Oshn Privacy Notice

Introduction

BFB Labs Limited (‘BFB’) and buyers (the organisation who made Oshn available to you) of its products recognise the importance of protecting your personal data. This is information that relates to living identifiable individuals such as the users of our App.  Protecting personal data means handling it properly - in accordance with what the law requires.  

An important part of compliance is being transparent with individuals about the use of their personal data.  

This Notice seeks to ensure transparency.  It should be read by:

  1. Children (under the age of 13) through their Guardian- a parent or carer, 

  2. the Guardian themselves, and,

  3. Young People aged 13- 25. 

It should be read before deciding to provide personal data for processing in connection with Oshn by the organisation who enabled access and BFB. 

This Notice is provided largely on behalf of the organisation who enabled access to Oshn.  This is because they act as ‘Data Controller’ of the personal data of children and Guardians as well as that of young people aged 13- 25.   They are called the Data Controller because it is mainly they who decide  the purposes (the reasons and aims) and means (how) your personal data is processed.  

The enabling organisation may also have their own Notice which provides similar and additional information. Children (through their Guardian) and the Guardian or the young person should also read the Privacy Notice of the organisation who enabled access. 


Key terms

Distributors are staff within the organisations who make Oshn available. 

Where an enabling organisation  acts as a Data Controller, BFB acts as its Data Processor - an organisation (BFB) who processes personal data on behalf of a Controller and to its instructions.   This is because information about individuals is processed through our software - Oshn. 

There are occasions where BFB processes personal data for its own purposes.  Where that is the case and we act as a Data Controller this Notice will say so. 

Special Category Data, in the context of Oshn,  is personal data which indicates an individual's  racial or ethnic origin, or health.  


Who are the Data Controllers? 

The primary Controller will be the organisation who made Oshn available.  This may have been by the provision of a code to enable sign up or because you live within the organisation’s ‘catchment’ area.  You should have their contact details.  If you do not please contact us at support@bfb-labs.com. 

We are BFB Labs Limited.  Our registered office is 127 Farringdon Road, C/O Better Space, London, England, EC1R 3DA. 

We are registered at Companies House under company number 09700274. 

Our Data Protection Officer can be contacted via support@bfb-labs.com. 

We are also  registered with the ICO under number ZA393479.



Who are BFB? 

We are the creators of Oshn. 

Oshn is an evidence-based, gamified digital intervention designed to support children and young people aged 11-25 years to self-manage low mood and boost motivation by building confidence, resilience, and personal wellbeing through meaningful real-world actions and connection.

Oshn is based on a type of Cognitive Behavioural Therapy (CBT) called ‘Behavioural Activation’ (BA). BA is based on a simple idea: that what you do shapes how you feel.

Oshn helps users understand the link between thoughts, feelings and behaviours (psychoeducation),  discover their values, and suggests quick ‘in-the-moment’ activities aligned with those values. 

Even a few minutes spent on a meaningful activity can make a difference, helping users feel more engaged and being able to self-manage difficulties they may be facing with low mood and reduced motivation.

Whose personal data is collected and further processed 

  1. Children who are signed up for the game by their Parent/ Guardian.  

  2. The relevant Guardian 

  3. Distributors - staff from an enabling organisation including clinical or educational practitioners who are directly involved in supporting children.

  4. Young People 



What personal data is collected and further processed 

1. Children and Young people 

You must provide us with your: 

  1. first/nickname, 

  2. date of birth,

  3. postcode, 

  4. e-mail,  

  5. How did you hear about Oshn. 

  6. Agreement to our terms and conditions

  7. Acknowledgment that you have had access to this Privacy Notice 

We would like you to (as it helps us know who is using the product and helps us improve it and people’s access to it ) but you do not have to tell us about: 

  1. gender, 

  2. ethnicity,

  3. disability, 

  4. care experience, 

  5. education status 

  6. NEET (whether in employment, education or training) status.

You must provide us with your: 

  1. value selection  

  2. log of completed activities and helpfulness rating

  3. weekly check - in responses   

We may ask you to (as it helps us improve our product) but you do not have to: 

  1. provide feedback about your experiences with the game and its effectiveness.

