Bloom Privacy Policy
[As of 22nd November 2024]
Privacy is very important to Bloom, and we have implemented strict protocols to ensure the protection of your information. This policy is intended to help you understand what data we collect, how we use it, and your rights related to it. Bloom has appointed a Data Protection Officer (DPO) who oversees the collection and protection of your personal information who can be reached by email at dpo@aphaia.co.uk.
The information that you provide to us or that we collect or receive about you may depend on how you interact with us and the services that you choose to use. Generally, we may collect the following information about you when you sign up for and interact with the Bloom Services:
contact information such as your name, and email address;
device identification information for push notifications; and
information necessary for the management of the client relationship such as your company name, for the purposes of validating your membership.
Additionally, phone numbers may be collected at some point for verification and other notification purposes.
Information provided for onboarding purposes
During the onboarding process, your employer will provide us with the basic information that will enable us to identify you and enable you to register, such as your name, email address, department, county or residence and job title. Should you not sign up for our service and provide consent to use it, we will delete any personal data within six months after termination of the contract with your employer. You can also delete your individual personal data at any time.
Information Provided by You Through the Chat Feature or Personal Coaching Sessions
If you choose to use the chat feature of the Bloom Services (“Chats”) or the virtual one-on-one coaching sessions (“Sessions”), the guidance you seek may prompt more specific information to be discussed. All information exchanged during Chats and Sessions is voluntary and kept confidential. This information is stored by Bloom in connection with your membership but is not used for any other purpose. Additionally, certain automated tools for calendars and virtual meetings may be used to set up and conduct Sessions as well as to send reminders and make changes to meeting dates and times, etc. We may also use chat transcripts to improve the product and coaching experience.
If you provide information to us through these features, including mental health data, you will have to consent to Bloom’s processing of this data for the purposes of providing the Bloom Services.
Information provided by you will be kept strictly confidential and will not be shared with your employer, except in the form of statistical, non-personal data and/or anonymous feedback examples, and in the form of the number of coaching actions per user without referring to their content.
Information Collected by Automated Means
We also collect or receive information over time and across different websites or platforms when you use Bloom Services. We track user information in the app through tracking APIs and on the web through cookies. This information may include:
information about the use of our site, such as records of, or relating to, your Internet Protocol address, your general geographic location, your browser type, your operating system, the pages you view on the services, the pages you view immediately before and after you access the site, and the search terms you enter on the site;
information about communications and other interactions between you and us about our site;
information about your transactions with third parties, including any third-party providers you access through our site; and
decisions you may make with respect to the Bloom Services offered through the Bloom application and the website (the “Bloom Platform”).
Information to Protect the Bloom Services
We further use certain software programs to prevent hacking, detect computer viruses and other software that might damage our computers or the network, and monitor and fine-tune our network’s performance. These programs may detect additional information from your computer such as your IP address, addresses from network packets, and other technical information. Such information is used to maintain the security and performance of our networks and computer systems. We may also combine the information you provide us and information we automatically collected with information from public or third-party sources.
Our Data Processors
Bloom may use the following processors to host personal data or provide other infrastructure that helps with delivery of the Bloom Services:
Processor
Role
Airtable
User Waitlist and coaching feedback
Attlassian
Customer support, documentation and task management
Amazon Web Services
Cloud service hosting provider
Auth0/Okta
User Identification
Calendly
Calendar scheduling
Expo EAS
Mobile deployments
GitHub
Code storage and deployment
Google Analytics
Data analytics
Google Looker
Reporting
Google Workspace
Collaboration, communication and document storage
HubSpot
CRM services
Hyvor Talk
Commenting system on the Bloom website
Intercom
Coaching Chat and support
Microsoft
Coaching Chat and transcripts
Mixpanel
Analytics and feedback
OpenAI
Coaching Chat and subtitle generation
OneSignal
Notifications
Retool
Admin tooling
Sentry
Client crash reporting
Slack
Instant messaging
SonarCloud
Security scanning
Split
Feature flags
Storyblok
Content management
Talent LMS
Coach training platform
Twilio
Chat connections
If any of your personal data is used by these parties, Bloom will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, as well as Bloom’s legal obligations. If any of your personal information is transferred or used outside of the UK, Bloom will take suitable steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK, using an appropriate transfer mechanism such as Standard Contractual Clauses for third countries without data protection adequacy such as the US. Please note that the list of processors may change; however, this is not expected to change the purpose of processing.
