Privacy Policy: Workplace Bias Awareness Screener
Last updated 8 October 2026. This policy covers the Aperio Workplace Bias Awareness Screener at bias.aperioprofiles.co.uk. The ADHD screener, the autism screener, and the Aperio Workplace Profile have their own privacy policies on their own sites, because they process different data.
Who we are
Aperio Profiles is a trading name of Liberation Academy Ltd, a company registered in England and Wales (company number 16087057), registered office 20 Wenlock Road, London N1 7GU. We are the data controller for the personal data described in this policy and we are registered with the Information Commissioner's Office (ICO), registration reference ZB819301. Data protection contact: enquiries@liberationacademy.co.uk.
What we collect
Your email address, so we can send you your results, and your name if you choose to give it. The name field is optional. We also record the access code you used and, if that code was issued by an organisation, which organisation issued it.
Your answers to the screener: how you would interpret a series of workplace situations, how far you agree with statements about workplace practice, what you would do if you saw someone treated unfairly, and how often you work closely with colleagues from different groups. The screener does not ask about your own ethnicity, health, religion, sexual orientation or other personal characteristics.
How long you spend on each question. Your browser measures this so we can check whether answers were read (for example, whether many were answered faster than they could be read). We keep only a summary of that check with your results; the individual timings are not stored.
Optional written reflections at the end. These are not scored and are not stored: see below.
The scores we compute from your answers: your scores in each of eight areas, your scores by kind of decision, your speaking-up result, your score bands and overall band, any response-pattern flags, and the list of questions you were given (questions are drawn from a larger bank, so people see different sets).
Before 1 October 2026 the screener also asked optional questions about you (such as ethnicity, disability, religion and sexual orientation) and sent short written answers to OpenAI for scoring. It no longer does either. Answers collected under the earlier version remain covered by the retention and deletion terms below, and you can ask us to delete them at any time.
Technical data recorded with your consent
When you give or withdraw consent, we also record your IP address and your browser's user-agent string alongside the exact wording you were shown and the time. We keep this only as evidence that consent was properly given, which UK GDPR Article 7(1) requires us to be able to demonstrate. It is not used for tracking, profiling, or advertising.
If you decline consent, we record that too: that you declined, the email address you entered, the access code, the time, the wording you were shown, and your IP address and browser user-agent. We keep this so that we can show the code was not used. No answers or results are collected or stored when you decline.
Special category data, and where the line falls
The screener does not ask for special category data under Article 9 of the UK GDPR. If something you write in the optional reflections reveals special category information, such as your health, religion or sexual orientation, that is covered by the explicit consent you give on the consent screen under Article 9(2)(a), and it is not stored. Answers to the intake questions collected before 1 October 2026 included special category data and remain held on the basis of the explicit consent given at the time.
Your bias scores are not special category data. They are sensitive profiling, and we treat them carefully, but they are not Article 9 data and we do not claim otherwise.
Our lawful basis under Article 6 is performance of our contract with you (Article 6(1)(b)) where you bought access yourself, and your consent (Article 6(1)(a)) where an organisation gave you the code. Taking the screener is voluntary and confidential, and you can withdraw your consent at any time.
Your written reflections
The reflection questions at the end are optional. Your answers are not scored, are not sent to any third party for analysis, and are not saved to our database. They are included in your results email, sent through our email provider Resend, and then discarded. That email is your only copy.
How your scores are produced, and what they are not
Your scores are computed on our servers from the answers you submit, using a fixed scoring method, not from a value your browser sends us. This is a reflective screening instrument. It does not diagnose bias, prejudice, or any psychological or medical condition, it is not medical or legal advice, and it does not make any automated decision about you with legal or similarly significant effect.
Who sees it
Your results go only to the email address you give us. We do not share them with employers, third parties, or advertisers, and we do not sell your data.
If you used a screener code funded by an organisation, the organisation is not told who requested or used it. It is not told whether you consented or declined. If you decline, that is recorded for our own accountability, but it is not sent to your employer's dashboard. Screener completions are shown to the organisation only as an organisation-wide count, never named. It never shows your scores, your bands, your answers, or anything you wrote. That boundary is enforced in the software, not merely promised in this policy.
