Thrive 8 Privacy Notice
Who we are
Intogreat Ltd (iIntogreat, we, us, our) provides the Thrive 8 Index assessment and related learning and development services. We are registered in England and Wales (company number 13734084) and have our registered office at Suite 6a 10 Duke Street, Liverpool, England, L1 5AS.
This Privacy Notice explains how we use personal information about individuals who complete the Thrive 8 Index assessment, receive an individual report, access our learning platform, or take part in related learning and development activities.
Intogreat Ltd is the owner of the Thrive 8 Index® assessment methodology and related intellectual property.
Depending on how the Thrive 8 Index is delivered, your employer or sponsoring organisation may also be a separate controller of certain personal information relating to your participation in the programme. Your employer or sponsoring organisation will provide its own privacy information explaining how it uses personal information for its employment, organisational development and human resources purposes.
Effective: September 2026
1. Contact details
Address: Suite 6a 10 Duke Street, Liverpool, England, L1 5AS.
Email: hello@intogreat.net
Telephone:+44 (0) 7597 487 220
intogreatLtd is registered with the Information Commissioner’s Office (registration number available on request). You can also contact the InformationCommissioner’s Office at www.ico.org.uk.
2. Our role under data protection law
For the personal information collected through the Thrive 8 Index assessment platform, Intogreat generally acts as a data controller because we determine how assessment responses are collected, analysed, scored and reported. In some customised or white-labelled situations, we may instead process specified information on the sponsoring organisation’s documented instructions. We will explain any materially different arrangement before collecting your information.
The organisation that invites you to participate may also act as a separate controller in relation to information it holds about you, including information relating to your employment, participation in organisational programmes and receipt of aggregated organisational reporting.
In certain programme arrangements, including customised, white-labelled or hybrid programmes, Intogreat and the sponsoring organisation may each have separate responsibilities under data protection law. Where this is relevant, the information provided to you before you take part will identify the relevant organisation, explain their respective role and state who will receive your Individual Report.
Your employer or the organisation that invited you to participate is also likely to be a separate data controller for information it holds about you and for its use of aggregated reports. Your employer should provide its own privacy information about how it uses personal information in an employment or workplace context.
Because participants may complete the Thrive 8 Index, or receive training and debriefs, from a range of countries, other data protection laws (for example, the EUGDPR) may also apply to some of our processing in addition to UK data protection law. Where this is the case, we will comply with the applicable requirements of those laws as well as this Privacy Notice.
3. What the Thrive 8 Index is
The Thrive 8 Index is an assessment tool designed to help you understand how you are doing across 8 science-led factors and 28 sub-factors associated with thriving and wellbeing.
You are asked to respond to statements using a scale, for example from strongly agree to strongly disagree. Your answers are scored and used to create an individual report for you. The report may identify areas of strength, areas for development, and learning content that may support your wellbeing and development.
The Thrive 8 Index is not a medical, psychiatric, diagnostic, therapeutic, clinical, occupational health or crisis service. It does not diagnose mental health conditions.
4. What personal information we collect
We may collect and use the following information.
4.1 Identity and contact information
1. name;
2. email address;
3. employer or organisation;
4. role, team, department, programme or cohort, where relevant;
5. country where you currently work; and
6. other contact or administrative details needed to provide the assessment.
4.2 Demographic information
1. age or age range;
2. gender; and
3. country or region.
4.3 Thrive 8 assessment responses
This includes your responses to the Thrive 8 Index questions, including answers about how you perceive your wellbeing, behaviours, habits, working experience, stress, thriving, nutrition, energy, focus, relationships, mindset, purpose and related factors.
4.4 Well-being and mental health-related information
Some Thrive 8 Index statements relate to personal wellbeing factors, including areas such as sleep, resilience, stress management, nutrition, energy, mindset and personal wellbeing. Responses to these statements may constitute special category personal data under applicable data protection laws where they reveal informtion relating to an individual's physical or mental health.