2. Guardian

You must provide us with your: 

  1. Full name and email address; 

  2. agreement to Terms and Conditions  and acknowledgment of the Privacy Notice on behalf of your child;

  3. response to your child’s initial outcomes rating scale survey; 

  4. relationship to the child. 

We may ask you to (as it helps us improve our product) but you do not have to: 

Provide feedback about your child’s experiences with the game and its effectiveness.


3. Distributors 

  1. name, 

  2. email,

  3. phone number,

  4. who you work for,

Please note that you are under no obligation to provide personal data.  However if you do fail to provide the mandatory information above then you will not be able to access Oshn or the Hub. 


Why is personal data processed? 


Children and Young People 

Referring organisation use of personal data 

The child or young person's  information will be used in order to validate their account and ensure data accuracy and what is attributed to them is correct. This ensures that the professionals working with the child or young person can be confident they are looking at the correct person’s data in the Hub.  

Ethnicity, age, gender, disability ,education, care experience and NEET information may be used to understand who is accessing the product / service.  This is because some demographics are more vulnerable to mental health problems. 

Postcode information can be used to link to the indices of multiple deprivation (IMD) and, again, enables organisations who made the product available understand who is accessing the product / service. 

Health Data is used by the enabling organisation (through the Distributor) to review the effectiveness of the game and how it is helping the child or young person to deal with their issues. 

Information is also used to create and manage users of the game, monitor use of the game and progress including game analytics and survey responses .

Information is also used to consider feedback about your experiences with the game and its effectiveness.


BFB use of Personal Data

We make a record that you have agreed to our terms and conditions of use of the App and have been referred to this Notice. 

We make use of demographic data (such as gender, disability, ethnicity etc.) to identify who is using the game and how it is being used. In doing this we do not focus on any individual’s data.  All data is aggregated (combined) and, during that process, the data becomes anonymous. This anonymised data provides us with insights which helps us improve our products, show us who is using the product and their progress, where the product is being used, demonstrate usage and how the product helps  the organisations that enable access to Oshn and to market our products more effectively. 

We also use personal data to ensure the security of your data by ensuring that access to the same by professionals is controlled (by the use of logins and passwords) and that data of one user  cannot be accessed by someone else or added to by someone other than the registered user. 


Guardian

Referring organisation use of personal data 

Information is used  in order to ensure verification and to ensure the Guardian of the child is sent the right information to access the game and to review outcomes of rating surveys and to enable guardians to facilitate use of the game by their child. 

Information is also used to provide support to the Guardian for them, in turn, to support their child. 

BFB use of personal data 

We make a record that you have agreed to our terms and conditions of use of the App on behalf of your child and have been referred to this Notice. 

Information is also used to consider feedback about your child’s experiences with the game and its effectiveness.


Distributor 

BFB use of personal data 

To enable an administrator within BFB to create and maintain a list of distributors of the game; to send them notifications (email) and generate login details.  To enable distributors to access the Hub and make use of the child’s and guardian’s data or the young person contained within it. We also use personal data to ensure the security of data by ensuring that access to the Hub is controlled (by the use of logins and passwords)

What is the legal basis to collect and further process personal data 

Enabling organisation (through Distributors)

The processing of the data of the child/ guardian or young person is done:

  1.  with  consent.

Where consent is provided it can be readily withdrawn.  If a child (through their Guardian) or the Guardian or Young person wish to withdraw consent please contact the referring organisation or email us at   support@bfb-labs.com  

  1. As an alternative the data is processed as it is necessary for the performance of a task carried out in public interest or in exercise of official authority by the enabling organisation. 

As regards special category data this may be processed with:

  1. explicit consent or for 

  2. reasons of substantial public interest or, 

  3. where it is necessary for the purposes of preventive medicine, the provision of health or social care or treatment or the management of health or social care systems and services. 


BFB 

Distributors - we process your personal data in the legitimate interests of the organisation you work for - enabling them to provide support services to children, young people and their families.. 

Children/Guardians and Young people  -   Personal data (such as age, gender, disability,postcode, education, care experience, NEET status etc.)  is used to identify who is using the game and how it is being used. In doing this we do not focus on any individual’s data.  All data is aggregated (combined) and, during that process, the data becomes anonymous. This anonymised data provides us with insights which helps us improve our products, show us who is using the product and their progress, where the product is being used, to report on the impact our organisation has, and to promote our products more effectively. This we do in our legitimate business interests. 