Where it is stored and who processes it for us
Your data is stored with Supabase in the UK region (AWS London), with row-level security locked to server-side access only. The site runs on Vercel. Results emails are sent via Resend. If you bought access yourself, payment is processed by Stripe and we never see or store your card details. If you accept analytics cookies, Google Analytics (Google) and Vercel Analytics (Vercel) receive information about your visit, such as the pages you view, your browser and device, and your IP address, which Google Analytics anonymises. They do not run unless you opt in: see our cookie policy. Each provider processes your data under a data processing agreement.
Vercel, Resend, Stripe and Google process some data on US infrastructure. Those transfers are safeguarded by the UK Addendum to the EU Standard Contractual Clauses, or the UK IDTA, in our agreement with each provider.
The chat assistant
The Live Help button on our sites opens the Aperio Assistant, an AI assistant. When you use it, we process what you type, the page you were on (with any code or link removed from the address), a random conversation ID, and a scrambled (hashed) version of your IP address that we use only to prevent abuse. If you send something to our team through its form, we also process the name, email address and organisation you choose to give. We use this to answer your questions and deal with what you send us, and we look at the questions people ask, grouped by topic, to check and improve the answers. Our lawful basis is our legitimate interest in supporting the people who use Aperio and responding to enquiries (Article 6(1)(f)), or our contract with you where your question is about something you have bought (Article 6(1)(b)).
Your messages are sent to Anthropic, the provider of the AI model, to generate the replies. Anthropic acts as our processor under its data processing addendum, does not use them to train its models, and deletes them within 30 days. Anthropic processes data in the United States; the transfer is safeguarded by the UK Addendum to the EU Standard Contractual Clauses in that addendum.
We keep chat conversations, and the record of each question and the reply it got, for 30 days after the last message and then delete them automatically. After that we keep only a count of the topics asked about and a short general rewording of each question, written without personal details and not linked to you. Anything you send through the form is kept until we have dealt with it and for up to 24 months after that; the copy of the conversation attached to it is deleted 30 days after we close it. Please do not type health information, diagnoses or results into the chat: we do not need them. The conversation is also kept in your own browser for up to 12 hours so that it survives a page change, and Clear chat removes it.
Separately, a usage log holding the hashed IP address, the conversation ID and timing data is kept for 90 days for abuse prevention and service monitoring, and then deleted automatically.
How long we keep it
We keep each type of data only as long as we need it. Your raw answers (and any intake answers given before 1 October 2026) are deleted or anonymised about 90 days after your report is produced, and your scores are kept while your Aperio account is active. If you do not have an Aperio account, your scores are deleted 24 months after your last activity. Written reflections are never stored. These deletions run automatically and are logged.
Access codes and session tokens are kept for up to 12 months. Codes issued to an organisation and not yet redeemed expire 180 days after issue. Consent records are kept for up to 6 years, because the law requires us to be able to demonstrate the consent you gave. If you bought access yourself, payment records are also kept for 6 years, because tax law (HMRC) requires it.
Your rights
You can exercise most of your rights yourself from your Aperio account: see what we hold about you, download a copy, withdraw your consent, and request erasure. You can withdraw consent at any time, and withdrawal does not affect processing already carried out before you withdrew.
We action erasure requests within one calendar month. We delete everything the law allows us to delete; where the law requires us to keep something, we will tell you what is kept and why. For rectification, restriction, objection, or anything else, email enquiries@liberationacademy.co.uk. You also have the right to complain to the ICO at ico.org.uk.
Age
This screener is for adults. You must confirm you are 18 or older before you can begin.
Cookies
See our cookie policy. Analytics run only if you opt in, and you can change your choice at any time from the cookie preferences link in the footer.
Contact
Data controller: Liberation Academy Ltd, trading as Aperio Profiles, registered in England and Wales (company number 16087057), registered office 20 Wenlock Road, London N1 7GU. Email: enquiries@liberationacademy.co.uk.