Safeguarding Policy

1. Purpose and scope

This policy sets out how VYVE Health CIC (“VYVE”) identifies and responds when a member may be at risk of harm to themselves, or at risk of harm from others. It applies to every VYVE member, including members who access VYVE through an employer or partner, and to everyone who works for or on behalf of VYVE: staff, contractors, coaches, counsellors and partners.

We say clearly on sign-up, on our urgent support page and throughout the app that VYVE cannot respond to emergencies. Our role is to notice when someone may be struggling, make sure they know where to get immediate help, and reach out to them personally.

This policy covers:

• Risk of suicide or self-harm
• Disclosure of abuse, including domestic abuse
• Severe emotional distress
• Concerns about a member’s immediate safety raised by anyone, including another member or a partner

VYVE members must be aged 18 or over. If we believe a member is under 18, we close the account and, where there is a risk of harm, follow section 5.

2. Roles and cover

Every safeguarding alert has a named owner. The shared team inbox is never the only route: every alert is also sent, by push notification and email, directly to the Safeguarding Lead, and opens a task that stays open until a person closes it.

Cover hours. Safeguarding alerts are monitored from 08:00 to 21:00, seven days a week. A critical alert raised outside these hours is picked up at the start of the next cover period. Outside cover hours, members are always shown 24/7 crisis services straight away (section 4), because VYVE cannot respond to emergencies. The Lead and Deputy agree cover in advance for holidays and absence, so at least one of them is on cover during every cover period.

3. How concerns are identified

Concerns reach us in two ways: automated detection in the app, and people telling us.

Automated detection

Free text a member writes is checked automatically against a curated list of phrases that indicate suicide, self-harm, abuse or severe distress. This covers:

• The welcome questionnaire
• Weekly and monthly wellbeing check-ins
• Daily mood notes
• Private journal entries
• Community check-ins and posts

Detection uses fixed rules, not AI judgement, so its behaviour is predictable and testable. Each match is graded:

• Critical: explicit language about suicide, self-harm or abuse
• Concern: language suggesting severe distress, hopelessness or crisis

False positives happen. Our rule is: when in doubt, still reach out.

People telling us

A member, another member, a partner, a coach or an employer contact may raise a concern by emailing team@vyvehealth.co.uk or speaking to any member of the VYVE team. Whoever receives it passes it to the Safeguarding Lead the same day, and it is handled as a concern or critical flag under section 4.

4. Response process and timescales

The member is shown help immediately; a person follows up within 4 hours for critical flags and 24 hours for concerns, measured within cover hours.

When we reach out, we:

1. Check how the member is, without a script and without judgement
2. Repeat the crisis services and encourage them to use them, or to speak to their GP, and point them to their employer’s own support line where the employer has given us one
3. Offer VYVE support where appropriate, for example a session with our counsellor or group support
4. Agree a follow-up if they want one

If there is an immediate risk to life, and the member cannot or will not keep themselves safe, the Lead or Deputy calls 999. This is the only situation in which we act without the member’s agreement.

If a member does not reply, we follow up once more within 48 hours, then close the alert with a record of the attempts. We do not repeatedly contact a member who has told us they are safe and supported.

5. Confidentiality and information sharing

What a member shares with VYVE stays confidential. We never tell an employer, partner or community leader that a member has been flagged, and safeguarding is never part of employer or partner reporting about individuals.

We share information without a member’s agreement only when:

• There is an immediate risk to their life or someone else’s, and we need emergency services to help (UK GDPR Article 9(2)(c), vital interests)
• The law requires it, for example a court order
• A child or another adult is at risk of serious harm, in which case we contact the relevant authority

In those cases we share the minimum needed, with the people who need it, and record what we shared, with whom and why. Where it is safe to do so, we tell the member first.

Employers. For members who access VYVE through their employer, the employer is not notified about any individual. The only exception is a serious and immediate risk to life where the employer’s help is needed to keep the person safe, for example to locate them, and emergency services cannot be reached another way. That decision is made by the Safeguarding Lead and recorded.

6. AI safeguards

VYVE’s AI features personalise wellbeing support; they never handle a crisis. The safeguards are:

• AI is never used to decide whether someone is at risk. Detection uses fixed rules (section 3) and every flag goes to a person
• Every AI prompt is instructed never to coach someone through a crisis, and to signpost professional help when someone appears to be in distress
• AI output is for general wellbeing only, not medical advice, and members are told this
• AI prompts are tested against fixed scenarios before changes go live, including distress scenarios
• Our AI provider, Anthropic, processes data under a data processing agreement and does not use it to train its models

More detail is in our AI Use Policy.

