Privacy Policy

Effective Date: 01/02/2026
Version: 1.0

1. Introduction

PEAK4 Ltd (“PEAK4”, “we”, “us”, “our”) is committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you:

Use the PEAK4 Mobile Application (“App”)
Access related digital services
Participate in PEAK4 wellbeing programmes
Visit our website
Communicate with us

This policy is issued in accordance with:

UK General Data Protection Regulation (UK GDPR)
Data Protection Act 2018

2. Who We Are

PEAK4 Ltd is the data controller in relation to personal data processed through the App, except where we act as a data processor on behalf of a Sponsoring Organisation (see Section 4).

Registered Address: Avon View Offices 90 High Street, Bidford-On-Avon, Alcester, England, B50 4AF
Contact Email: hello@peak4.co.uk
Data Protection Contact: helpdesk@peak4.co.uk

3. Scope of This Policy

This Privacy Policy applies to:

Individual users of the PEAK4 Mobile App
Participants in employer-sponsored wellbeing programmes
Visitors to our website
Individuals who contact us

4. Controller and Processor Roles

Depending on the deployment model, PEAK4 may act as:

(a) Data Controller

Where we determine the purposes and means of processing personal data.

(b) Data Processor

Where we process personal data strictly on behalf of a Sponsoring Organisation (such as your employer), under a written data processing agreement.

Where PEAK4 acts as a processor, your Sponsoring Organisation is the primary data controller and determines how and why your data is used.

5. What Personal Data We Collect

The personal data we collect depends on how you use the App and services.

5.1 Identity and Contact Data

Full name
Email address
Organisation/employer details
Job role (where relevant)

5.2 Account and Authentication Data

Username
Encrypted passwords
Login timestamps
Account status information

5.3 Technical and Device Data

Device type and model
Operating system
App version
IP address
Device identifiers
Log files
Crash reports
Usage analytics

5.4 Wellbeing Programme Data

Programme participation records
Goal setting information
Activity logs
Engagement metrics

5.5 Wearable Device Data (If Connected)

Where you choose to connect a wearable device or third-party platform, we may receive:

Step counts
Heart rate data
Activity levels
Sleep metrics
Calorie expenditure
Other physiological or activity-related data

This data may constitute special category data (health-related data) under UK GDPR.

5.6 Communication Data

Support enquiries
Feedback
Messages submitted through the App

6. Special Category Data

Certain information processed via the App — particularly wearable-derived physiological metrics — may qualify as special category data under Article 9 UK GDPR.

We process such data only where:

You have provided explicit consent; or
Processing is necessary for employment, occupational health, or social protection purposes (where applicable); or
Another lawful Article 9 condition applies.

7. How We Collect Your Data

We collect data:

Directly from you (account registration, App use, wearable connection)
From your Sponsoring Organisation
From integrated third-party platforms (e.g., wearable providers)
Automatically via device and usage tracking technologies

8. Why We Use Your Data (Purposes of Processing)

We use personal data to:

Provide and maintain the App
Authenticate users
Deliver wellbeing programmes
Facilitate occupational health services
Enable wearable integrations
Monitor engagement and programme effectiveness
Improve App functionality
Maintain system security
Comply with legal and regulatory obligations

We do not sell personal data.

9. Lawful Bases for Processing

Under UK GDPR, we rely on:

Contractual necessity
Legitimate interests (balanced against user rights)
Legal obligations
Explicit consent (where required)

Where processing is based on consent, you may withdraw consent at any time.

We may share personal data with:

Sponsoring Organisations (in accordance with programme terms)
IT service providers and cloud hosting providers
Analytics providers
Wearable platform providers (where connected)
Professional advisers
Regulators or authorities where legally required

All third-party service providers are subject to appropriate contractual safeguards.

11. International Transfers

Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, such as:

UK International Data Transfer Agreement (IDTA)
Adequacy regulations
Standard contractual clauses

12. Data Security

We implement appropriate technical and organisational security measures, including:

Encryption in transit
Access controls
Authentication safeguards
Secure hosting environments
Monitoring and logging

However, no digital system can be guaranteed to be completely secure.

13. Data Retention

We retain personal data only for as long as necessary to:

Deliver services
Fulfil contractual obligations
Meet legal and regulatory requirements

Retention periods vary depending on the nature of the data and service.

Where employer-sponsored access ends, data may be archived or deleted in accordance with contractual and regulatory requirements.

You have the right to:

Access your personal data
Correct inaccurate data
Request erasure (where applicable)
Restrict processing
Object to processing
Data portability (where applicable)
Withdraw consent

Requests may be submitted to:
helpdesk@peak4.co.uk

You also have the right to complain to the Information Commissioner’s Office (ICO):

All text content is available under the Open Government Licence v3.0, except where otherwise stated.

15. Wearable Technology Disclaimer

If you connect a wearable device:

Data is generated and initially processed by the wearable provider
Accuracy depends on device technology
Data is used for wellbeing purposes only
It is not medical advice
PEAK4 does not control device hardware or firmware

Participation in wearable programmes is voluntary unless otherwise defined by your Sponsoring Organisation.

16. Children’s Data

The App is not intended for individuals under the age of 18 unless expressly authorised under a sponsoring programme. We do not knowingly collect children’s personal data without appropriate authority.