This schedule forms part of the Fit to Care Platform Terms, which cover liability, intellectual property, termination and governing law.
Schedule I, version I-2026-11, published November 2026. An organisation that agreed an earlier version of Schedule I (version 1.5, published October 2026) stays on that version until it agrees this one. I5 says where the two differ. Updated when this version goes live: I6 describes daily screening, hourly retry when the automated safety check cannot complete, escalation to the safeguarding lead after 24 hours marked as not checked by the AI, a backup safeguarding contact, and target times to email a contact (usually within 2 days, or within 3 days if the automated safety check is delayed, as aims not guarantees); I5 says where earlier versions differ for reports and themes; the safeguarding step in I6 applies to every organisation from the date this version is published, whichever Schedule I version it has agreed
Applicable to organisations that run Organisational Heartbeat rounds, and to their staff who answer.
Organisational Heartbeat opens a round of about two weeks every month at each of an organisation's sites. Staff answer one question, "What is your current state?", from 0 to 10, with an optional reason. Staff may write about their own situation, including their health, but must not name anyone. We never ask for names and there is no log-in. The first month's rounds are free, within the limits shown in the app. Later months need a paid plan.
An organisation agrees to these terms and this schedule by ticking the boxes in the app. The person who ticks confirms they are authorised to agree for the organisation. There is nothing else to sign. If the organisation has another agreement with Fit to Care, this schedule governs heartbeat answers.
We hold the name and work email of the lead and of each site's safeguarding lead, and the record of this agreement, to run the rounds and to contact the organisation. Fit to Care alone is responsible for these details. They are deleted 12 months after the later of the organisation's last round closing and its plan ending.
The organisation and Fit to Care are joint controllers of the reasons staff write, and of any score stored with a reason. The organisation decides to run the rounds and who is invited. Fit to Care decides everything else and is the only party that holds the answers. Staff may contact either party about their data; the organisation passes any request to Fit to Care within 5 working days. Fit to Care writes and publishes the privacy information staff see on the answer page and the privacy page, and answers any request or complaint about the answers. The organisation shares the staff link unchanged and does not add its own privacy wording about the round. Fit to Care handles any personal data breach, reports it to the Information Commissioner where the law requires, and tells the organisation's lead within 72 hours of finding it. A score on its own is an anonymous count. A summary of our data protection impact assessment is available on request from anthony.lawton@ffmi.co.uk.
During a round. Once 10 or more people have answered at a site, the organisation's lead can see a running average for that site and the number scoring 0 to 3, 4 to 6 and 7 to 10. These figures are not live. They are refreshed at most once a day, and only when at least 5 more people have answered since the figures last shown, so no single answer can be picked out. They may change until the round closes. Nothing is shown before 10 people have answered.
After a round closes. For each site where 10 or more people answered, a report for that month with the number who answered, the final average score, the number scoring 0 to 3, 4 to 6 and 7 to 10, and themes from the reasons people gave, shown like this:
If fewer than 5 people answered after the last running figures were shown, the final average and score bands are the last ones shown; the later answers still count towards the number who answered and the themes. Themes are made by an automated classifier from reasons with names removed (see I7). Where an organisation has more than one site, a combined report across the sites with 10 or more answers. From the second month, the trend of average scores. On a paid plan, Fit to Care may add a comparison with the wider picture once three or more organisations in the same sector and region have pooled; the report says when this is available. Where a count or an average could be used to work out a small group of people at any one site, it is withheld and the report says so. Never anyone's words, except the safeguarding step in I6.
What staff see. The organisation's lead can switch on or off, at any time while a round is open, whether staff see the same overall picture (the average and the score bands, refreshed on the same rule) after they answer. Staff see it only once 10 or more people have answered. The tick the organisation gives when it agrees sets the starting choice. Staff never see themes or anyone's words.
Earlier version. An organisation that has not yet agreed version I-2026-11 keeps the rule in version 1.5: a report only for sites with 10 or more answers, with themes shown only when shared by 10 or more people, with their average, and no running figures during a round. The rule that applies to a round is the one staff were shown when that round opened.
Fit to Care runs an automated safety check of the reasons every day. It looks for words that suggest serious risk, cannot catch everything, and does not replace the organisation's own safeguarding duties. If the automated safety check cannot be completed on a reason, it is tried again every hour. After 24 hours without a completed check, the words are passed to the site's safeguarding lead, with the words but never who wrote them, marked as not checked by the AI, even if they do not suggest any risk. If a reason suggests anyone, including you, may be at risk of harm and the check completes, the words are passed automatically to the site's safeguarding lead on the same basis. No one at Fit to Care reads the words before they are passed on. We do this to protect your privacy and to avoid delay. The safeguarding lead decides what to do. We send them only to the site's safeguarding lead, or the backup safeguarding contact if the email to the lead cannot be sent. An automated safety check on Google Cloud (Vertex AI, London region) reads the words for this step. The link in that email works for 7 days for anyone who has it. If our email to the lead contact cannot be sent, we try the backup safeguarding contact the organisation gave at sign-up, if there is one (we can only tell a delivery has failed when the send itself fails; an email that bounces later is not detected, so in that case the backup is not tried). The words are normally emailed to a safeguarding contact usually within 2 days, or within 3 days if the automated safety check is delayed. We aim to email a contact within 2 days, or within 3 days if the automated safety check is delayed. These are targets, not guarantees. If we cannot reach either contact, we try again each day and tell Fit to Care that delivery has not happened. If you withdraw your words, the page will no longer show them. Once the safeguarding lead has opened the page we cannot take back what they have read or copied. Staff are told this before they write, including to call 999 if anyone is in danger now. This is not an emergency route. The record of this step holds no words and is deleted six months after that flag is closed.
Reasons are analysed, including with AI tools, only in the United Kingdom. Themes are made by an automated classifier run by Fit to Care on Google Cloud Vertex AI in the London region from reasons with names removed; no person reads the reasons to make the themes. Reasons are deleted no later than 84 days after the round opens. After that Fit to Care keeps only an anonymous summary of themes and counts. That summary, with the reports, is copied once a month to storage in Google Cloud in the United Kingdom (London). It holds no reasons. Anonymous totals join a wider picture by sector and region, never with the organisation's name or anyone's words, and only when at least three organisations have pooled in the same sector and region. Fit to Care may publish that wider picture, by sector and region, never naming any organisation and never with anyone's words. Where a report shows a theme shared by 10 or more people, it may carry one short illustrative example, written by the automated classifier run by Fit to Care in Fit to Care's own words and labelled as such; it is never a staff member's answer, is never copied from one, and is checked and withheld if it appears to hold a name or job title.
A paid plan runs for 12 months from the day it is ordered and does not renew by itself; Fit to Care reminds the organisation before it ends. The plan starts when the order is placed. Fit to Care sends an invoice; no card is taken. If the invoice is still unpaid 60 days after the order, new rounds pause until it is settled and nothing already collected is lost; rounds start again the day Fit to Care records the payment. Prices exclude VAT. An organisation may stop using Organisational Heartbeat at any time; fees for a plan already ordered are not refunded, unless Fit to Care itself withdraws the service before the plan ends, when the unused whole months are refunded. The order record is kept for 12 months after the plan ends.
Fit to Care may pause or close a round that breaks this schedule. Section 7 (limitation of liability) of the Fit to Care Platform Terms applies.