If a child (through their Guardian) or the Guardian  or Young person objects to us processing to meet these legitimate interests then please email us at  support@bfb-labs.com  telling us why.  We will consider what you have to say and provide a response to you. 

Occasionally we may contact you by email to seek to secure your feedback on Oshn.  We contact you initially in our legitimate interests (product improvement) but, of course you are not obliged to provide feedback and if you do then it is done with your consent. As above if you change your mind you can contact us to withdraw your consent. 


Who is personal data shared with? 

Enabling organisations - Please see their Privacy Notice to see if any personal data is shared by them. 

BFB

We make use of  a sub- processor - SendGrid.  This is used for email. 

SendGrid ensures secure storage and secure disposal of data. They have the following accreditations:

  • ISO 27001; 

  • ISO 27017

  • ISO 27018

  • SOC 2 Compliant

Some personal data is processed by SendGrid within Eire (European Union)  and, as such, the protections of the European GDPR apply. 

We also make use of another sub- processor -  Amazon Web Services (‘AWS’) for platform hosting, product service delivery and analytics.

AWS provides start-to-end information management, ensuring secure storage and secure disposal of data.  They have the following accreditations: 

  • ISO 27001 (Information Security Management System);

  • ISO 27017 (Cloud Security);

  • ISO 27018 (Cloud privacy);

  • SOC 1, 2, and 3 (security, availability, integrity, confidentiality and privacy);

  • BSI’s Common Cloud Computing Controls Catalogue. 


Personal Data processed by AWS does not leave the UK. 

Apart from the above we may share personal data to:

  • Comply with the law or orders served on BFB;

  • Protect or defend the rights or property of BFB Labs (including the enforcement of our agreements); 


How long do we keep personal data for

Enabling organisations will decide how long to retain personal data that they control. Please see their Privacy Notice.  In this regard BFB acts as their Processor. 

BFB will only keep your personal data that we collect or generate as long as it is necessary for the purposes referred to above for which it was processed. When it is no longer needed we will securely remove your personal data from our system.


Where is my personal data stored? Does any personal data leave the United Kingdom? 

The only processing of personal data which is outside of the United Kingdom is in respect of SendGrid as set out above. 


How is my data kept safe and where is it stored? 

BFB is committed to protecting the security of your personal data. We use a variety of security technologies and procedures to help protect personal data from unauthorised access, use, and disclosure. For example, we store personal data on computer servers with limited access that are located in controlled facilities. 

The Product stores all data using encryption so that only professionals with the appropriate ‘keys’ are able to access the personal data. The Product sends all communications, except e-mail, using HTTPS.

When we replace our servers we erase the old equipment completely as part of ISO 27001 compliance and in line with National Cyber Security Centre (NCSC) guidelines.

The data that is being collected from the therapeutic game app is automatically encrypted and transmitted to the secure online data portal (VitaMind Online Hub) where it is encrypted at rest.

All data transfers will be in accordance with Secure File Transfer Protocols within the N3/HSCN network and/or in accordance with HSCIC Good Practice Guidelines, published at: https://systems.hscic.gov.uk/infogov/security/infrasec/gpg.

We will always ensure that any proposed secure transfer is in line with the latest guidance issued by the National Cyber Security Centre and industry best practices. 

BFB also holds the Cyber Essentials Plus accreditation and meets the requirements of the NHS Data Security & Protection Toolkit.

What rights do I have?

You have the right to request from the appropriate Controller:

  1. access to your personal data; 

  2. to rectify any inaccurate personal data 

  3. to erase personal data

  4. to restrict processing of your personal data and/ or object to what is done with it, and, 

  5. a right to data portability. 

If you wish to exercise a right please contact either the referring organisation or us at support@bfb-labs.com.  

Complaints

We hope that there are no issues with the use of your personal information however if you do have any concerns please contact the appropriate contact at the enabling organisation, or us.  

Where your complaint relates to our processing of your personal data we will look into matters for you and reply to you within a reasonable time period.  

After that, if you are still dissatisfied you have the right to complain to the ICO.  They can be contacted via this link.