Roots Workplace Challenge Privacy

Last updated: 22 October 2026

Who are we?

Roots Health Academy Workplace Challenge is delivered by Intelligent Health. We are a company in the UK, registered with the ICO under Payment Tier 1, Z1676868. At Intelligent Health, we are committed to maintaining the trust and confidence of our clients and players. Intelligent Health will never sell, rent or trade email lists or personal data with other companies and businesses.

In order to be clear and transparent, this privacy policy provides detailed information on when and why we collect your personal information and how we use it.

What data does Roots Health Academy Workplace Challenge collect and why?

As part of running the RHA Workplace Challenge we have a number of different activities which may involve the collection and handling of your information. Please see a list below describing our different activities and what information we need as part of this.

1. Data that we collect when you use our website where cookies are enabled

Information on how we collect and use data obtained from cookies, is available on our cookies page.

We use this information to:

  • Ensure content is presented in the most effective manner;
  • Develop new services based on the information being collected;
  • Analyse site traffic and understand customer needs and trends;
  • Identify issues with the website and user's experience of it;
  • Monitor the way our website is used.
  • We only do this if you accept these cookies. You can find out how to change your cookies preferences and information on how to control cookies through your browser settings on our cookies page.

2. Data that we collect when you use the RHA Workplace Challenge App:

  • Registration information, as listed below;
  • Location tracking data using geolocation functionality (with permissions);
  • Motion tracking data;
  • Step count from your health application (Google Fit, Apple Health – with permissions);
  • Device information;
  • Usage and diagnostics data.

We use this information in order to operate the game, without this it would not be possible to play the RHA Workplace Challenge using the App.

Registration information is used as described in this wider policy to create and manage your account; in the app this is used to reattribute your points with your account.

Your precise location is processed through geolocation functionality in order to measure your movements and earn points as part of the game. You can amend your tracking status by going to the settings section of the app

We use motion tracking information to assess when you are walking, running, cycling or at rest. Not only does this help us accurately calculate and attribute points it also allows us to turn off geolocation features when you are at rest so that we track you as little as possible whilst playing the game.

Where you agree to share your health data app with us we use your step count to further improve the calibration of our points calculation and also use this to measure the impact of the game but do so in a way which does not identify you.

We use device, diagnostics and usage information to continually improve our application.

We only collect and use this information where it is necessary for us to deliver the game. Where we use your information outside of what is absolutely necessary to run the game we ask for your consent.

3. Data that we collect when you register to take part in the RHA Workplace Challenge:

  • First name
  • Email address

We collect your personal information and contact details so that we can contact you in our legitimate interest to:

  • Enable you to participate in the game
  • Contact you to verify your RHA Workplace Challenge account and contact details provided
  • Contact you to provide information on how to get ready to play RHA Workplace Challenge
  • Inform you of the game's start date
  • Share guidance related to player safety
  • Alert you to any exceptional circumstances that could force us to stop the game
  • Contact you to ask for your feedback regarding your experience of playing the game.
  • Notify you if you have won a prize for reaching the top of a Leaderboard or a Lucky Tap prize (game update).

If you do not wish to receive this information, you can contact our helpdesk to de-register your account and have your personal information removed from the system. Please note that if you request to remove your account, you will be unable to participate in competitions or appear on the leaderboard.

4. Data we collect when you collect a Beat Box or a Gem:

  • Which Beat Box/Gem is collected (location)
  • When each Beat Box/Gem is collected

We need this information in order to calculate your points for the game to work.

We use this information in line with our legitimate interest in running the game smoothly and effectively.

5. Data we process when you opt into marketing during registration:

  • First name
  • Email address

We collect this information during registration and will process it in order to:

  • Send you weekly information about competitions events during RHA Workplace Challenge
  • Send you reminders to complete any surveys for which you can earn additional points for your team.

We only send the above information when you have given your specific consent to receive marketing during registration. If you wish to withdraw your consent, you can do so by contacting our helpdesk via the 'Help?' widget that appears on the RHA Workplace Challenge website.

