TempoLife › Features › Workplace wellness
Workplace wellness that cannot spy on anyone
Company step challenges where the employer sees aggregates and nothing else. A 5-person floor is enforced in the query, names appear only by opt-in, and weight and food are never read at all.
What an employer sees
- How many people joined, and how many of those logged any steps in the challenge window.
- The team's total steps for the window, and the average per participating person.
- The number of days on which anybody logged steps.
- A first-name leaderboard containing only the people who explicitly opted in to appear on it.
What an employer never sees
- Weight, body composition or any measurement of a body. Not aggregated, not banded, not "average BMI of the sales floor". This file contains no query that reads it.
- Food. Not meals, not calories, not "how healthily the team eats". Same reason.
- Sleep, heart rate, blood pressure, medicines, symptoms or anything a clinician would recognise as health data.
- Individual step counts, unless that person opted in to a named board, and then only a first name and a total.
- Who declined to join, beyond the arithmetic of a headcount they already have.
- Anything at all below 5 participants. Small teams are where aggregates stop protecting anyone, so they produce no numbers.
The guarantees above are implemented, not promised: the aggregate query carries HAVING COUNT(DISTINCT user_id) >= 5, the PHP re-checks that count, and the only health column read anywhere on this surface is a step count.
Why the 5-person floor matters
An average is not anonymous when the group is small. Show the mean of three people, then show it again after one leaves, and anyone with a calculator has the number of the person who left. Aggregate reporting protects people only above a threshold, which is why statistical offices suppress small cells rather than publishing them, and why this dashboard refuses to draw a chart for a team of four.
The floor applies to distinct people who actually contributed data in the window, not to headcount. Eight people can join and still produce no figure if only three of them logged steps that week, because it is the contributors who would be identifiable. When the floor is not met the page says so plainly instead of showing a zero, which would itself be information.
Running one of these without doing harm
- Never tie it to pay, insurance, promotion or a review. The moment a step count affects someone's money it stops being wellness and starts being a fitness test that people with disabilities, caring responsibilities or a desk-bound job will fail.
- Make joining genuinely optional and unremarkable. No public list of who did not join, no manager chasing, no gentle reminders in a team channel.
- Do not use a wheelchair-unfriendly metric as a proxy for health. Steps measure walking. They do not measure fitness, effort, or whether someone is looking after themselves, and a step target excludes some colleagues entirely.
- Prizes should be small and shared. Team-level, low-value and ideally the same for everyone who took part. Large individual prizes reliably produce phones taped to dogs.
- Set an end date. A four-week challenge that finishes is better than a permanent leaderboard nobody can get off.
- Tell people exactly what you will see. You can link them to this page — it is written for them, not for you.
Start one
Creating an organisation needs an account, because someone has to be the administrator and that has to be a real, revocable identity rather than an email address in a form.
Frequently asked questions
Can my employer see my weight or my food diary?
No. This surface contains exactly one query against health data and it reads step counts. There is no code path here that reads weight, food, sleep, heart rate or anything clinical, so there is no setting an administrator could change to reveal them.
Can they see my steps individually?
Only if you switch it on yourself for a challenge, and then only your first name and your step total on the office board. By default your steps exist for your employer only inside a team total that also needs at least 5 other people to appear at all.
What happens in a team of three?
Nothing appears. The aggregate query carries a HAVING clause requiring 5 distinct people, and the PHP re-checks the count before rendering, so a small team produces no figure rather than a rounded or approximate one.
Can I leave?
Yes, in one click from the challenge page, and your membership row is deleted rather than flagged. Your steps stop counting towards the total from that moment.
Does my employer find out I did not join?
They see a headcount of people who joined, which they can compare with a staff list if they want to. That is unavoidable in any voluntary scheme, and it is the reason a step challenge should never be tied to insurance, pay or a performance review.
Source: Step totals read from the app's own step log; k-anonymity floor of 5 enforced in SQL and PHP · checked 2026-09-02
Track your own steps first
TempoLife reads steps from Health Connect on Android and keeps them beside your food, sleep and weight — the parts your employer never sees.