4.5 Report and scoring information
1. scores across the 8 Thrive 8 factors and 28 sub-factors;
2. overall thriving scale position;
3. individual report outputs;
4. learning recommendations; and
5. programme or cohort segmentation data where relevant.
4.6 Coaching, workshops and learning records
Where coaching sessions, workshops, development activities or programme debriefs are provided, we may collect information relating to attendance, participation, development objectives, action plans, feedback and notes created during those activities. These activities may be delivered by intogreat, by your employer’s internal HR team, or by both, depending on how your organisation uses the Thrive 8 Index. If you access our learning platform, we may collect information such as your account details, course enrolment, progress, completion information, learning activity and platform usage data.
4.7 Technical and communications information
We may collect basic technical and communications information, including email delivery information, IP address, device information, access logs and information needed to keep our systems secure.
5. How we collect your information
We collect personal information:
1. directly from you when you choose to complete the Thrive 8 Index assessment, communicate with us, or use the learning platform;
2. from your employer or sponsoring organisation that invited you, where they provide administrative information needed to facilitate participation such as your name, email address, cohort, programme or department;
3. from Microsoft Forms, Microsoft Excel, Microsoft OneDrive and related Microsoft services used to collect, store and process assessment responses;
4. from the Thrive 8 Index scoring engine or model used to generate your report;
5. from workshop, coaching and learning activities where applicable;
6. from any learning platform provider identified to you before you use that platform;
7. from our business systems, email systems and service providers; and
8. from correspondence or support requests relating to the Thrive 8 Index assessment or associated services.
Where the Thrive 8 Index is delivered as a customised or white-labelled programme, invitations and communications may be issued by your employer or sponsoring organisation on our behalf.
Regardless of how the programme is delivered, including in customised, white-labelled or hybrid arrangements, the underlying assessment data, the Thrive 8 Index scoring engine and the generation of reports always remain within intogreat’s control. Your employer or sponsoring organisation will not have direct access to the underlying individual-level data used to generate reports.
6. Automated scoring, modelling and report generation
The Thrive 8 Index assessment uses automated scoring and modelling. Your assessment responses are processed through Intogreat’s scoring engine/model to generate your individual scores and Individual Report.
The automated scoring process is designed to generate personal development insights and educational wellbeing information. The results are not used by Intogreat to make decisions about an individual's employment, promotion, remuneration, disciplinary status or contractual relationship.
The report is generated automatically based on your answers, the Thrive 8 Index scoring methodology, and statistically validated norms. The norms were developed using a benchmark dataset of individuals employed in a defined set of countries, obtained by intogreat from an independent survey panel provider, and may be updated over time as the Thrive 8 Index develops.
Automated report generation is used to provide consistent, efficient and personalised learning and development insights. The report is not a medical diagnosis and should not be treated as clinical advice.
Intogreat may engage specialist technology providers, including providers of artificial intelligence tools, to assist in developing, validating and refining the Thrive 8 Index scoring methodology and statistical norms. Where this involves personal information, it is limited to historic benchmark data obtained for that purpose, as described in section 9; your own individual assessment responses and Individual Report are generated by intogreat's scoring engine and are not shared with such providers.
We do not permit your employer to use your Individual Report to make decisions about your employment. Depending on how your organisation uses the Thrive 8 Index, we may send your Individual Report directly to you, or, where your organisation has arranged for its internal HR team to distribute reports and conduct debriefs, we may send your Individual Report to a nominated member of that HR team for distribution to you and for the purpose of the debrief. We do not provide your employer with your individual response scores or Individual Report other than in these agreed distribution arrangements, which will be explained to you before you take part, together with the safeguards that apply. In every case, your employer does not have access to the underlying raw assessment data used to generate your report.
7. What your employer receives
Your employer or sponsoring organisation receives aggregated reporting only. This means it may receive a company, programme, country, department, management or cohort-level report showing overall scores, themes and learning and development recommendations.