7. Records, data protection, training and review

Records. Every flag creates a record of the date, source and category, without the member’s words. The member’s words are seen only by the Safeguarding Lead and Deputy, through the safeguarding alert email, and never appear in dashboards, reports or digests; that email is not stored in any VYVE system. Safeguarding records (date, source, category, contact made and outcome) are kept for 6 years after the concern is closed, because they may be needed to respond to a complaint or legal claim.

Data protection. Safeguarding checks process health data. Members are told about them in section 6 of the Privacy Policy and agree to them when they give explicit consent to health data processing. We also rely on the Data Protection Act 2018, Schedule 1, paragraph 18 (safeguarding of individuals at risk), and, for emergency disclosure, UK GDPR Article 9(2)(c) (vital interests). Safeguarding alerts are sent only to named VYVE addresses, through providers under data processing agreements.

Training. Everyone who handles safeguarding alerts completes recognised suicide prevention training (for example the Zero Suicide Alliance course) before going on cover, and refreshes it every year.

Review. The Safeguarding Lead reviews this policy with the clinical adviser every 12 months, after any serious incident, and before any new employer or partner launch. Detection phrases are reviewed every quarter using anonymised data on missed and false flags.

8. Partners, coaches and staff

Everyone who works with VYVE members follows these standards:

• Partners, coaches and counsellors are identity-checked before going live, and confirm they hold the qualifications and insurance their service requires
• Anyone who sees something worrying in a community, session or message passes it to the Safeguarding Lead the same day. They do not try to manage a crisis on their own
• No one contacts members outside VYVE channels, asks for personal contact details, or forms a relationship that could exploit a member’s vulnerability
• Counsellors and therapists also follow their professional body’s code, for example BACP, and their own clinical safeguarding duties
• Breaching these standards leads to removal from the platform, and a report to the relevant professional body or authority where needed

Anyone can raise a concern about how VYVE, a partner or a member of staff has handled safeguarding by emailing team@vyvehealth.co.uk, marked for the Safeguarding Lead, or directly to the Deputy if the concern is about the Lead.

9. Appropriate policy document (Schedule 1)

This section is VYVE’s appropriate policy document for processing under the Data Protection Act 2018, Schedule 1, paragraph 18 (safeguarding of individuals at risk).

• Purpose: identifying and responding to members at risk of suicide, self-harm, abuse or severe distress
• Lawfulness and fairness: members are told about safeguarding checks in Privacy Policy section 6 before they give consent
• Purpose limitation: safeguarding data is used only for safeguarding, never for marketing, profiling, AI training or employer reporting
• Data minimisation: records hold the date, source and category; the member’s words are seen only by the Lead and Deputy
• Accuracy: fixed detection rules are reviewed quarterly, and every flag is checked by a person
• Storage limitation: records kept 6 years after closure (section 7)
• Security: access limited to the Lead and Deputy; database access controls and audit logs

This document is retained for 6 months after this processing ends, and is available to the ICO on request.

10. Incidents, assurance and reporting

Serious incidents. A serious incident is a member’s death or serious harm where VYVE had a flag or report, an alert that failed to reach a person, or a breach of these standards. The Lead reviews every serious incident with the clinical adviser within 5 working days, records what happened and what changes, and reports it to the VYVE board. Where a member’s data was exposed, our breach process applies (ICO within 72 hours).

Monitoring. The Lead reviews these measures monthly:

Testing. The alert path is tested end to end, with a rehearsal flag, before any new employer or partner launch and after any change to detection or routing.

Employer reporting. Employers receive no safeguarding information about individuals. On request, VYVE confirms to an employer that this policy is in place and being followed, and may share anonymised totals (for example, number of flags in a period) only where the group is 8 people or more.

11. Legal framework and related documents

This policy is written in line with the UK GDPR, the Data Protection Act 2018, the Care Act 2014 (adult safeguarding principles), and NHS and Samaritans guidance on responding to suicide risk. It works alongside VYVE’s Privacy Policy (sections 3, 6, 7 and 11), Terms of Service (sections 2 and 5), AI Use Policy, Information Security Policy, Data Retention Schedule and urgent support page.

The VYVE policy suite

This document is one of six that together describe how VYVE handles data and keeps members safe. They are written to be read together and use the same facts.