Feedback rounds

Colleague and patient feedback is the part of revalidation a locum cannot organise the way a salaried colleague can. There is no fixed team to hand forms to and no organisation manager collecting them, and by the end of a cycle the people who know your work are spread across thirty placements.

A feedback round starts from your session log. Sessional already holds every organisation you worked at inside your cycle and the named contact at each one, so a round is a list you tick rather than an address book you rebuild. You choose who is asked. Sessional sends the questionnaire, receives the answers, and shows you totals.

By email, to a named person. Colleague and organisation rounds go to people you name: the person who booked you, the person who paid the invoice, a colleague you add by hand. Each one gets their own link, and that link answers once. Start the round, tick the contacts the ledger already knows, add anyone it does not, read the covering note, and send. Anything that did not go out is listed back to you with the reason: an address our mail provider will not accept is named as unusable, while one we simply could not send to says so and can be added again in a few minutes, because nothing was left behind to block it.

Who the invitation comes from. Invitations and reminders are sent by Sessional, from Sessional Feedback ([email protected]), never from your own address. The message names you, says you asked for the feedback, and explains that Sessional collates the answers. If somebody replies to it, the reply reaches the Sessional support desk and never reaches you: a reply in your inbox would tell you who had answered, which is the one thing a collated round is built not to tell you. If a colleague says the invitation has not arrived, ask them to look for "Sessional Feedback" and to check their junk folder before you resend.

Every invitation carries a permanent way out, and the invitation says before it asks anything that you will never see an individual response. If a recipient uses that way out, no one on Sessional asks that address for feedback again, on any round, for any professional.

By card, for patients. A patient round produces an A5 card with a QR code and a short link, either one card for the round or one per session so the card can name the day it belongs to. Print it, leave it with reception or hand it out at the end of a consultation. The card names nobody, so the same link takes many answers, with limits on how fast one device can send them.

Both channels feed one report. A round can use either or both.

The floor and the recommended number are different things and the page shows both. Five is the point at which a report can exist at all without a small round pointing at a person. Fifteen and thirty-four are the figures Sessional recommends. Reaching five is not reaching fifteen, and Sessional never says it is.

A question is shown separately from the round as a whole. A round at five responses gets a report, but any single question that fewer than three people answered on its own scale shows "fewer than three answered" instead of a figure. On the patient questionnaire, where most questions offer "Doesn't apply", that happens more often than you would expect, and a mean over one answer would be that person's answer.

Invitations are capped at 200 for one round and 60 a day across your whole account. Both are anti-abuse limits on messages to people who are not Sessional users, not a plan limit.

The point of an independent collator is that the person being described cannot work out who said what. That is enforced in the data, not by asking you not to look.

What the round shows you

• Everyone you invited: their name, their organisation, whether they were emailed or handed a card, whether the invitation came from your booking ledger or was typed in by hand, when it was sent, and whether it bounced.
• Counts, each as a number, once the round has five responses: responses received, responses set aside because they were filled in from your own signed-in account, and responses that came from a network or device you have also used. Declines are not among them, and there is no count of them anywhere.
• At five responses and above: for each question, how many people answered, the average, the spread, and how many said "Don't know".
• The written comments, in an order unrelated to when they arrived, with no date, no role and no organisation against any of them, once at least three of them have been checked and can be shown together.

What nothing in Sessional shows you

• Which of the people you invited has answered. Not on the page, not in a PDF, not in a notification, not in the API, not in a log. An invitation shows when it was sent and whether it bounced. It never shows that it was answered.
• Who declined, and how many. Declines are not counted for you at all: a number that went up the morning after you invited three people is a fact about one of those three.
• Your own address, if you type it in. A round cannot ask you about yourself. The contact list never offers your address and typing it by hand is skipped with the reason given, because feedback about you that you wrote is not feedback and an appraiser is entitled to assume nobody did that.
• An exact response count below five. The round says "fewer than five responses so far" and nothing more precise, because a figure that moves by one when one person you invited yesterday answers is that person's participation.
• One person's answers. There is no screen, export, download or API response anywhere in the product that carries them.
• Which comment came from which invitation. The link between a response and a person invited is not exposed by anything you can open.
• Anything at all below five responses, including on a round you have closed.

Reminders work the same way. Send a reminder goes to everyone who has not answered, in one press, and tells you it has been sent and nothing more. You never choose the list, because choosing it would mean seeing it, and you are not told how many it reached either: on a round with one invitation outstanding, the difference between none and one is that person's answer. One reminder per person, either when you press it or automatically at day 14, whichever comes first.

