Can HR see which employees signed up?

Yes. Organisation admins see the roster: every invitation and whether it was redeemed, and for each person who accepted, the name on their account, their email, their seat type and the date they joined. The roster says nothing about how anyone uses TriageFit after that.

Can a manager see someone's weight, check-ins or messages?

No company role can. A member's training, food logs, weigh-ins, check-ins and conversations belong to their own relationship with TriageFit, and no screen or API route in the employer portal carries them. Each person is told this on the invitation page before they accept.

Why do some figures in the report show no number?

A figure appears only when at least five distinct people contributed to it. Below that the report shows the line as withheld with no number, so a small department cannot be identified by its average. If the whole team is smaller than five, the report shows no figures for it at all.

Who is the controller of employee data?

The company is the controller of the roster data it gives us, and TriageFit processes that data as its processor under the data processing agreement. For everything a person does inside their own account, TriageFit is an independent controller under its privacy policy, and the person uses their rights directly with us.

What happens to our data when the contract ends?

The company chooses in writing whether its roster data is deleted or returned, and if no choice arrives within 30 days of the end, TriageFit deletes it. People who held seats keep their own accounts, history and data, and are offered a personal plan.

What an employer can see in a TriageFit wellness programme

When a company funds TriageFit seats, it sees a roster of who holds one and group figures that are only released once at least five people stand behind them. Each employee's training, food, check-ins, messages and health data stay between them and their coaching, and they are told exactly what the company can see before they accept. The data processing agreement and the data flow pages set the same boundary down in writing.

By TriageFit · Published 28 September 2026

Employee wellness data privacy decides whether a programme gets used. People will not tell a coaching app about their sleep, their weight or a bad month at home if they think it travels back to their employer, and a benefit nobody trusts is a benefit nobody takes up. TriageFit gives it a short answer that holds on every screen a company can open: a roster of who holds a seat, group figures with at least five people behind each one, and nothing about any one person's coaching.

Two relationships, kept apart

A seat pack sets up two separate relationships. The company gives TriageFit a small amount of contact data so the roster can run, and for that data TriageFit is the company's processor under a data processing agreement. Each person who accepts a seat becomes a member with an account of their own, and everything they do inside it belongs to that second relationship, in which TriageFit is an independent controller under its own privacy policy.

Health data in a member's account is processed only with that person's explicit consent, and they use their rights to see, export, correct or erase it from inside their own account. The company is not a controller of any of it and receives none of it.

What the company hands over

At purchase, the company gives its name and billing details. For each person it invites, it gives a work email address, the role that person will hold and whether the company funds the seat. It can add four labels against each address, worded however it likes: department, site or region, employment type and tenure band. Every label is optional, and the report uses the department label to speak about one part of the business.

That is the whole list. The invitation form has no field for a name, a home address, a date of birth or a payroll number, and TriageFit never asks for one. How team data flows sets each of these out, along with what comes back.

The roster

Organisation admins see a roster on the People tab. It lists each invitation and whether it has been redeemed, and for everyone who has accepted it shows the name on their own TriageFit account, their email address, their seat type and the date they joined. The name comes from the person's account, so it is theirs to set and change. Admins can download the roster as a CSV file.

The roster carries contact details and seat state, and that is where it stops. Whether someone trained this week, how often they open the app and what they logged all stay out of it.

The group report

The Reports tab opens the workforce health report, a printable document of group figures, with participation counted across the roster and figures broken down by department when the numbers are large enough. A figure appears only when at least five distinct people contributed to it, and below that it shows no number at all, so a team of three cannot be picked out by its average.

The report is built fresh each time it is opened, so an admin who wants a record at a point in time can print it or save it as a PDF from the browser.

A company can give someone a billing admin role for the finance side. A billing admin sees how many seats were bought, redeemed, held by invitations and free, and opens the invoices and payment details, and the People and Reports tabs are closed to them. Every organisation admin and billing admin must sign in with a two-factor authenticator app before the portal opens.

What each person is told before they accept

The invitation page tells each person, before they accept, that the company can see they have enrolled and can see group numbers that never single anyone out, with groups smaller than five withheld, and that it can never see their training, check-ins, messages or anything about their health. The announcement the portal drafts for the company to send says the same in the company's own words.

The corporate terms hold the company to the same line: taking part stays voluntary, accepting or declining a seat cannot feed into any decision about a person, and the company agrees never to try to identify anyone from group reporting.

What stays with the person

Everything a member does inside TriageFit stays with them and their coaching: the intake, the programme, food logs, weigh-ins, check-ins, conversations with the AI coach and anything a coach writes back. No company role can reach it through any screen or any API route. When TriageFit's safety screening leads it to adjust or pause someone's coaching, that stays between TriageFit and the person as well, and the company is not told.

When someone leaves the company, they keep their account, their history and their data and are offered a personal plan, and their seat returns to the company's pool for a new invitation. When an agreement ends, the company chooses in writing whether its roster data is deleted or returned, and if it makes no choice within 30 days TriageFit deletes it. Members keep their accounts either way.

Where the data is held

The application and database run in Frankfurt, member uploads are stored under EU jurisdiction, and AI processing runs in EU regions only, checked at runtime. Sensitive fields are encrypted at rest, and staff reads of health records are written to an audit trail recording who read what and when. The security overview covers the rest, and the sub-processor list names every service involved and where it runs.

Settling it before you buy

A privacy review usually needs five documents: the corporate terms, the data processing agreement, the data flows, the security overview and the sub-processor list. All five are public, so HR, IT and legal can read them before anyone talks to us. The wellness platform procurement checklist matches the usual vendor questions to each one, and a corporate wellness programme built on coaching seats covers what each seat gives a person.

Seats are bought on the TriageFit for business page, where packs of 10 to 50 seats go through online and a larger team gets a quote by email.

Questions people ask

Can HR see which employees signed up?: Yes. Organisation admins see the roster: every invitation and whether it was redeemed, and for each person who accepted, the name on their account, their email, their seat type and the date they joined. The roster says nothing about how anyone uses TriageFit after that.
Can a manager see someone's weight, check-ins or messages?: No company role can. A member's training, food logs, weigh-ins, check-ins and conversations belong to their own relationship with TriageFit, and no screen or API route in the employer portal carries them. Each person is told this on the invitation page before they accept.
Why do some figures in the report show no number?: A figure appears only when at least five distinct people contributed to it. Below that the report shows the line as withheld with no number, so a small department cannot be identified by its average. If the whole team is smaller than five, the report shows no figures for it at all.
Who is the controller of employee data?: The company is the controller of the roster data it gives us, and TriageFit processes that data as its processor under the data processing agreement. For everything a person does inside their own account, TriageFit is an independent controller under its privacy policy, and the person uses their rights directly with us.
What happens to our data when the contract ends?: The company chooses in writing whether its roster data is deleted or returned, and if no choice arrives within 30 days of the end, TriageFit deletes it. People who held seats keep their own accounts, history and data, and are offered a personal plan.