Privacy Policy
Last updated 8 October 2026. This policy covers the Aperio Workplace Profile and this website. The ADHD, autism, and bias screeners have their own privacy policies on their own sites, because they process different data. Aperio is for adults aged 18 and over.
Who we are
Aperio Profiles is a trading name of Liberation Academy Ltd, a company registered in England and Wales (company number 16087057), registered office 20 Wenlock Road, London N1 7GU. We are the data controller for the personal data described in this policy, except where the next section says otherwise, and we are registered with the Information Commissioner's Office (ICO), registration reference ZB819301. Data protection contact: enquiries@liberationacademy.co.uk.
Who is responsible for your data
Aperio Profiles (Liberation Academy Ltd) is the controller for assessment and screening data and for each person's own account. For the part of a Workplace Profile shared with an employer, the employer and Aperio are joint controllers. Where Aperio holds an employer's roster on its instruction, it acts as the employer's processor.
What we collect
When you complete a workplace profile we collect: your email address, your name if you provide it, the sex you were assigned at birth, your work arrangement, any existing diagnoses you choose to disclose, whether you opted into pattern screening, your answers to the assessment questions, and your working-style preferences. From your answers we generate your profile results, which include executive function scores, personality (OCEAN) scores, any pattern screening indicators you opted into, and a set of candidate workplace adjustments.
Technical data recorded with your consent
When you give or withdraw consent, we also record your IP address and your browser's user-agent string alongside the exact wording you were shown and the time. We keep this only as evidence that consent was properly given, which UK GDPR Article 7(1) requires us to be able to demonstrate. It is not used for tracking, profiling, or advertising.
Special category data
Your executive function scores, any neurodivergence screening results, and any existing diagnoses you share are special category health data under UK GDPR Article 9. We process them only with your explicit consent, which we ask for on a dedicated consent screen before the assessment starts and record with the exact wording you were shown. Personality scores are not special category data.
Why we process it and our lawful basis
Your answers are used to generate your profile and your results. Your email is used to deliver them. Our lawful basis is the contract with you (Article 6(1)(b)) and, for the health data described above, your explicit consent (Article 9(2)(a)). We do not use your assessment data for advertising, and we do not sell it. The table below sets out the lawful basis for each purpose. You do not have to give us any of this information, and there is no legal requirement to. Without your answers and an email address we cannot produce or deliver a profile, and without your explicit consent we cannot process the health-related parts, so the assessment cannot start.
| What we do | Lawful basis |
|---|---|
| Generating your profile and results, and delivering them to you | Our contract with you (Article 6(1)(b)). For the health-related inferences (executive function scores, any screening results and any diagnoses you share): your explicit consent (Article 9(2)(a)). |
| Sharing the baseline part of your profile with your employer (name, work email, job title, personality profile and work arrangement), if you took it through your employer | Legitimate interests (Article 6(1)(f)): your employer's and Aperio's interest in helping your organisation understand how its people work best and support them. This part of your profile contains no health data, and your employer is contractually barred from using it to make decisions about you. Sharing it is the purpose of a profile your employer provides, so it is not based on your consent. Before you start, we show you exactly what will be shared and you can decline. |
| Holding the employee list your employer gives us (name, work email, job role, team and manager) to invite you and administer the rollout | Your employer is the controller of its employee list and relies on its own lawful basis, usually its legitimate interests (Article 6(1)(f)). Aperio holds the list as your employer's processor, on its instruction, under our Data Protection and Data Sharing Agreement with your employer. |
| Keeping evidence of the consents you give or withdraw (the wording shown, the time, your IP address and browser user-agent) | Legal obligation (Article 6(1)(c)): UK GDPR Article 7(1) requires us to be able to show that consent was given. |
| Keeping records of workplace adjustments shared with your employer for up to 6 years, as Equality Act 2010 evidence | Our legitimate interests in being able to show what was shared and when (Article 6(1)(f)), and the establishment, exercise or defence of legal claims (Article 9(2)(f)). |
| Sending you marketing emails, if you join our mailing list | Your consent (Article 6(1)(a)). |
| Answering you through the Aperio Assistant chat and dealing with what you send the team | Our legitimate interests in supporting the people who use Aperio (Article 6(1)(f)), or our contract with you where your question is about something you have bought (Article 6(1)(b)). |
| Analytics (Google Analytics, Vercel Analytics) and the Meta Pixel | Your consent through the cookie banner, under PECR Regulation 6 and Article 6(1)(a). |
Automated processing
Your results, any pattern screening indicators and the list of suggested workplace adjustments are generated automatically from your answers. Aperio makes no decision about you that has a legal or similarly significant effect: you decide what, if anything, to share, and any decision at work is made by people. Employers have agreed, as a condition of using Aperio, not to base decisions about individuals on Aperio data.
