Privacy Policy

1. Who we are

Superb Wellness ("Superb", "we", "us", "our") is a workplace wellbeing platform based in Scotland. We operate the Superb Manager and Superb Employee applications available at superbwellness.co.uk. If you have any questions about this policy, please contact us at privacy@superbwellness.co.uk.

2. What data we collect

We collect the following categories of personal data:

• Manager account data: company name, manager name, email address, and encrypted password. We use this to create and manage your workspace.
• Employee data: display name, role, and company code used to join a workspace. Employees do not need to provide an email address.
• Check-in data: weekly mood scores (1–5) and optional free-text notes. This data is stored with a reference to the employee record but is only ever surfaced to managers in aggregated, anonymous form.
• Feedback messages: messages sent via the mail centre, which may be anonymous (no employee reference stored) or named (employee name attached as chosen by the sender).
• Holiday requests: dates, duration, and optional reason. The employee name is attached as this is required for the approval workflow.
• Course completions: a record of which employees have completed which courses.
• Payment data: billing name, email, and card details. Card details are handled exclusively by Stripe and are never stored on our servers.
• Usage data: basic analytics including pages visited and features used, to help us improve the product.

3. How we use your data

We use the data we collect to:

• Provide and operate the Superb Manager and Superb Employee applications
• Allow managers to understand the general wellbeing trends of their team
• Allow employees to submit feedback, check in, and access resources
• Process subscription payments via Stripe
• Send transactional emails such as account confirmations and payment receipts
• Improve and develop the platform based on usage patterns
• Comply with legal obligations

We do not use your data for advertising. We do not sell your data to any third party.

4. Anonymity and employee data protection

Protecting employee privacy is central to how Superb works. The following technical controls are in place:

• Weekly check-in mood scores and notes are only surfaced to managers as team-level aggregates. No individual employee is identified in mood reports.
• When an employee chooses to send an anonymous feedback message, no employee reference is stored with that message. It is technically impossible to trace it back to an individual.
• Managers see employee names in the employee directory and in named feedback only — they never see which individual submitted a check-in or anonymous message.

5. Legal basis for processing

We process personal data under the following legal bases under UK GDPR:

• Contract: processing necessary to provide the service you have subscribed to
• Legitimate interests: improving the platform and preventing fraud
• Legal obligation: complying with applicable law including tax and financial regulations
• Consent: where we ask for specific consent, such as optional marketing communications

6. Data retention

We retain personal data for as long as your account is active. When you close your account:

• Manager account data is deleted within 30 days
• Employee records are deleted within 30 days
• Anonymous feedback and check-in data may be retained in anonymised, aggregated form for up to 12 months for research and product improvement purposes
• Payment records are retained for 7 years as required by HMRC

7. Who we share data with

We share data only with the following trusted service providers, all of whom process data under strict data processing agreements:

• Supabase Inc. — database hosting and authentication (EU region)
• Stripe Inc. — payment processing (UK and EU region)
• Vercel Inc. — application hosting (EU region)
• Anthropic PBC — AI content generation for the AI Wellness Resources add-on only. No personal data is sent to Anthropic; only the article topic is passed.

We do not share your data with any other third parties.

8. Data security

We take security seriously. Our measures include:

• All data is encrypted in transit using TLS 1.2 or higher
• Passwords are hashed using industry-standard bcrypt encryption and never stored in plain text
• Database access is restricted using row-level security policies
• Payment card data is tokenised by Stripe and never touches our servers
• Regular security reviews are carried out

9. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: request deletion of your data ("right to be forgotten")
• Portability: receive your data in a machine-readable format
• Objection: object to certain types of processing
• Restriction: ask us to restrict processing while a complaint is investigated

To exercise any of these rights, email us at privacy@superbwellness.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies

We use only essential cookies necessary to keep you logged in to the application. We do not use tracking cookies or third-party advertising cookies.

11. Children

Superb is designed for use by employees in a workplace context. We do not knowingly collect data from anyone under the age of 16. If you believe a person under 16 has provided us with personal data, please contact us immediately.

12. Changes to this policy

We may update this policy from time to time. When we make material changes we will notify managers by email and display a notice in the dashboard. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.