Workplace wellbeing
Information about someone's health, including mental health, is special category data under UK GDPR. That means an employer needs both a lawful basis and an extra condition to process it, and should collect as little as it genuinely needs. The Information Commissioner's Office guidance for employers on workers' health data also notes that consent is hard to rely on at work, because an employee may not feel free to say no to their employer.
This is why the way a wellbeing tool is designed matters as much as what it does. The safest pattern is for the app to give each person a private space, and for the employer to see only anonymous, aggregated information, such as how many people used it this month, never who did or what they wrote. Ask any provider exactly what the employer can see, whether a small group could be identified from the figures, and whether staff can use it without telling their manager.
Beyond that, employers should carry out a data protection impact assessment, be open with staff about what is collected and why, keep collection to the minimum, and take advice from their data protection officer or a qualified adviser. This guide is general information, not legal advice.
365ALIVE is built as a personal space for each person's reflections, wins and memories. Our planned workplace offering is being designed around that: employers would see only anonymous group-level totals, never individual activity. If you would like to talk through the approach, email hello@365alive.uk.
Start My 7-Day Plan