Privacy Policy
People come to HeartBrain at a hard moment in their working life. That means we hold information that matters, so we explain plainly what we collect, why, and what control you have.
Questions? Email privacy@heartbrain.io.
Last updated: 6 October 2026
1.Who we are and how to contact us
HeartBrain is a UK-based platform that helps people affected by workplace bullying and harassment, and helps organisations build healthier cultures. In this policy, "we", "us" and "HeartBrain" mean HeartBrain, and "you" means anyone who uses our website or app.
HeartBrain is the data controller for the personal information described in this policy. For anything privacy related, including requests about your data, email privacy@heartbrain.io or use our contact page.
When an employer runs a Workplace Culture Questionnaire campaign, that employer is the controller for their campaign and we act as their processor. Everything else on the platform is controlled by us.
2.The essentials in 60 seconds
- You can browse the public parts of our site without an account.
- In the community you appear under a pseudonym, not your legal name.
- Anything you record in Tracker (incidents, evidence, documents) is yours. We do not sell it, and no employer or expert can see it unless you choose to share it.
- We use AI to help summarise and draft. Your content is sent to our AI provider only to produce that output. It is not used to train public models.
- We never sell your personal information and we do not run advertising trackers.
- You can download all of your data or delete your account at any time from Privacy & data in your account.
3.What we collect, why, and our legal basis
We only collect what we need to run HeartBrain. The table below sets out each type of information, why we use it, and our lawful basis under UK GDPR.
| Information | Why we use it | Legal basis |
|---|---|---|
| Account details: email address, password (stored encrypted), pseudonym, display preferences, avatar | To create and secure your account and sign you in | Performance of a contract |
| Profile information you choose to add, and your per-field privacy settings | To show the parts of your profile you have chosen to share | Consent, and performance of a contract |
| Community content: posts, replies, reactions, ideas, votes, direct messages, reports you make | To operate the community and moderate it safely | Performance of a contract, and legitimate interests in keeping the community safe |
| Marka activity: points, stage, streaks, leaderboard position, invites you send and referrals that result | To recognise people who help others, and to reward successful invites | Performance of a contract, and legitimate interests in encouraging supportive behaviour |
| Tracker case data: incidents you log, dates, people involved, witnesses, notes, uploaded evidence, letters and documents you generate, HBCase scores and stage history | To provide the Tracker service you subscribe to | Performance of a contract. Where this includes sensitive information such as health or protected characteristics, we rely on your explicit consent and on the establishment, exercise or defence of legal claims |
| Voice notes you record, converted to text | To let you capture an incident by speaking instead of typing | Performance of a contract |
| HeartBrain Resolve matter data: your timeline, answers, uploaded evidence, contracts, emails and generated assessments | To produce your cited case assessment and answer your follow-up questions. Extracted document text and summaries are processed by our AI provider as needed to generate and verify the analysis you request | Performance of a contract. Where this includes sensitive information, we rely on your explicit consent and on the establishment, exercise or defence of legal claims |
| Questionnaire answers | To produce your personal result, or an employer's aggregate culture report | Consent for individuals. For employer campaigns, the employer's legitimate interests, with us acting as processor |
| Expert engagement data: enquiries, bookings, messages with experts, proposals, engagement terms, invoices and payment status | To connect you with lawyers, counsellors and coaches and manage that engagement | Performance of a contract |
| Billing information: subscription status, plan, payment history. Card details are handled by Stripe and never stored by us | To take payment and manage your subscription | Performance of a contract, and legal obligation for tax records |
| Support tickets and any files you attach | To investigate and fix problems you report | Performance of a contract |
| Marketing contacts: name, email, organisation, the page you came from, and the exact consent wording you agreed to | To send the handbook, waiting list updates, newsletters and other information you asked for | Consent, and legal obligation to keep a record of that consent |
| Email delivery data: whether an email was delivered, bounced, or was marked as spam, and unsubscribe status | To keep our emails working and to stop sending to addresses that fail | Legitimate interests in reliable email delivery |
| Technical data: IP address, browser and device type, pages viewed, error reports and security logs | To keep the platform secure, diagnose faults and prevent abuse | Legitimate interests in security and service reliability |
Where we rely on legitimate interests, we have considered your rights and only proceed where our interests do not override them. You can object at any time.
4.How we use AI
HeartBrain uses AI to help you make sense of a difficult situation. That includes summarising your incidents, analysing your case, suggesting next steps, drafting letters and messages, rewriting text into plain English, and turning voice notes into text.
- Content is sent to our AI provider only at the moment it is needed to produce your output, and only the content required for that task.
- Your content is not used to train publicly available AI models.
- When you request a HeartBrain Resolve assessment, update or answer, the extracted text and summaries of your evidence, contracts and emails are sent to our AI provider as needed to generate and verify that output. This processing is covered by the service-provider arrangements described below. Your documents are not made public, sold or shared for advertising, and are not used to train public AI models.
- AI output is a starting point, not advice. It can be wrong, so always review it before relying on it or sending it to anyone.
- A human decision is never made about you automatically. Scores and stage recommendations are guidance for you, and you can always choose a different route.
6.How long we keep information
| Information | How long we keep it |
|---|---|
| Your account and its contents | While your account is open |
| Tracker case data | While your account is open, so it remains available for any future claim. Deleted with your account, or sooner if you delete it yourself |
| Community posts | While your account is open. If you delete your account, posts are removed or fully anonymised |
| Expert engagements | Archived when the engagement ends, then deleted after six years |
| Billing and tax records | Six years after the transaction, because tax law requires it |
| Support tickets | 24 months after the ticket is closed |
| Marketing contacts without consent | Deleted after 12 months of no activity |
| Contact form messages | 24 months |
| Unsubscribe and suppression records | Kept indefinitely so we do not email you again |
| Security and error logs | Up to 12 months |
7.Your rights
Under UK data protection law you have the right to:
- get a copy of the personal information we hold about you;
- have inaccurate information corrected;
- have your information deleted;
- receive your information in a portable format;
- object to, or ask us to restrict, how we use your information;
- withdraw consent at any time, without affecting what we did before;
- complain to a supervisory authority.
The quickest way to use most of these is in the app. Go to Privacy & data, where you can download everything we hold about you as a readable document, manage your privacy settings and blocked members, and delete your account permanently.
Otherwise, email privacy@heartbrain.io. We respond within one month. We do not charge for this.
9.How we protect your information
- Traffic between you and HeartBrain is encrypted in transit, and data is encrypted at rest by our hosting provider.
- Access to your data is enforced at the database level, so one member cannot read another's records.
- Staff access is limited to the people who need it, and admin actions are logged.
- Card details never touch our systems; Stripe handles them directly.
- No online service can be completely secure. If a breach affects your rights we will tell you and the regulator without undue delay.
10.Where your information is held
We aim to keep data within the UK and European Economic Area. Some of our providers process data outside that area. Where they do, the transfer is protected by UK approved safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards we rely on.
11.Children
HeartBrain is for adults in work. It is not intended for anyone under 16, and we do not knowingly collect information from children. If you believe a child has created an account, email privacy@heartbrain.io and we will remove it.
12.Changes and complaints
We update this policy when the platform changes. The date at the top always shows the current version, and we will tell you about significant changes by email or in the app.
If you are unhappy with how we have handled your information, please contact us first at privacy@heartbrain.io so we can put it right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.