6. Data we process when you opt in to marketing when joining a game

  • First name
  • Email address

7. Data we may collect when you respond to our surveys:

  • First name
  • Email address
  • Email opening statistics

We collect the information listed here for:

  • Intelligent health to measure the effectiveness of the RHA Workplace Challenge programme.
  • evaluate whether the RHA Workplace Challenge programme has led to changes in behaviour and improved employee engagement and connection.
  • help us monitor and improve our e-newsletter.
  • report back to our clients on the effectiveness of the challenge.

Our data is not used for commercial purposes currently, but any such use in the future would have to meet required ethical standards that align with IH's mission of improving health and wellbeing for all. Should the data be used for such purposes, we will inform you where possible by updating the privacy notice. Any data shared for commercial purposes would be sufficiently de-identified so personal data should not be reidentified.

We process this data in accordance with Article 9(2)0) of the UK GDPR in accordance with Schedule 1, Part 1, 4 Research of the Data Protection Act 2018 (archiving, research and statistics). This is not shared with the other Party.

8. Data we may collect when you take part in events, photoshoots or videos

  • Photographs
  • Video footage
  • Audio footage
  • Name
  • Email address

We process this player data in our legitimate interest to promote the game, foster engagement and to promote the benefits of physical activity and connection.

We will notify you if a photoshoot or video will be taking place in any event advertising, and have clear signage at events to indicate photography is taking place. We will also ensure photo policy information is available explaining the purposes for which the footage may be used. Our photographers and videographers will also take verbal consent for any photos.

You have the right to withdraw this consent at any time by contacting communications@intelligenthealth.co.uk in which case we will stop using information that you had consented for us to use and they will not be used in future publications. Please note that they may continue to appear in publications already in circulation, where these cannot be adjusted or reissued. You also have the right to request to see a copy of the information we hold about you and to request corrections or deletions of the information that is no longer required, you can do this by contacting communications@intelligenthealth.co.uk.

Who will my data be shared with?

RHA Workplace Challenge is delivered by Intelligent Health who will access data for the reasons stated above. Additionally, to help deliver the programme, your data may be shared with the following third-party processors, on which we carry out due diligence tests:

  • Brevo - your name and email address will be shared with Brevo to issue email newsletters weekly during the game.
  • SurveyMonkey – all surveys are hosted with SurveyMonkey. View SurveyMonkey's Privacy Policy.
  • Amazon Web Services (AWS) - provides us with cloud infrastructure to host and manage the RHA Workplace Challenge website.
  • Google Data Studio, Google Cloud Platform and Google Big query - provides us with analytics and business intelligence. We have risk-assessed the above data processors and subsequent transfer to them in order to de-risk the transfer of data to these platforms. As part of this, we have ensured that there are Standard Contractual Clauses in place between us to cover this transfer.
  • Freshdesk - your name and email address will shared with Freshdesk if you opt to contact us via our helpdesk or website.
  • Appzi - your name and location (county-level) will be shared with Appzi if you opt to provide feedback on the game via our Appzi 'share your feedback' widget.
  • Sprout - we use a third-party provider, Sprout, to manage our social-media interactions. If you send us a private or direct message via social media, it will be stored by Sprout. It will not be shared with any other organisation.
    View Sprout's Privacy Policy.
  • Prospective RHA Workplace Challenge Clients (including general marketing) - photographs and audio/video footage may be shared with prospective clients in the form of sales or marketing brochures, social media platforms and presentations.

Where you consent to receiving our Newsletter or agree to participate in our Surveys some of your data will be shared with SurveyMonkey who are based in the USA. As part of this Intelligent Health has employed the services of the Data Protection People who have carried out a Transfer Risk Assessment to ensure that this sharing is carried out securely and compliantly.

In respect of the above suppliers Intelligent Health will ensure that they are risk assessed and subject to appropriate contractual terms.