If you took the assessment through your employer
If you complete the profile through your employer, part of your profile is shared with your employer's dashboard so that they can understand how you work best, support you, and plan and balance teams. Your employer sees your name, your email address, your job title, your personality (OCEAN) profile, and your work arrangement. Your employer does not receive the sex you were assigned at birth, your executive function scores, any neurodivergence or pattern screening results, any diagnoses you disclose, or your raw answers: those are never shared with your employer. The sex you tell us is used only to select the right version of the assessment for you. Your full results are not sent to your work email address without your say; when you finish, you choose where your results go. Specific workplace adjustments are shared with your employer only when you actively choose to share them, as written or flagged for discussion, and you can withdraw a shared adjustment at any time from your Aperio account. When you share an adjustment you can also choose to tell your employer which area it relates to (ADHD, autism, dyslexia, dyspraxia or other). That is a separate, explicit choice. No score or result is attached to it, and you can withdraw it at any time from your account. Screener use is shown to employers only as anonymous, organisation-wide figures: how many people completed a screener and how many scored in the high range. These are never named, and they are hidden unless the group is large enough that nobody could be identified. If your workplace profile suggests possible ADHD or autistic traits, you are offered a screener, either using one of your employer's codes or by buying one yourself. Both are anonymous. If you use an employer code, your employer approves the request first: it is told that someone has requested a screener and which kind, but not who asked, and it never sees your result. If you buy one yourself, your employer has no involvement at all. Your employer may also give its team a request code. If you enter that code at www.aperioprofiles.co.uk/screener-request, a screener from the employer's pool is set up for you without an account: we do not record your name or email address at that step, and your employer is not told who used the code or whether you completed the screener. For the part of your profile that is shared with your employer, your employer and Aperio are joint controllers under UK GDPR: Aperio decides what is collected and shown and keeps it secure, and your employer decides how it uses the shared profile within its organisation. Your employer is contractually prohibited from using your profile to make recruitment, promotion, disciplinary, redundancy or other employment decisions about you, and from using Aperio to assess job candidates. It may use the overall balance of working styles across a team when it plans what a new role needs. Sharing this part of your profile is the purpose of a profile your employer provides, so it is not based on your consent and cannot be switched off once the profile is complete. If you do not want your employer to see it, you can decline before you start. In your Aperio account you can choose whether your profile is visible to HR and your line manager, or to HR only, and you can withdraw any adjustment you shared at any time. When your employer records that you have left, your profile is removed from its dashboard. You can exercise your data protection rights against either of us, and Aperio (enquiries@liberationacademy.co.uk) is your single point of contact.
If your employer added you from an employee list
Your employer may add you to Aperio by giving us your name, work email, job role, team and manager, so they can invite you to set up your own account. We hold that list as your employer's processor, on its instruction. This is ordinary employment information they already hold about you, and no health or other special category data is created by adding you or by inviting you. Setting up an account is voluntary. Your account is your own: you sign in with a personal email that your employer cannot read, and from it you can view your workplace profile and request an ADHD, autism or bias screener whenever you want one. Your employer can see that you have set up (activated) an account, so that they can keep track of the rollout, and they see the employment details they provided. Your employer can never see which screener you request, whether you completed one, or any result: those are private to you. When you request a screener from your account it is confidential; your employer pays for it from a shared pool but is never told who used it, and screener use is only ever reported to your employer as anonymised, organisation-wide figures (how many people completed a screener and how many scored in the high range). We are able to show your employer that you activated an account because the account is general purpose, and is also how you reach your workplace profile results, so activation on its own does not reveal anything about your health or whether you have used a screener.
Taking part is voluntary
If your employer invited you to take an assessment, taking part is voluntary. We recognise that agreeing to something at work is not a completely free choice, so we do not rely on that alone: your employer agrees, as a condition of using Aperio, that anyone who declines to take an assessment will not be penalised or treated less favourably for it, in performance reviews, work allocation, selection, or any other decision. Your decision to take part, or not, is separate from your terms of employment.
How long we keep it
We keep each type of data only as long as we need it. Your raw answers are deleted or anonymised about 90 days after your report is produced. Your results are kept while your Aperio account is active. If you do not have an Aperio account, your results are deleted 24 months after your last activity. Access codes and session tokens are kept for up to 12 months, and audit and access logs for up to 18 months. Records we need for legal reasons, such as your consent history, any workplace adjustment shared with an employer (Equality Act evidence), and payment records (kept for HMRC), are retained for up to 6 years. When a retention period ends we delete or anonymise the data. The shorter-lived deletions, including your raw answers, run automatically each day and are logged.
