Measuring employee wellbeing without monitoring: anonymous and aggregated data

HR teams want to know how their employees are doing: who is disengaging, which teams are running out of steam, whether wellness initiatives make a difference. Employees, for their part, get wary as soon as an app touches their health. Both expectations are legitimate, and they do not contradict each other.

The key fits in one rule: the employer measures group trends, never individuals. This guide separates the types of data, summarizes what privacy law requires in Canada, with a closer look at Quebec's Law 25, and offers four rules to measure wellbeing without monitoring people.

Individual, aggregated, de-identified, anonymized: what is the difference?

Type of dataWhat it isExampleWho should see it IndividualTied to a named personJulie's steps on TuesdayThe person themselves AggregatedAn average or total across a groupThe Sales team's average mood in MarchThe employer, if the group is large enough De-identifiedThe name is removed, but the person can still be identified indirectlyA row reading "employee 47, age 52, Lévis warehouse"Controlled internal use (studies, statistics) AnonymizedNo identification possible, irreversiblyAn annual statistic that can no longer be linked to anyoneUsable under the conditions set by law The most common trap is confusing de-identified with anonymous. Removing the name is not enough: in a team of four, age and job title are often enough to find someone.

What the law says

Across Canada, PIPEDA applies to the private sector. In Quebec, the Act respecting the protection of personal information in the private sector, modernized by Law 25, is more specific:

• Sensitive information: information that is medical, biometric or otherwise intimate in nature is sensitive, and its use requires express consent (section 12).
• De-identified: the information no longer allows the person to be identified directly (section 12).
• Anonymized: it irreversibly no longer allows the person to be identified, directly or indirectly (section 23). Since May 30, 2024, the Regulation respecting the anonymization of personal information requires a re-identification risk analysis, and the risk must be very low (Torys summary).

Wherever you operate, a wellness platform should be able to explain what data it collects, where it hosts it and what the employer sees.

4 rules to measure without monitoring

1. Show groups, never individuals

The HR dashboard shows averages and trends by team, site or organization. No individual view, even "to help".

2. Hide small groups

Set a minimum number of respondents before showing an average, and apply the same rule to cross-filters (team and age range, for example). Below the threshold, the result is not displayed.

3. Collect only what you need

To run a wellness program, participation, activity and self-reported mood are enough. Diagnoses, individual heart rate or location have no place in an HR dashboard.

4. Know where the data lives

Ask the vendor where data is hosted. If it leaves Quebec, Law 25 requires a privacy impact assessment before the transfer. Data hosted in Canada makes the analysis simpler.

What to measure in practice

• Participation: the share of employees taking part in activities, by team.
• Physical activity: average steps and active minutes, and their trend.
• Mood: a team average from voluntary, anonymous check-ins.
• Social connection: participation in team challenges and exchanges between colleagues.

Tracked over time, these measures are enough to spot a team running out of steam and to document a prevention approach, without ever exposing a person.

The Propulsion model

Propulsion applies these rules by design. The HR portal shows a health-performance index built on three pillars (physical, mental and social health), calculated from aggregated data. The employer only sees team averages and trends: small groups are hidden and individual mood stays private.

Data is hosted in Canada, with OVHcloud in Quebec. Propulsion complies with PIPEDA, Quebec Law 25 and GDPR, is ISO/IEC 27001 certified, and its SOC 2 Type II audit is in progress. At Fromagerie Bergeron, a manufacturing employer, 78.8% of employees took part (see the case study).

Keep reading

To measure wellbeing through a survey, the 20-question employee wellbeing survey includes an analysis grid. To assess a platform on these criteria, the ten features to check in a wellness app work as a scorecard. And to compare vendors on hosting and language, our comparison of eight platforms covers the field. To see the HR portal with your own settings, book a demo.

Frequently asked questions

Can my employer see my steps or my mood?

It should not. A well-designed platform only shows the employer group averages. Ask your employer or the vendor what the HR dashboard actually displays.

Is step data health information?

It relates to health and is personal information. In Quebec, information of a medical or otherwise intimate nature is sensitive and requires express consent. Treat activity data with the same care.

Is data without a name anonymous?

No. Under Quebec's Law 25, it is de-identified: the person can still be identified indirectly. Data is anonymized only when identification becomes irreversibly impossible.

How large must a group be to show an average?

The law sets no single threshold. Set a minimum number of respondents, apply it to cross-filters too, and document your choice in your privacy impact assessment.