Your employer does not receive your individual assessment responses, individual scores or Individual Report unless we have told you clearly in advance and there is a lawful basis for doing so.
Intogreat applies measures intended to reduce the likelihood that individuals could be identified from organisational reporting.
Where practical, group reporting will be generated only where a sufficient number of participants have completed the assessment. Intogreat may combine, suppress or withhold certain reporting outputs where there is a material risk that information could be linked to identifiable individuals.
For your organisation’s initial benchmark report, intogreat may generate aggregated reporting regardless of group size, because there is no earlier result to compare it with. We recommend, and will discuss with you, an appropriate minimum group size to reduce the risk that individuals could be identified from that reporting.
For any reporting that compares results over time, for example to measure change following an assessment cycle, we will not produce a comparative result for asegment unless at least 10 participants within that segment have completed the assessment on both occasions, because a smaller number could allow an individual’s change in score to be inferred.
If your organisation asks us to segment reporting, for example by team, department, location or business unit, that segmented reporting will show the number of participants in the segment but will not identify which individuals responded. A small segment size increases the risk that responses could be attributed to a particular individual, and we will discuss appropriate minimum segment sizes with your organisation before enabling segmented reporting.
Organisations receiving aggregated reporting are contractually prohibited from attempting to identify individual participants from those outputs or combining them with other information for that purpose. We only describe an output as anonymised where individuals are not reasonably identifiable from it; aggregated reporting that shows participation numbers by segment, such as by team or department, is disclosed to your organisation as aggregated but may not always meet the higher anonymisation standard, and we apply the safeguards described in this section accordingly.
8. Why we use your personal information
We use your personal information for the following purposes:
1. to invite you to complete the Thrive 8 Index assessment;
2. to administer the assessment;
3. to score your responses;
4. to generate and send your Individual Report;
5. to provide personalised learning and development recommendations;
6. to provide access to any learning platform;
7. to generate aggregated reports for your employer or sponsoring organisation;
8. to maintain, validate, develop and improve the Thrive 8 Index, scoring model, statistical norms and learning content;
9. to administer coaching, workshops, debrief sessions and development programmes;
10. to manage customised and white-labelled Thrive 8 Index programmes;
11. to monitor, validate, develop and improve the scientific robustness, reliability and effectiveness of the Thrive 8 Index methodology;
12. to manage security, quality assurance, troubleshooting and system administration;
13. to respond to queries, complaints and rights requests;
14. to comply with legal and regulatory obligations; and
15. to establish, exercise or defend legal claims.
9. Lawful basis for using your personal information
We rely on the following lawful basis under UK data protection law. Where we rely on consent or explicit consent, that consent is given directly to intogreat before we collect your name or email address, separately from any invitation issued by your employer, so that you retain a genuine and free choice about whether to participate.
1. Purpose: Administering the assessment, generating your Individual Report and providing related Thrive 8 services. Lawful basis: Consent under Article 6(1)(a) UK GDPR.
2. Purpose: Processing wellbeing-related assessment responses and other special category data Lawful basis: Explicit consent under Article 9(2)(a) UK GDPR.
3. Purpose: Improving, validating and developing the Thrive 8 Index using anonymised or aggregated information Lawful basis: Data protection law does not apply to information that has been effectively anonymised so that no individual is reasonably identifiable. Before anonymisation, we process the relevant responses under the explicit consent basis described above.
4. Purpose: Creating aggregated reports for your employer Lawful basis: Legitimate interests in helping organisations understand workforce learning and wellbeing themes. Where the creation of those reports involves health information, we also rely on your explicit consent under Article 9(2)(a) UK GDPR. We apply aggregation and disclosure controls and do not share individual-level results under our standard model.
5. Purpose: Improving and validating the Thrive 8 Index and statistical norms Lawful basis: Legitimate interests in developing, validating and improving our assessment tools and services, with safeguards including aggregation, access controls and anonymisation where appropriate.
6. Purpose: Security, records, complaints and legal compliance Lawful basis: Legal obligation, legitimate interests, and establishment, exercise or defence of legal claims.
