any provider we measure or signpost, and no survey data is ever sold or shared for marketing.
The reporting floor
Employers see counts and patterns only. Nothing is reported for any group smaller than 10 people, and health-related counts are rounded to the nearest 5. Both rules are enforced in the system that produces the numbers, not by policy, so there is no report that could break them.
Retention and your rights
Pulse data is kept while the employer uses the service and deleted within 90 days of their use ending, or sooner if the employer asks. Employees can ask us to delete their account and everything linked to it at any time: hello@summnutrition.co.uk, answered by a person.
You also have the usual UK GDPR rights of access, correction and complaint, including to the Information Commissioner’s Office.