Our commitment to privacy, confidentiality and participant anonymity is a centerpiece of Yvy’s philosophy: Honest answers about mental health require safety, and organizations will only share sensitive information with a partner they can trust. This Policy outlines how we protect the confidentiality of our clients and the anonymity of research participants, the methodological and technical choices behind those protections, their limits, and how we adapt to the legal requirements of the jurisdictions where we work.
1.Who this policy covers
This Policy applies to: (a) clients, the organizations that engage our services; (b) research participants, the individuals who respond to surveys or other research instruments in the course of a project; and (c) website visitors, anyone using yvyhealth.com, including the contact form.
2.Our principles
The anonymity of participant data is a typical requirement of HIPAA-aligned standards, and it protects the interests of the people who take part in our research. It is also a methodological tool: participants answer honestly when they do not fear retribution or judgement, and anonymity is the main way to achieve this.
Confidentiality about company data and communications is equally essential. It is a fundamental right of companies and their officers, a legal obligation in many jurisdictions, and especially important for a mental health consultancy, where communications may touch on workforce mental health, internal conflicts, or morale. For a company to work with Yvy, it needs to feel confident that its information is safe. That is why we make specific commitments and technical choices covering the client's data, the content of communications, health-related workforce information, and any other information shared by the client, its officers, or any member of its workforce.
3.Client confidentiality
We strictly do not disclose to third parties any information regarding research projects we carry out. This includes, but is not limited to, the design of the research project, the data collected, the results obtained, and their interpretation. This information is communicated only in a confidential report provided to the client, and this commitment is formalized in a written contract for every engagement. It also covers all communications between the client and Yvy's officers, including email exchanges and video calls, and the content of contracts and other agreements.
There are two exceptions, and we prefer to state them plainly rather than promise the impossible:
- Court orders. In the unlikely event of a court order compelling disclosure, we may have to comply, depending on the relevant jurisdiction. Where legally permitted, we will notify the affected client before complying, so that the client may seek protective measures.
- Client references. We may ask a client whether we can cite their company name as a former client in our promotional material. This would never include any information about the content of the research project, and we will not cite a client's name without their agreement.
We obviously do not sell, rent, or trade any client or participant information, and we do not use client data for any other purpose than the research project contracted by the Client. This means that we do not use client data for training, or marketing.
4.Participant anonymity
Quantitative survey data: a zero-knowledge approach
For quantitative data, the personal identities of research participants are protected so that neither third parties, nor the client and its officers, nor even Yvy's officers can link individual data points to the identities of participants. We do not ask for or collect names, addresses, email addresses, phone numbers, IP addresses, or any other identifying information alongside survey responses. Because we never hold the link between responses and identities, even a court order could not extract it from us: the information does not exist in our systems.
Qualitative data: rare edge cases, actively managed
If a project includes qualitative data collected through open-ended questions, some participants may, in rare cases, voluntarily or inadvertently include identifying information in their written answers, even though we advise them against it and explain how to avoid it. In this particular case, Yvy's officers may come into contact with identifying information, despite the fact that we collect no standard identifiers. We implement a series of measures to make it extremely unlikely that such an event could compromise a participant's anonymity:
- Yvy's officers are contractually prohibited from sharing any such information with anyone;
- qualitative data are never reported individually or in raw form; only themes extracted by qualitative analysis are reported;
- raw qualitative data are destroyed early, right after the conclusion of the research project.
5.Methodological choices that protect participants
- No individual reporting. We do not report individual data, preventing inferences or guesses about identities linked to individual data points.
- No face-to-face interviews for qualitative data. We collect qualitative data through open-ended questions delivered online, in an anonymous format where no standard identifying information is collected.
- Participant guidance. Our instructions advise participants against including identifying information in open-text answers and explain how to avoid doing so.
- No identifying fields. Our surveys do not ask for names, addresses, email addresses, phone numbers, and we decline to collect IP addresses.
- Informed consent. Participants are informed, before responding, of the purpose of the research, the voluntary nature of participation, their right to withdraw, and the anonymous design of the data collection.
6.Data security and encryption
Data is collected online in a full anonymous response mode in which responses are de-identified from the outset and respondent IP addresses are not collected. Data collected in this way are also encrypted both in transit and at rest using robust protocols. After the conclusion of a project, data are stored in a fully encrypted mode in servers located under Swiss jurisdiction. Third parties (including the server’s providers) are unable to read, scan, or share them.
