What we collect. Your score and, only if you choose, a short reason linked to that score (see 'If you tell us why'). We never ask for your name, phone number or email. A cookie on your device, and a scrambled record of it, stop the same device answering twice. A scrambled record of your connection limits how many answers one connection can send. We rely on our legitimate interest in keeping the count honest (UK GDPR Article 6(1)(f)). All three are deleted the day after the round closes.
During a wording test your browser keeps a one letter note of which wording you saw, so it stays the same if you reload. It is not sent with anything that identifies you and goes when you clear site data.
Bot check. We use Cloudflare Turnstile to check that a person, not a bot, is submitting. Cloudflare may handle that check in the United States, under the UK-US data bridge.
Where it is kept. On servers in the United Kingdom (London), run by Vercel and Upstash for us, and in Google Cloud in London for the automated analysis, the daily safety check and a monthly copy of the anonymous reports and summaries.
Retention. Your score is kept only as part of an anonymous count, with no reason or device attached. Optional reasons are deleted no later than 84 days after the round opens, so never more than 3 months after you wrote them. After that we keep only an anonymous summary of themes and counts, never your words. That summary is also copied once a month to Google Cloud storage in London.
What your organisation sees. Your organisation receives a report for each site, and a combined report if it has several sites. Reports show score bands and averages only from groups of at least 10 people, and hold back any figure that could point to a smaller group. Themes are shown only when shared by at least 10 people, with their average. If your organisation has agreed the newer terms (Schedule I, version I-2026-11), a theme shared by 5 to 9 people may also be shown by its name alone, marked "5 to 9 people", with no number and no average. Themes shared by fewer than 5 people are folded into "other reasons", which shows no number. A theme that names a role or a team, such as a manager, needs at least 10 people. While a round is open, under the newer terms your organisation's lead can see a running average and score bands, only once 10 or more people have answered, refreshed at most once a day and only after at least 5 more people have answered, so your own answer cannot be picked out. Apart from the safeguarding step, your organisation never sees your words. When your organisation has agreed, anonymous totals may also join a wider pooled picture: never your words, never your organisation's name. A theme shared by 10 or more people may carry one short illustrative example, written by the automated classifier run by Fit to Care in Fit to Care's own words and labelled as such; it is never anyone's answer and is checked and withheld if it appears to hold a name or job title.
What you may see after you answer. Your organisation's lead can choose to show you the same overall picture (the average and score bands) after you answer, once 10 or more people have answered, refreshed on the same rule. You never see anyone else's words.
"Asked by". Your organisation may show the name or role of the person or team asking, above the question. That wording is your organisation's, chosen by it. It does not mean that person or your organisation can see who answered. They cannot.
For staff rounds, the organisation that invited you and Fit to Care are joint controllers of what you write (both are responsible for it in law). Only Fit to Care keeps it. Your organisation sees only score bands, averages and themes as described under "What your organisation sees", never who you are, and never your words apart from the safeguarding step. You can ask either of us about your data; your organisation passes any request to Fit to Care within 5 working days.
We try to remove names, phone numbers and email addresses automatically before anyone sees your words, but this can miss some. Out of Ten is designed so that your organisation is not told who wrote what. But what you write could still point to you, especially in a small team, for example if you mention your role. That is your choice: if you want your safeguarding lead to be able to reach you, you can say who you are, but we cannot promise anyone will act on it, or when.
If you tell us why. Telling us why is optional. What you write may include health information about you or your family. Please do not name anyone. We remove names, phone numbers, emails, postcodes and long numbers automatically, plus some school and workplace name patterns, but this cannot catch everything. We keep your words with your score until no later than 84 days after the round opens (never more than 3 months) while we find themes, using an automated classifier run by Fit to Care on AI tools run in the UK (Google Cloud Vertex AI, London region). No person reads your words to find the themes. The safeguarding step is in the next paragraph. You can withdraw with the code you were shown, using the form below, or by emailing anthony.lawton@ffmi.co.uk. Please do not use the withdrawal email address for anything urgent, because it is not checked every day. If you or someone else is in danger now, call 999.