Feedback is only worth reading if the person it describes could not have shaped it. Four things make that checkable rather than promised:

• Nothing can be deleted or cherry-picked. There is no route in Sessional that deletes a response or a round. Closing a round freezes it. Revoking one stops the links but keeps the responses, and a revoked round still appears in your appraisal pack with its counts, so an unfavourable round cannot be made to disappear. The only thing that removes a round is erasing your whole account, which removes everything you have.
• Where the invitations came from is on the record. Each one is marked as coming from your booking ledger, meaning an organisation you have a recorded shift with, or as typed in by hand. The report states how many were which, so your appraiser can see the proportion rather than take the list on trust.
• An answer you filled in yourself is set aside. If a questionnaire is submitted while you are signed in to your own Sessional account, that response is excluded from the report and the exclusion is counted where your appraiser will see it. The respondent page notices your own session and nothing else, which is the one signal strong enough to act on.
• Answers from a network or device you have also used are kept, and counted. A workplace shares one network and one browser build, so a match there says almost nothing: it is at least as likely to be the colleague at the next desk as it is to be you. Removing their answer would punish the honest case. The report notes how many responses matched, as a number your appraiser can weigh, and the answers stay in the figures. You see the counts. You never see which response.
• Every exported report carries a verification code. The footer prints sessional.co.uk/verify/feedback/<code> with a ten-character code, the version number and the first characters of the digest. Anyone opening that page sees your name and profession, the round title, the questionnaire, the window, the counts, the per-question averages, the integrity line and the full digest, and never the comments. It shows an appraiser what Sessional recorded for that version, so they can compare it with the document in their hand. The page never sees their document, so it cannot tell them the paper was altered; it tells them what the genuine report says, and anything that differs is not this report.

The patient questionnaire is the GMC's own, word for word. Sections 1 to 3 of the GMC Patient Questionnaire are reproduced exactly as the GMC prints them: three questions about the visit, seven about how good the doctor was at being polite, listening, assessing, explaining, involving you and arranging treatment, two about confidentiality and honesty, three yes or no questions, and the comment box. The GMC's own scales come with it, including "Doesn't apply", which is counted separately and never enters an average.

The colleague questionnaire is still Sessional's wording. Eight scored questions and a comment box, on a five-point agreement scale with "Don't know" beside it, written to follow the four Good Medical Practice domains. Every page that shows it says it is based on the GMC colleague questionnaire, because it is not a transcription. A receptionist who cannot judge clinical reasoning should be able to say so, and those answers are counted separately and never enter an average.

Everyone else gets a short organisation questionnaire: six questions about reliability, communication with the team, communication with patients or service users, clinical practice, records and handover, and whether the organisation would book you again, plus one comment box. It is deliberately short. A twenty-question form sent to an organisation manager gets one answer in ten, and the whole point of a round is answers.

The GMC has three requirements about the people you choose, and Sessional is built around them rather than leaving them to you to remember. Quoted from the GMC's guidance on supporting information for appraisal and revalidation:

• A range of roles. The colleagues asked "must be chosen from across your whole scope of practice and must include people from a range of different roles, including those who are not doctors, AAs or PAs". The page where you tick names says so, and nudges you if everyone on the list is down as the same role. Your report, your export and your appraisal pack all print how many invitations went to each role, so an appraiser can see the mix. That line counts invitations, never responses: responses by role would identify the one manager the moment they answered.
• Impartially, and explicably. You "must choose colleagues impartially and be able to explain to your appraiser, if asked, why you have chosen the colleagues who have given your feedback". There is a box for that on the round: write it while you are choosing, and it is printed on your report PDF and in your appraisal pack. Nobody you invite ever sees it. It is your own writing and Sessional does not alter it: if it names a person or carries a patient identifier, the save is refused and you are told why, rather than the text being quietly rewritten and printed under your name.
• Anonymous where possible. "Where possible, feedback should be anonymous." It always is here. You never see one response, who answered, who declined or who has not replied, and comments arrive undated and in an order unrelated to when they were written. It holds in the database as well as on the screen: there is no column anywhere recording that a particular invitation was answered, so the fact is not in a backup either.

Sessional will not choose respondents for you and does not suggest names. That is your judgement and the GMC asks you to be able to defend it.

Sandy is allowed near the paperwork around a round. It is not allowed near the evidence in one.

• It drafts the covering note that goes out with a colleague invitation, from the facts already in your ledger. You read it, edit it and send it.
• Once a round is at the floor it can offer a "What the feedback says" panel: recurring themes across the comments, shown beside the comments themselves and labelled as an aid to reading them.
• It reads every comment for names before that comment is shown to anybody. A rules-based check runs the moment the comment is stored, and a language model in the EU runs over it on the hour and catches a bare name the rules cannot, such as a colleague named without a title in front of them. A comment nobody has checked yet is held, not shown, so a model outage delays comments rather than publishing unchecked ones. The model never changes what a comment means: it names the identifiers, and the replacement is done by ordinary code.
• It maps questions and comments to your regulator's domains for the appraisal pack index, which is counting, not judging.

