Data and Trust

People will only tell you the truth if they trust what happens to it

This page sets out what the platform collects, why, who can see it, how long it is kept, and the things it will never do. Share it openly with participants — it is written to be read by them, not only by you.

What we collect

Data, purpose and access

Data	Why we collect it	Who can see it
Programme and planning content	Charters, roadmaps, risks, decisions and reports — the working record of the change.	Programme members with an assigned role.
Stakeholder group records	To assess impact, plan engagement and track adoption at group level.	Programme members. Groups, not individual profiles.
Leadership readiness ratings	To design proportionate support for people leading the change.	Sponsor, change lead and named assessors only. Developmental use only.
Pulse and baseline responses	To understand how the change is landing and where to adapt.	Reported only as aggregates above the anonymity threshold.
Account and audit records	Security, accountability and version history.	Programme owner and IV administrators.

Commitments

Firm limits, not aspirations

The platform must not rank or profile individuals

No individual scoring, league tables, sentiment analysis of named people, or automated judgements about performance, attitude or suitability.

Anonymity thresholds are enforced

Pulse and baseline results are only shown when a group has enough responses — five by default, configurable upward, never downward. Free-text is reviewed for identifying detail before it is shared.

Sensitive interview material is handled separately

Verbatim interview and focus-group material is stored against the programme, restricted to named owners, and summarised thematically for wider audiences.

AI output is labelled as draft

Everything the IV Change Guide produces is marked draft and separates evidence, assumption, interpretation, recommendation and the decision a human must make.

Final decisions are made by accountable humans

Gates, go/no-go calls, employment matters and communications release all require a named person to decide and record it.

Serious concerns are routed, not buried

Where a response raises a safeguarding, wellbeing, legal or ethical concern, it is routed to a named owner through your existing organisational channel — not resolved inside the platform.

Participant consent wording you can reuse

“We are asking for your view so we can understand how this change is landing and adapt it. Your individual responses will not be shared with your manager or used in any decision about you. Results are only reported where at least five people in a group have responded. You can skip any question, and you can stop at any point.”

Retention and deletion

Programme content is retained while the programme is active and for an agreed period afterwards. Raw pulse responses are deleted once the aggregate reporting period closes. A programme owner can request full export or permanent deletion of a programme and its registers at any time.