We use your personal information to:
Verify your identity;
Register and service your online account;
Provide the Bloom Services and Sessions to you,
Customise your experience when using the Bloom Platform;
Fulfil legal and regulatory requirements;
Detect and prevent fraud, suspicious claims, and other illegal activities;
Generate and analyse statistics about your use of the Bloom Services; and
Analyse and improve products and services, enhance the Bloom Services, and evaluate the effectiveness of our marketing activities and overall services.
We may also use your data to help us analyse patterns, which data we may share with business partners to conduct analysis and research about customers and website visitors.
Personal data that we process may be shared with analytics, communications, database, authentication, marketing, content and user management, testing, cloud infrastructure and other cloud services providers, recruitment and HR services providers. Where personal information is shared with entities in third countries without an adequacy decision, such as the US, an appropriate transfer mechanism such as Standard Contractual Clauses or a Data Protection Agreement shall be used to protect your data in such jurisdictions. Additionally, if you choose to participate in Sessions, your contact information such as your name and email address will be transmitted to the coach with which you were matched.
Also, when you decide to use the Relatability feature offered in the Bloom app, you will, by default, share your basic personality tendencies with other users in your organization on a reciprocal basis. You may change that in your app privacy settings and stop the sharing. Other users may ask you to share your tendencies on a reciprocal basis but you are free to refuse, with the only consequence being your not being able to access their tendencies.
What About Sensitive Data?
You will not be asked to provide sensitive data but you may choose to reveal certain personal data during exercises or coaching sessions. Special categories of data such as on your physical or mental health, sexual orientation, or sex life shall only be processed after you have given your consent, which you can withdraw at any time, Withdrawal of consent will, however, not affect the lawfulness of earlier processing.
If you sign up for and consent to Sessions, a coach arranged by Bloom may review your previous Chats and any other correspondence with Bloom for career coach, mentoring, etc. You and the coach or coaches who conduct the Sessions are able to see the messages you send, as well as the answers or the entries you submit through Chats. Information shared during Sessions are not shared with any third party, and your live Sessions are not recorded. This information will be visible to anyone on the coaching team and may be shared internally with a coach administrator appointed to manage coaches who conduct Sessions for quality control and feedback. We do not share your Chats or Sessions with your employer.
We keep your personal information as long as may be necessary to enable your continued use of Bloom Services, for the time period reasonably necessary to achieve the purposes described in this Privacy Policy, or any other notice provided at the time of collection unless a longer retention period is required or permitted by applicable law, taking into account applicable statutes of limitation and our records retention requirements and policies. In case of Chat and/or Session-related personal information, we keep the data as long as you have an account with Bloom, as may be necessary to anonymise all personal data and/or as long as necessary for Bloom to complete all business purposes in connection with your account. If you wish to have Bloom delete your personal information and/or for Bloom to cease contacting you, please email privacy@usebloom.com. Generally, your data will be retained for a period of up to six months after termination of Bloom’s contract with your employer.
Subject to UK law, you have the following rights in relation to your personal information, which can be exercised by emailing to privacy@usebloom.com.
Right of access: If we are processing your personal information you can request a copy of that information by emailing privacy@usebloom.com.
Right to rectification: If your personal information is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your personal information with others, we will tell them about the correction where possible.
Right to erasure: You may ask us to erase your personal information in some circumstances, such as where we no longer need it or you withdraw your consent by deleting your account in the app or by emailing privacy@bloom.com.
Right to restrict processing: You may ask us to restrict or ‘block’ the processing of your personal information in certain circumstances, such as where you contest the accuracy of the data or object to us processing it, subject to UK GDPR.
Right to data portability: You have the right to obtain your personal information from us that you consented to give us or that was provided to us as necessary in connection with our contract with you. We will give you your personal information in a structured, commonly used and machine-readable format. You may reuse it elsewhere.