Summary of how long your data will be kept for different purposes

Unless you have provided explicit authority for data to be kept for longer:

  1. Personal data collected through registration will be de-identified 26 months after you have registered to participate. Personal data for the purposes of this statement, includes: your email address and name. It will be de-identified by removing name and email address.
  2. Personal data will be removed from tap data after 14 months - the data will be de-identified using Globally Unique Identifiers (GUIDs). These GUIDs will link tap data to the personal data collected in our surveys, which itself will be de-identified after 26 months.
  3. Data used to contact you for marketing or service updates, held by our third-party provider (Brevo), will be deleted 14 months after registration for the game.
  4. Data collected in surveys using our third-party provider (Surveymonkey) will be removed from Survey Monkey 26 months after completion of the survey. This data will then be de-identified and moved to AWS to be stored for an undefined period for the purpose of conducting statistical research to help improve physical activity and mental wellbeing for communities. We de-identify this data by removing personal identifiable information (such as name, email addresses).
  5. Photo, audio or video footage data collected at events will be retained for a period of 36 months, or for a longer period if the content remains relevant in its current form when incorporated in marketing or promotional brochures, presentations, podcasts or videos. This will be removed at your specific request.

We will retain the below-listed information for the purpose of statistical research in a manner to ensure that persons cannot be re-identified.

  1. Game play (Tap Data, Points, Mileage)
    1. Purpose: Understand level of game interaction, support game experience, and tailor advice and behaviour change methods to increase physical activity levels. To identify spatial patterns related to active travel mobility.
  2. Stories (Player and partner experiences)
    1. Purpose: To gain feedback of the game experience, identify trends in behaviour change to make improvements to the game, identify physical activity and mental health needs and demonstrate impact.
      Photo, audio or video footage data collected at events will be retained for a period of 36 months, or for a longer period if the content remains relevant in its current form when incorporated in marketing or promotional brochures, presentations, podcasts or videos. This will be removed at your specific request.

Summary of how long your data will be kept for different purposes

You may have certain rights in relation to your information. The availability of these rights and the ways in which you can use them are set out below in more detail.

Access: you are entitled to ask us if we are processing your information and, if we are, you can request access to your personal information. This enables you to receive a copy of the personal information we hold about you and certain other information about it.

  • Correction: you are entitled to request that any incomplete or inaccurate personal information we hold about you is corrected.
  • Erasure: you are entitled to ask us to delete or remove personal information in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the data is required for compliance with law or in connection with claims.
  • Restriction: you are entitled to ask us to suspend the processing of certain of your personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Transfer: you may request the transfer of some of your personal information to another party.
  • Objection: where we are processing your personal information based on a legitimate interest you may challenge this. However, we may be entitled to continue processing your information based on our legitimate interests or where this is relevant to legal claims.
  • Automated decision making and profiling: we do not perform any automated decision-making based on personal data that produces legal effects or similarly significantly affects you.
  • Withdrawal of consent: where you have provided us with your consent for a particular processing activity you can withdraw this at any time. Please note that this will not affect any processing we have undertaken up until your withdrawal.
  • Lodge a complaint with Intelligent Health or the Regulator: If you have any concerns or wish to make a complaint about this Privacy Notice or our handling of your Personal Data, please contact us at info@intelligenthealth.co.uk. We will investigate your complaint as promptly as possible, will confirm receipt of your complaint within 30 days, will inform you on the progress of your complaint throughout our investigation, and we will provide you with a response without undue delay. If you are still not happy, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

    Information Commissioner’s Office
    Wycliffe House
    Water Lane
    Wilmslow
    Cheshire
    SK9 5AF
    https://ico.org.uk/global/contact-us/ 

Some of these rights will only apply in certain circumstances. If you would like to exercise, or discuss, your rights below please contact us at info@intelligenthealth.co.uk, or alternatively you can write to:

Intelligent Health
Reading Enterprise Centre University of Reading Earley Gate
Whiteknights Road Reading
RG6 6BU.

Changes to this privacy notice

We keep our privacy policy under regular review and we will place any updates on this webpage. This privacy policy was last updated in September 2026.