Your results
‍are yours.

We collect the information you give us when you take the Human Core 7 assessment, contact us, or create an account. We collect a small amount of information automatically to keep the service working — nothing more than is needed to deliver your results.

Information you provide

• Assessment responses — your ratings across the seven dimensions and any optional written reflections.

• Contact information — your name and email address, used to deliver your report and respond if you write to us.

• Account information — your password (encrypted) and any preferences you set.

Information collected automatically

• Usage data — pages visited, features used, and the timestamps for your sessions.

• Device data — browser type, operating system, and approximate region inferred from your IP address.

• Cookies — see Section 07 (Cookies and tracking) for details.

You can request a copy of all the information we hold about you at any time. See Section 06 (Your rights and choices).

We use your information to deliver your report, maintain your account, respond to your messages, and improve the assessment over time. We do not use your assessment responses to advertise to you, and we do not sell your information.

Specifically, we use the information you provide to:

• Generate the personalised content in your Human Core 7 report.

• Send your report to you and let you return to it from your account.

• Respond when you contact us by email or through the form on our contact page.

• Maintain account security and prevent abuse of the service.

• Understand aggregate patterns in how the assessment is used, in order to refine it. Aggregate analysis never identifies individual respondents.

We also use AI to generate parts of your personal report. Because that involves your data in a specific way, we've broken it out as its own section, below.

Your assessment data and report are stored on servers operated by established cloud infrastructure providers, encrypted both in transit (TLS 1.2 or higher) and at rest (AES-256). Access within our team is limited to the personnel who need it to deliver the service, and is logged.

We retain your assessment data and report for as long as your account is active. If you delete your account, your data is removed from our primary systems within 30 days, and from backups within 90 days.

We perform regular security reviews and respond to confirmed vulnerabilities promptly. If a breach affecting your data occurs, we will notify affected users within 72 hours of confirming the incident.

We do not sell your information. We share it only in the following limited circumstances:

• Service providers — cloud hosting, email delivery, and the AI model providers described in Section 03, all bound by contracts that restrict the use of your data to delivering services to Human Core 7.

• Legal requirements — if we receive a valid legal request, we may disclose information to the extent required by law, and will notify you when we are permitted to do so.

• With your permission — if you ask us to share your report or results with a coach, employer, or other third party, we will do so at your direction and keep a record of the request.

We do not share assessment responses with employers, insurers, or advertisers under any circumstances.

You have the right to access, correct, export, or delete the information we hold about you. You can exercise most of these rights directly from your account settings; for anything you can't do from your account, write to privacy@core7.com and we will respond within 30 days.
‍

Rights for users in the EU/UK

If you are located in the EU, UK, or Switzerland, you have additional rights under the GDPR and equivalent local laws, including the right to object to certain types of processing, the right to data portability, and the right to lodge a complaint with your local data protection authority.
‍

Rights for California residents

California residents have specific rights under the CCPA/CPRA, including the right to know what categories of personal information we collect and the right to request deletion. We do not "sell" or "share" personal information for cross-context behavioural advertising as those terms are defined in California law.

We use the smallest number of cookies needed to keep the site working — essentially, the cookies that remember you're logged in. We do not use advertising cookies, behavioural tracking pixels, or session replay tools.
‍

Site analytics, where we use them, are configured to anonymise IP addresses and never to feed any third-party advertising network.

When we update this policy, we'll bump the version number and update the "Last updated" date at the top of this page. Material changes will be communicated to account holders by email, with reasonable notice before they take effect.

Previous versions of this policy are available on request.