We read it as yes. Answers to a workforce wellbeing check-in that can be linked to a person are data concerning health, which UK GDPR treats as special category data.
This page sets out how we read the Information Commissioner's Office (ICO) guidance, with a link to each page so you can read it yourself. It is not legal advice, and the controller should take its own. The decisions it describes belong to the controller, which is usually the employer. Every ICO page cited here carried this notice when we checked it: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change."
We think so, when they can be linked to a person. UK GDPR defines data concerning health as "personal data related to the physical or mental health of a natural person". The ICO adds that health data "includes any related data which reveals anything about the state of someone's health" (ICO, What is special category data?).
The ICO's guidance for employers names "a questionnaire completed by workers to detect problems with their health" as an example of workers' health information (ICO, Data protection and workers' health information). It also says health monitoring "isn't limited to monitoring just physical health, but can involve mental health and wellbeing" (ICO, What if we carry out health monitoring?). A check-in that asks about burnout, sleep or overall health fits that description.
Possibly not. It depends on the context. The ICO says "Data protection law does not apply to anonymous information" (ICO, Introduction to anonymisation). It also says "Identifiability exists on a spectrum", and information is anonymised when no means are "reasonably likely to be used by you or anyone else" to identify someone (ICO, How do we ensure anonymisation is effective?).
Turning answers into group results is itself processing personal data. Whether a result is anonymous depends on group size, what else colleagues know, and whether results can be sliced. The Intelligent Wellbeing Engine stores no result for fewer than five people and has no team or department breakdowns. Those make re-identification harder. They do not settle the question for every workplace, so the DPIA should test it. The reasoning behind the floor is on why n≥5.
A controller "determines the purposes and means of the processing of personal data". A processor "processes personal data on behalf of the controller" (ICO, What are controllers and processors?).
In the usual set-up, the employer decides to measure its workforce and is the controller. A platform that runs the check-in on the employer's instructions is a processor, and Alltoogether is a processor or sub-processor under our data processing agreement. A platform that decides what to ask, or uses the answers for its own purposes, may be a controller in its own right. Controllers "must enter into a binding contract or other legal act with your processors", with the terms Article 28(3) requires (ICO, What does it mean if you are a controller?).
That choice is the controller's. The ICO says "you must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9" (ICO, What are the rules on special category data?).
Consent needs care at work. The ICO notes that "As an employer, you will generally be in a position of power over your workers" (ICO, workers' health information). For a wellness programme, it says that where "participation is optional and there are no adverse consequences to those who do not want to take part, the employer can consider consent as their lawful basis" (ICO, health monitoring). Our DPIA template lists the options controllers most often consider and the facts about the IWE that bear on each.
We think every deployment should have one. The ICO says a DPIA is required for "processing on a large scale of special categories of data", and that "employees could be considered vulnerable data subjects where a power imbalance means they cannot easily consent or object" (ICO, When do we need to do a DPIA?). Its guidance on workers' health says: "You should carry out a DPIA given the sensitive and potentially intrusive nature of processing workers' health information."
The sandbox's database is hosted in London (UK) and its API runs in Dublin (Ireland). Production is designed to use the same regions. The sub-processors and the security measures are on the trust and security page.