Draft. This statement is awaiting review by our Data Protection Officer and legal advisers. Items marked like this are still to be confirmed.
In short
- MySpine.Health collects your personal data, including information about your health, so we can help you look after your back.
- It is held by us, in the UK, separately from your employer. We will never share it with any other organisation without your permission.
- Your employer only ever sees totals and summaries about groups of 10 or more people, never anything about you personally.
- Your individual answers are shared with your employer’s Occupational Health team only if you say yes. You can change your mind at any time.
- You can see, download or delete your data in the app at any time.
Who we are
MySpine.Health is provided by [legal entity name, company number and registered address] (“we”, “us”). We are the controller of the personal data described in this statement.
Questions about your data, or about this statement: [email protected].
What we collect
- About you: your email address, first and family name, and optionally your works or HR number.
- About your work: your employer, site, department, the kind of work you do and, optionally, your age band.
- Your spinal health questionnaire: back and neck pain, spinal history, general health and long-term conditions, height and weight (used to work out your BMI), activity and exercise tolerance, smoking, and current treatments.
- What you tell us over time: weekly check-ins, back problems (“episodes”) and follow-ups, days off work, your answers to safety and risk questions, exercises you’ve done, and feedback on tips.
- How to reach you: your mobile number (if you give it), preferred contact method and time, and how often you want reminders.
- Your choices and our records: what you chose about sharing, when you read this notice, and a log of every time Occupational Health viewed your record.
If you decide not to join, you can tell us why. That answer is anonymous: we keep only your employer’s name, the reasons you picked and the date.
We use one essential cookie to keep you signed in. We don’t use advertising or tracking cookies.
Why we use it
- To run the app for you: check-ins, reminders, tips, coaching and events near you.
- To get you help: when you ask to talk to a person, or your answers suggest you need care, a physiotherapist or doctor from the MySpine.Health clinical team will see the relevant information and contact you.
- To keep you safe: some answers trigger urgent advice, such as calling 999 or NHS 111.
- To give your employer anonymous totals and summaries, so it can improve the spinal health of the people who work there.
- To share your record with your employer’s Occupational Health team, only if you choose to.
- To keep the service secure and to improve it, using anonymous or summarised data wherever possible.
Our legal basis (to be confirmed by our DPO): for your health information, your explicit consent (UK GDPR Article 9(2)(a)) and, where our clinicians are caring for you, the provision of health care (Article 9(2)(h)).
Who sees what
| Your employer (HR, managers and others) | Only totals and summaries about groups of at least 10 people. Smaller groups are combined or hidden. Never your name or your answers, and not whether you have joined. |
|---|---|
| Your employer’s Occupational Health team | Only if you say yes. They can see your name, site and department, your questionnaire, your check-ins and pain trend, your back problems, follow-ups and days off, exercises you’ve done, and whether you’ve been referred for care. They may contact you about your back. They never see your safety and risk answers or anything a clinician records. If you stop sharing, they lose access to all of it straight away, including anything from before. |
| The MySpine.Health clinical team | Registered physiotherapists and doctors, when you ask for help or your answers suggest you need it. |
| Our service providers | Google Cloud stores the data, in London. Cloudflare delivers the app’s pages and protects connections. An email provider sends your sign-in codes. They act only on our instructions. |
We never sell your data or use it for advertising.
Where it’s kept, and for how long
Your data is stored and processed in the UK (London), and encrypted in transit and at rest.
We keep it while you have an account, and for [retention period] after you last use the app. If you delete your account, your data is deleted straight away (copies in our encrypted backups are overwritten within [backup period]). We keep only a record that a deletion happened. If you leave your employer, sharing with that employer ends.
Your rights
- See and download your data: in the app, under Privacy.
- Delete your account and data: in the app, under Privacy.
- Change your mind about sharing at any time, under Privacy. It takes effect immediately.
- Correct anything that’s wrong, restrict or object to how we use it: email [email protected].
- Complain to the Information Commissioner’s Office: ico.org.uk or 0303 123 1113. We’d like the chance to put things right first.
Changes to this statement
If we make important changes, we’ll tell you in the app before they apply.