Apart from the safeguarding step below, your organisation only sees themes, never your words, and only when enough people share them. A daily safety check looks for words that suggest someone may be at risk of harm. If it finds them, the words are passed automatically to your organisation's safeguarding lead, never with who wrote them. If the check cannot be completed on your words for 24 hours, they are passed on in the same way, marked as not checked by the AI, even if they do not suggest any risk. If what you write suggests anyone, including you, may be at risk of harm, the words are passed automatically to your organisation's safeguarding lead, with what was said but not who you are, usually within 2 days, or within 3 days if the automated safety check is delayed. We send them only to your safeguarding lead, or your backup safeguarding contact if the email to your lead cannot be sent. An automated safety check on Google Cloud (Vertex AI, London region) reads your words for this step. The link in that email works for 7 days for anyone who has it, so your organisation should share it only with the safeguarding lead. No one at Fit to Care reads the words before they are passed on. We do this to protect your privacy and to avoid delay. The safeguarding lead decides what to do. The automated safety check runs every day; if it cannot be completed on your words it is tried again every hour. If our email to your lead cannot be sent, we try your backup safeguarding contact, if your organisation has given one. If an email is sent but later bounces or is not read, we will not know. The check is set to pass words on when it is unsure, so words about low mood, exhaustion or bullying at work may sometimes be passed on as well. The check is not perfect: it can miss things and it can pass on things that are not a concern, and does not replace your organisation's own duties. If you withdraw your words, the page will no longer show them. Once your safeguarding lead has opened the page we cannot take back what they have read or copied. In a small team what you write might make you recognisable, so please think about that before you write. Whether to pass words on is decided by an automated check, with no person at Fit to Care looking at them first. If you think words were passed on wrongly, write to anthony.lawton@ffmi.co.uk and we will look into it. For what you write about yourself, our basis is your explicit consent (UK GDPR Article 6(1)(a) and Article 9(2)(a)), which you give with the tick box. For words about other people, and where protecting someone at risk of harm requires it, we also rely on Data Protection Act 2018, Schedule 1, paragraph 18. Please do not use the withdrawal email address for anything urgent, because it is not checked every day. If you or someone else is in danger now, call 999.
Withdraw your words. You can withdraw what you wrote at any time until it is deleted, 84 days after the round opens. Use the withdrawal form below with your round code and your withdrawal code from the thank-you screen. Themes are worked out after the round closes. If you withdraw after that, your words are deleted, but they stay counted in the themes already worked out.
If you set up rounds for your organisation. We hold your name and work email, and those of each site's safeguarding lead and backup safeguarding contact, to run your rounds, send your reports and handle the safeguarding step. This is our legitimate interest in providing the service your organisation asked for (UK GDPR Article 6(1)(f)). These details are kept in the UK (Upstash, London region) and deleted 12 months after the later of your last round closing and your plan ending. Sign-in links last 24 hours and your sign-in cookie lasts 30 days. Emails are sent by Postmark, which keeps a record of each email (the name and email address it was sent to and the subject line, never anything staff wrote) in the United States for its own retention period. That transfer is covered by the UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the standard contractual clauses as the fallback, both in Postmark's data processing agreement. Ask us for a copy. The bot check (Cloudflare Turnstile) sees your browser's connection. If you order a plan, the order details (legal name, billing address, billing contact, purchase order number and plan) are kept for 12 months after the plan ends, and invoices are kept by our accountants for as long as the law requires. Records of the safeguarding step hold no words and are deleted six months after that flag is closed. If you add an "Asked by" name or role, it is shown on the staff page for that round with a fixed line saying Fit to Care runs the round and your organisation cannot see who answered. It is kept with your set-up details and deleted at the same time as them.
Your rights. You can ask what we hold about you, or ask us to delete it, by emailing anthony.lawton@ffmi.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.
Who runs it. Front Foot MI Ltd, trading as Fit to Care, registered in England and Wales, company number 05457319, VAT number 861978082. Registered office: Park House, 2 Park View, Gatley, Stockport, SK8 4BL. anthony.lawton@ffmi.co.uk.