The chat assistant
The Live Help button on our sites opens the Aperio Assistant, an AI assistant. When you use it, we process what you type, the page you were on (with any code or link removed from the address), a random conversation ID, and a scrambled (hashed) version of your IP address that we use only to prevent abuse. If you send something to our team through its form, we also process the name, email address and organisation you choose to give. We use this to answer your questions and deal with what you send us, and we look at the questions people ask, grouped by topic, to check and improve the answers. Our lawful basis is our legitimate interest in supporting the people who use Aperio and responding to enquiries (Article 6(1)(f)), or our contract with you where your question is about something you have bought (Article 6(1)(b)). If you type an email address into the chat, we treat it as a request to contact you: we keep a record of the conversation with that address, on the same terms as the form, and email our team the address and a link to that record, not your message.
Your messages are sent to Anthropic, the provider of the AI model, to generate the replies. Anthropic acts as our processor under its data processing addendum, does not use them to train its models, and deletes them within 30 days, unless a message is flagged under its usage policy or the law requires it to keep it for longer. Anthropic processes data in the United States; the transfer is safeguarded by the UK Addendum to the EU Standard Contractual Clauses in that addendum.
We keep chat conversations, and the record of each question and the reply it got, for 30 days after the last message and then delete them automatically. After that we keep only a count of the topics asked about and a short general rewording of each question, written without personal details and not linked to you. Anything you send through the form is kept until we have dealt with it and for up to 24 months after that; the copy of the conversation attached to it is deleted 30 days after we close it. Please do not type health information, diagnoses or results into the chat: we do not need them. The conversation is also kept in your own browser for up to 12 hours so that it survives a page change, and Clear chat removes it. Separately, a usage log holding the hashed IP address, the conversation ID and timing data is kept for 90 days for abuse prevention and service monitoring, then deleted automatically.
Who processes it for us
Data is stored with Supabase in the UK region (AWS London) with row-level security locked to server-side access only. Payments are processed by Stripe; we never see or store card details. Emails are sent via Resend (which sends our email from its EU region; Resend is a US company, so some support access may occur in the US under the UK Addendum). The site runs on Vercel. The chat assistant uses Anthropic, as described above. Each provider processes data under a data processing agreement. Where a provider processes data outside the UK (Stripe and Anthropic in the US, Resend support access as above; Vercel edge functions may execute outside the UK), the transfer is safeguarded by a mechanism UK law approves: the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework.
Analytics, advertising and our mailing list
If you opt in through the cookie banner, we use Google Analytics and Vercel Analytics to understand how the site is used, and the Meta Pixel to measure whether visits and purchases came from our advertising. None of these load unless you opt in, they never run on assessment, account and dashboard pages, and you can change your choice at any time from the cookie preferences link in the footer. Our lawful basis is your consent (Article 6(1)(a)). If you join our mailing list, we hold your email address, and your first name if you give it, in our own email marketing system (FluentCRM, run on the Liberation Academy website) on the basis of your consent, and you can unsubscribe at any time. If you book a call with us, the booking is handled by TidyCal.
Your rights
You can exercise most of your rights yourself from your Aperio account: view the data we hold about you, download a copy (access and portability), manage or withdraw anything you have shared with an employer, and request erasure. Erasure requests are actioned within one calendar month; where the law requires us to retain something (for example, evidence of workplace adjustments under the Equality Act 2010), we will tell you what is retained and why. You also have the right to have inaccurate data corrected, to restrict how we use your data, to object to processing we carry out on the basis of legitimate interests, including the sharing of your baseline profile with your employer (if you object, we will stop unless we can show compelling legitimate grounds for continuing that override your interests, rights and freedoms, and we will tell you our decision and the reasons), and to withdraw any consent at any time without affecting what we did before you withdrew it. For any of these, email enquiries@liberationacademy.co.uk.
Complaints
If you are unhappy with how we have handled your data, please tell us first: email enquiries@liberationacademy.co.uk with "Data protection complaint" in the subject, or write to us at 20 Wenlock Road, London N1 7GU. We will acknowledge your complaint within 30 days, keep you updated, and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk or on 0303 123 1113.
Cookies
See our cookie policy. Non-essential cookies run only if you opt in, and you can change your choice at any time from the cookie preferences link in the footer.
Contact
Data controller: Liberation Academy Ltd, trading as Aperio Profiles, registered in England and Wales (company number 16087057). Registered office: 20 Wenlock Road, London N1 7GU. Email: enquiries@liberationacademy.co.uk. General enquiries: hello@aperioprofiles.co.uk.