For organisations and for employees
How confidentiality works
Employees ask one question above all others: will my employer find out? The content of your sessions never reaches them. What reporting the organisation does receive is agreed in advance and set out below.
The employer buys access to a service. The employee receives therapy.
These are two separate relationships and the system does not let them meet. The company pays for a volume of sessions. The employee activates their entitlement with a code that does not carry their name. From there, their participation lives in a different part of the system, which the company profile has no path into.
What the employer sees
- The contract, volume purchased and remaining balance
- Invoices and payments
- How many people used the programme and how many sessions took place
- How many sessions were cancelled and how many were missed
- The typical time from activation to a first session
- A signal when the volume is running out
Every figure is aggregate and is only produced above the threshold below.
What it does not see — and cannot
- Whether a specific person used the service
- Any participant's name, email or phone
- Date, time or which therapist
- Topic, reason, diagnosis or notes
- A report on a small group where someone could be identified by elimination
Three mechanisms, not three promises
Activation that does not go through the employer
Access codes are not issued by name. The employer receives a batch of codes and sees how many were used — not who used them. This does not make the therapy anonymous: your therapist knows who they are working with, and your details stay with us, confidentially.
A minimum threshold for every report
If a group of people — a department, a location, a period — is below a set size, no detailed report is produced at all. Instead of a number you see "population too small for a privacy-safe report". The reason is that in a small group, "three people from marketing" is effectively a name.
Separated systems
Contract data and therapy data live in different parts of the system, with different access rights. The administration that handles invoices has no access to therapeutic content. That is a constraint in the database, not a rule in a handbook.
One piece of advice worth hearing
Sign in with a personal email, not a work one. If you use your work account, your company's IT administrator can see in their own logs that you signed in to an application — that is outside our system and we cannot prevent it. This is why we do not offer sign-in with a work account at all.
What your data protection team can ask for
We bring the pack to the second meeting without being asked: data processing agreement, record of processing activities, sub-processor list, retention and deletion policy, breach procedure with notification timeline, confidentiality declarations from every therapist, and a one-page data flow diagram.