7. Purpose: Coaching sessions, workshops, development activities, programme debriefs or learning platform access Lawful basis: Legitimate interests in delivering and administering the relevant activity, performance of a contract, or consent where participation is optional and consent is appropriate. If notes reveal health information, we will also identify and document an applicable Article 9 condition.
Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing carried out before withdrawal.
10. Is participation voluntary?
Participation in the Thrive 8 Index is intended to be voluntary.
Choosing not to participate or withdrawing consent will not adversely affect your employment, benefits, or learning opportunities. We require sponsoring organisations not to pressure individuals to participate or impose adverse consequences for declining.
Intogreat does not ordinarily provide employers with information identifying individual participants or non-participants under its standard model. If a particular programme operates differently, participants will be informed before providing information.
Before we ask for your name or email address, you are asked to confirm whether you consent to take part. If you do not consent, you are taken to the end of the Thrive 8 Index and we do not collect or hold any information that could identify you, including your name or email address.
11. Who we share personal information with
We may share personal information with:
1. you, by providing your Individual Report;
2. your employer or sponsoring organisation, but only in aggregated form under our standard reporting model;
3. Microsoft, where Microsoft Forms, Excel, OneDrive or related services are used;
4. any learning platform provider identified to you before you use that platform;
5. email, hosting, cloud storage, IT support, security, analytics and business system providers;
6. carefully selected associates,consultants and contractors engaged by Intogreat to assist with assessment administration, report preparation, coaching, facilitation, debriefs, learning and development activities or client services. intogreat does not currently engage associates, consultants or contractors to deliver Thrive 8 Index services, but if it does so in future, any individual given access to individual-level assessment data, for example to conduct a debrief, will be required to sign confidentiality and data protection agreements before being given that access;
7. professional advisers, insurers, auditors and legal advisers;
8. regulators, public authorities, courts or law enforcement where required by law; and
9. emergency services or appropriate authorities where necessary to protect someone from serious and imminent harm.
We do not sell your identifiable personal information.
12. International transfers
Some of our service providers may process personal information outside the United Kingdom. For example, widely used technology, cloud, email, learning platform and support providers may use infrastructure or support teams in other countries.
We do not always control, and may not always know, the specific location of the servers used by our service providers, including Microsoft. Where we become aware that personal information is being transferred outside the UK, we will apply the safeguards described below.
Where personal information is transferred outside the UK, we will use the appropriate lawful transfer mechanism applicable to the relevant recipient and destination, which may include:
1. a UK adequacy regulation covering the destination country;
2. the UK International Data Transfer Agreement;
3. the UK Addendum to EU Standard Contractual Clauses; or
4. another lawful safeguard permitted by Data Protection Laws.
Because many organisations using the Thrive 8 Index operate internationally, personal information may occasionally be accessed from, or processed in connection with, multiple jurisdictions. Where personal information is transferred internationally, Intogreat will implement appropriate safeguards and transfer mechanisms required by applicable data protection laws. You may contact us for further information about the relevant destination and safeguard.
13. How long we keep your information
We keep personal information only for as long as reasonably needed for the purposes described in this notice.
Our standard retention approach is:
1. Category: Assessment responses and identifiable scoring data Retention Period: Retained for the duration of the relevant assessment and agreed reassessment cycle and normally deleted or effectively anonymised within 24 months after that cycle ends. An assessment cycle is usually 12 months, so identifiable data will normally be retained for no more than 36 months after the initial assessment, unless your organisation agrees a different reassessment cycle with us, in which case the retention period will be adjusted accordingly.
2. Category: Individual reports Retention Period: Retained for the duration of the relevant assessment and agreed reassessment cycle and normally deleted or effectively anonymised within 24 months after that cycle ends.
3. Category: Client engagement records Retention Period: Normally retained for up to 6 years following completion of the engagement.