The NMC asks for five pieces of practice-related feedback across a cycle, from patients, service users, colleagues or others, and prescribes no form. A round using the organisation questionnaire satisfies that as written, and Log as practice-related feedback adds one entry to your NMC feedback log summarising the round, on your NMC revalidation→ page, so you are not retyping your own round into your own tracker. One entry, not one per response: individual responses stay collated, and there is nothing in your tracker to edit them one at a time.

The GPhC asks you to name your peer and to have their agreement to be named and contacted, which is a different thing from a collated round. The HCPC asks for evidence of benefit to service users, and the same round and the same report serve that. Nothing here replaces your regulator's own portal: Sessional never submits anything on your behalf.

A round closes when you close it, or on its own after 60 days. Closing freezes it: the report stays, and no further answers are taken. You can reopen it inside those 60 days.

Revoking is the stronger action. It kills every link in the round, including printed cards, and a respondent who follows one is told plainly that it has been withdrawn. Use it if a card has gone somewhere you did not intend. It is not a way out of a round you did not like: the responses already given are kept, and the round still appears in your appraisal pack with its counts.

Ninety days after a round closes or is revoked, the respondents' names and email addresses are deleted. The responses stay, because they are your record. The contact details go, because they were never yours.

Sessional support cannot read your responses. Not from an admin screen, not from an export, and not during an assisted-support session, the mode where a member of staff looks at your account with your permission to work out what has gone wrong. Every feedback page and route is blocked in that mode. What support can see is that a round exists and what its counts are, which is enough to answer a question about sending and not enough to read a word anyone wrote about you.

The respondent pages are quiet. A page opened from an invitation or a card sets no cookies, loads nothing from any third party, carries no analytics, tells search engines not to index it and passes no referrer onward. Nobody is followed around the internet for having given a colleague some feedback.

Your data is held in the United Kingdom. Our servers and database run in the UK and your files are stored with Cloudflare in the UK region. Two things leave the UK: emails are delivered by Postmark in the United States, and the automated check for names in feedback comments runs on a model hosted in France by OVHcloud. Nothing is stored by either beyond what that step needs. Respondents' names and email addresses are encrypted where they sit, deleted 90 days after the round closes, and never used for marketing of any kind. Report PDFs are built when you ask for one and are not filed anywhere afterwards.

Collecting feedback is part of Plus: starting a round, sending invitations and reminders, printing patient cards and drafting a covering note. Reading what you have collected is free on every plan and stays free after a downgrade: your reports, their verification codes, the themes panel and your NMC log. If your plan lapses while a round is open, the invitations already sent keep working and responses keep arriving; you can close the round, and you can send more once you are back on Plus. The report PDF and the appraisal pack→ are free on every plan, and were on Plus until 8 September 2026. Your evidence for an appraisal or a revalidation never depends on a subscription.

This part is for the person holding the link rather than the professional who sent it. If a colleague, a practitioner you booked, or a doctor you saw has asked you for feedback through Sessional, then:

• The page tells you who is asking and why before it asks you anything.
• Sessional receives your answers, not the professional. They see totals across everyone who answered, and only once at least five people have. They are never shown your answers on their own.
• They are not told whether you answered. Nothing they can open says which of the people they invited replied, declined or ignored it. Reminders go to everyone who has not answered in one press, without them seeing who that is, and the totals are worked out once a day so a number cannot move in step with a message they just sent you.
• Your comment is checked twice before anyone sees it, once by a rules-based check and once by a language model in France, and names and other identifying details are replaced. Comments appear the morning after they are checked. Please do not put your name, a patient's name or anyone else's in the box.
• The page sets no cookies, loads nothing from any other company and carries no analytics, so answering does not follow you anywhere. Your answers are held in the United Kingdom; the automated check for names runs on a model hosted in France, and invitation emails are delivered by Postmark in the United States.
• If you were emailed, the email carries a decline link. It opens a page with a button, and nothing happens until you press it. That second step is deliberate: plenty of mail systems open every link in a message to check it for you, and a one-click link would let a scanner decline on your behalf without you ever seeing it. Once you press the button you are not asked again, by that professional or by anyone else using Sessional, ever. Your address is held encrypted for the round and for 90 days after it closes, and is then deleted. It is never used for marketing. If you reply to the invitation instead, that reply is a support conversation with Sessional rather than part of the round: it goes to the support desk, the professional never sees it, and it is kept with our other support correspondence rather than deleted on that 90-day timetable.

The privacy policy→ has a section written for you, and you can write to support at any time.