Any email sent to info@yvyhealth.com or support@yvyhealth.com is stored encrypted as soon as it reaches us, using a robust post-quantum encryption protocol (more details are available from this link). Emails stored this way cannot be scanned for any purpose (for instance, emails cannot be scanned for commercial, advertising, AI training, or any other purpose). For privacy-minded clients we can also enable a strong end-to-end encryption email communication, which requires a password to open each email.
In our website, we do not collect cookies, analytics profiles, or visitor IP logs. The contact form is handled by a script on our own server: your message travels over HTTPS to our server and is then relayed over an encrypted connection to our encrypted mailbox. No third-party form-processing service sees your message.
7.Data use, retention, and destruction
- Single-purpose use. Data collected for a project can only be used for the research project contracted by the client. It is not published, not reused for other projects, not used for training of any kind, and not used for any other purpose. This specific term can be overridden only in cases where the client wishes to re-use the data for a specific purpose after the completion of a project.
- Client-defined retention. Quantitative data are securely stored on encrypted servers for a duration determined by the client, up to five (5) years, after which they are permanently destroyed.
- Early destruction of qualitative data. Raw qualitative data are destroyed right after the conclusion of each project (after delivery of the report or the conclusion of any agreed follow-up), given their higher potential for containing personal information. Clients may also request earlier destruction of project data at any time.
- Access. Yvy's officers have access to project data during the research project and the agreed storage period, and are legally bound not to share or disclose sensitive project-related information, as described above.
- Report sharing. Data are shared with clients only in the form of a confidential report. Clients may share this report internally or with third parties in a manner consistent with the written agreement signed with Yvy.
- Breach notification. In the unlikely event of a security breach affecting personal information, we will notify affected parties and the relevant authorities in accordance with applicable law, including Delaware's breach notification statute (6 Del. C. § 12B-100 et seq.).
8.Website visitors and the contact form
- No tracking cookies. We do not use cookies for tracking, analytics profiling, or advertising, and we do not deploy third-party advertising technologies.
- Do Not Track. Because we do not track visitors across sites, our Site behaves the same whether or not your browser sends a "Do Not Track" signal.
- Contact form. If you use our contact form or email us, we collect only what you provide: typically your organization's name, sector, country, your work email, and the content of your message. We use this information solely to respond to your inquiry and, if applicable, prepare a proposal. As described in section 6, the form is processed on our own server and delivered to our encrypted inbox.
- Children. This Site is intended for professional audiences and is not directed at children under 18. We do not knowingly collect information from children.
9.United States and Delaware law
Yvy Consultancy LLC is incorporated in Delaware, USA, and this Policy is designed to be consistent with applicable United States law, including the Delaware Online Privacy and Protection Act (DOPPA) and the Delaware Personal Data Privacy Act. In particular, and as described in this Policy, we disclose: the categories of information we collect and the purposes for which we use them; the categories of third parties with whom information may be shared (service providers only, such as secure hosting and encrypted email); how visitors can review and request changes to their information; how we respond to Do Not Track signals; and how changes to this Policy are announced. Our research practices are aligned with HIPAA privacy principles and the ethical standards of the Declaration of Helsinki.
10.Bespoke arrangements for other jurisdictions
Data collection may take place in jurisdictions with their own data protection regimes, for example the EU/EEA (GDPR), the United Kingdom (UK GDPR), Brazil (LGPD), or Canada (PIPEDA and provincial laws). We are happy to provide bespoke privacy and compliance arrangements adapted to the jurisdictions where a project's data collection takes place. These arrangements are formalized in the engagement agreement for each project, as described in our Terms & Conditions.
11.Your rights and requests
Website visitors and clients may contact us at any time to review, correct, or request deletion of the information they have provided to us (for example, contact-form submissions). Because research participant data are anonymous by design, individual survey responses cannot be located, retrieved, or deleted on a per-person basis; this impossibility is deliberate, and inherent to our approach to privacy and anonymity.
12.Changes to this policy
We may update this Policy from time to time. Material changes will be indicated by updating the published effective date of this policy.
13.Contact us
For any question about privacy or confidentiality, or to exercise your rights under this Policy: info@yvyhealth.com · Yvy Consultancy LLC, 8 The Green, Suite B, Dover, DE 19901, USA.