4. Category: Workshop, coaching and development records Retention Period: Retained for as long as needed to deliver and follow up the relevant activity. Normally deleted within 24 months after it ends, unless a longer period is explained to you and justified.
5. Category: Financial and contractual records Retention Period: Normally retained for up to 6 years in accordance with legal and accounting requirements.
6. Category: Anonymised and aggregated data Retention Period: May be retained indefinitely where individuals are no longer identifiable.
7. Category: Demographic information (age, gender, country/region) Retention Period: Retained for the duration of the relevant assessment and agreed reassessment cycle and normally deleted or effectively anonymised within 24 months after that cycle ends.
8. Category: Technical and communications information (for example IP address, device information and access logs) Retention Period: Normally retained for up to 12 months, or longer where needed for security investigations or to comply with a legal obligation.
We may retain information for longer where necessary to establish, exercise or defend legal claims, comply with legal obligations, investigate complaints, maintain security, or preserve evidence.
14. Security
We use appropriate technical and organisational measures to protect personal information. These may include access controls, restricted access to assessment files and scoring outputs, cloud security settings, confidentiality obligations, secure storage, supplier due diligence, and appropriate deletion or anonymisation procedures. Our systems, including Microsoft Forms, Excel and OneDrive, are provided under a Microsoft 365 Business Standard subscription, and data backup is managed in accordance with Microsoft’s standard service arrangements for that subscription.
No system is completely secure, but we take reasonable steps to protect personal information against unauthorised access, loss, misuse and disclosure.
Security measures may include:
1. role-based access controls;
2. restricted access to assessment data;
3. multi-factor authentication;
4. encrypted storage and transmission technologies;
5. confidentiality obligations applying to employees, associates and contractors;
6. supplier due diligence and contractual protections;
7. secure deletion and retention procedures.
15. Your rights
You have rights under Data Protection Laws, subject to conditions and exemptions. These include:
1. the right of access to your personal information;
2. the right to rectification of inaccurate or incomplete information;
3. the right to erasure in certain circumstances;
4. the right to restrict processing in certain circumstances;
5. the right to object to processing based on legitimate interests;
6. the right to data portability in certain circumstances;
7. the right not to be subject to solely automated decisions producing legal or similarly significant effects, where applicable;
8. the right to withdraw consent where we rely on consent; and
9. the right to complain to the Information Commissioner’s Office.
To exercise your rights, contact us using the details in section 1. We may need to verify your identity before responding.
Where we rely on consent as our lawful basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect processing carried out before consent was withdrawn.
16. Objection and withdrawal
You may object to processing based on legitimate interests, including certain uses of your identifiable assessment data for service improvement and validation. If you object, we will consider your request and stop processing unless we have compelling legitimate grounds to continue or need to process the information for legal claims.
Where we rely on consent, including explicit consent for special category data where required, you may withdraw consent at any time. If you withdraw consent before completing the assessment or before your report is generated, we may be unable to provide your Individual Report. Withdrawal does not affect processing already carried out lawfully. Information already incorporated into an effectively anonymised output cannot be removed because it can no longer be linked to you.
17. Automated decision making
We use automated scoring and report generation. This produces your Individual Report and suggested learning areas. It does not by itself make employment decisions, legal decisions, clinical decisions or decisions with similarly significant effects.
Your employer should not use your Individual Report or any Thrive 8 output to make decisions that materially affect your employment. Organisational reports are intended to inform group-level wellbeing, learning and development initiatives.
18. Intellectual property
The Thrive 8Index® assessment methodology, scoring model, reports, content, branding and associated materials are proprietary to Intogreat. Nothing in this Privacy Notice transfers ownership of any intellectual property rights to participants, employers or sponsoring organisations.
19. Changes to this notice
We may update this Privacy Notice from time to time. The latest version will be made available on our website (www.intogreat.net), through the assessment process, or on request.
FINALIST
WINNER
Sign up to receive a short note each Wednesday morning. A quiet observation about being human, read in under a minute. Essays when there's something worth saying.