Right to object: You may ask us at any time to stop processing your personal information where we process your data based on our legitimate interests, provided no compelling legitimate grounds for further processing exist. All marketing emails from Bloom will also have a link for you to opt out of receiving future marketing emails from Bloom, but we may continue to send service emails.
Rights in relation to automated decision-making and profiling: You have the right to be free from decisions based solely on automated processing of your personal information, including profiling, unless this is necessary in relation to a contract between you and us or you provide your explicit consent to this use.
Right to withdraw consent: If we rely on your consent to process your personal information, you have the right to withdraw that consent at any time, but this will not affect any processing of your data that has already taken place.
Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your personal information, you can report it to the ico.org.uk
To exercise any of the above rights, or if you have any questions relating to your rights, please email privacy@usebloom.com. We may need to request specific information from you when you exercise your rights to confirm your identity and to speed up our response. We may not be able to fulfil your request if we are not able to identify you.
Bloom is a General Audience Site and the Bloom Services are only available to persons aged 16 and over. The Bloom Services are not directed to persons under 16 and we do not knowingly collect personal information from children under 16. Children under 16 years of age are prohibited from providing any personal information in conjunction with the Bloom Services. If you become aware that your child has provided us with personal information without your consent, then please contact us at privacy@usebloom.com so that we can take steps to remove such information and terminate the child’s account.
Bloom does not use your data for third-party marketing purposes. Under California’s Shine the Light law, site visitors who are California residents may request and obtain a notice once a year about the personal information we share with other businesses for their direct marketing purposes. To obtain such a notice, please email privacy@usebloom.com and indicate in the email subject line, “California Shine The Light Request.” Please include your mailing address, state of residence and email address with your request..
For California residents under the age of 18 and registered users of the Bloom App or the Bloom Site, California law (Business and Professionals Code § 22581) provides that you can request the removal of content or information you posted on the Bloom App or the Bloom Site. Any such request should be sent to us at privacy@usebloom.com along with a description of the posted content or other information to be removed. Be advised, however, that applicable law may not permit us to completely or comprehensively remove your deleted content or for other reasons as set forth in this California law.
The California Consumer Privacy Act (CCPA) gives California consumers enhanced rights with respect to their personal information that is collected by businesses. Pursuant to the CCPA, California consumers may opt out of having their personal information sold to other persons or parties. Consumers may also demand to know what types of information that a business collects from them. Bloom does not sell any personal information to third parties for any purpose. To make a “request to know” or request to delete your personal information, please send an e-mail to privacy@usebloom.com and put either “Request to Know” or “Request to Delete” in the subject heading of your email. We will honour these requests for US individuals whether or not you would qualify as a California consumer under the CCPA. You can also delete your account within the app through the app settings page.
We currently do not honour browser-based Do-Not-Track signals.
We may amend this Privacy Policy from time to time in order that it accurately reflects the regulatory environment and our own data collection and disclosure practices. Accordingly, you should review this policy periodically. When we change this Privacy Policy in a material way, we will update the “last modified” date at the top of this Privacy Policy. Changes to this Privacy Policy are effective when they are posted on this page.
In the event that you have a complaint about our treatment of your personal information, you have the right to contact our DPO at dpo@aphaia.co.uk or to lodge a complaint with the supervisory body, the Information Commissioner - ico.org.uk. Details of how to do this are set out in the “for the public” section. However, Bloom welcomes the opportunity to resolve any complaint and we would suggest you first refer your complaint by email to privacy@usebloom.com and/or dpo@aphaia.co.uk prior to making a complaint to the Information Commissioner.
If you have any complaints relating to the management of your personal information that was collected in Australia, please forward your complaint by email to privacy@usebloom.com.
We will consider the complaint and advise you of their decision in writing within a reasonable time from receipt of the complaint. If you are not satisfied after lodging a complaint with us and have given us reasonable time to respond, then you have the right to lodge a complaint with the Office of the Australian Information Commissioner - https://www.oaic.gov.au/about-us/contact-us/
If you have any concern about privacy at Bloom or want to contact us, please email privacy@usebloom.com with a thorough description of your issue and we will try to resolve it for you.