Summ Signal privacy policy

Who we are

Summ Signal is operated by Consult Blue Ltd, a UK company, company number 08528647, registered with the Information Commissioner’s Office, registration C1910715. For anything in this policy: hello@summnutrition.co.uk, answered by a person within one working day.

The three kinds of data, and our role in each

• Employer and portal data. Organisation name, the work email an account is created or a purchase is made with, survey configuration, and messages sent through our forms. For this data we are the controller.
• Employee survey answers. Collected on behalf of the employer whose organisation runs the survey: for this data the employer is the controller and we are the processor, acting only on their instructions. A survey answer carries no name, no email, no employee number and no IP address, and employers only ever receive counts and patterns, never an individual response.
• Optional employee accounts. If an employee chooses to create a space with us, that account is between them and us: we are the controller, and their employer is never told who has an account, or whether any person participated.

What we collect, and what we refuse to

• Survey answers: workplace-framed responses with no name, no email, no employee number and no IP address stored. Free-text answers are shown to the employer word for word, and the survey says so where they are typed.
• Optional employee accounts: a personal email or self-chosen handle, and a passphrase stored only as a salted hash we cannot reverse. Work email addresses are refused at sign-up.
• Service ratings: linked to the pseudonymous account so the person can edit them, shown to the employer only as rounded totals, and never below 10 raters.
• Employer details: organisation name, the account email, survey configuration, and a time-stamped audit trail of configuration changes that never contains free text or logins.
• Enquiries and readiness check results you choose to send us: used only to reply and follow up.
• We never collect symptom severity, diagnoses, or any clinical information. The survey is a workplace assessment, not a health record.

Cookies and tracking

• The survey and portal pages carry no analytics of any kind: no Google Analytics, no session recording, no visitor measurement. This is enforced in the code, not by configuration.
• The survey sets one cookie for 24 hours as a courtesy against answering twice by accident. It contains no identity.
• An employee who signs in to their optional space holds their own key in their browser, which is why we advise signing out on shared computers.
• Marketing pages use analytics only if you accept them through the cookie banner, and declining changes nothing about how the site works.

Why we are allowed to use it

• Employer accounts, purchases and the service itself: performance of a contract, and the steps you ask us to take before one.
• Replying to enquiries, sending service emails such as deadline reminders, and protecting the service against abuse: our legitimate interests, applied narrowly.
• Optional employee accounts: the employee’s own choice to create one.
• Employee survey answers: processed on the employer’s instructions under their lawful basis as controller.

Where it lives and who else touches it

Primary storage is Cloudflare’s Western Europe region, with the website served by Vercel. All processing is subject to UK GDPR and the Data Protection Act 2018. The services that process data for us: Cloudflare (database and application hosting), Vercel (website hosting), Stripe (payments, buyers only; card details go to Stripe directly and never touch our systems), Resend (transactional email to employers, and to employees only when they created an account with an email and asked for something), and Anthropic (the support assistant on the marketing pages only; survey answers, ratings and account data are never sent to it). We take no commission from any provider we measure or signpost, and no survey data is ever sold or shared for marketing.

How long we keep it

Survey data is kept while the employer uses the service and deleted within 90 days of their use ending, or sooner if the employer asks. Employees can ask us to delete their account and everything linked to it at any time. Enquiries are kept only as long as needed to reply and follow up, and deleted on request.

Your rights

You have the UK GDPR rights of access, correction, deletion, restriction and objection. Employees exercise them with us, not through their employer, and the employer is never told a request was made: hello@summnutrition.co.uk. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk. More on how the system itself protects survey privacy: where your data lives.