The privacy-first wellness benefit buyer's checklist

Privacy: structure, not policy

Health data is a special category of personal data under Article 9 of the GDPR. An employer that can see it is the risk, not the benefit — so every answer here should describe what the system makes impossible, not what a policy forbids.^[4]

• Can any admin, ever, see an individual employee's entries or metrics? The only acceptable answer is 'structurally impossible' — not 'we have a policy', not 'only with permission'.

• What is the minimum group size below which aggregates are hidden — and are the figures rounded or perturbed so a small team cannot be reverse-engineered?

• Who owns the account and the data: the company or the employee? What happens to an employee's history when they leave, or when you cancel?

• Where is the data stored and processed, and who are the sub-processors? Is there advertising technology or data sale anywhere in the model?

• If there is AI: is it consent-based per employee, revocable at any time, and never trained on your people's data?

• Can an employee export everything and delete their account themselves, without going through HR?

Engagement and evidence

A dashboard can show anything. Ask what the number is made of.

• What does 'active' mean in the reporting — an app open, or a real logged entry? The best-run trials measured clinical and economic outcomes, not participation — and in the one that measured both, self-reported behaviour improved while clinical and spending outcomes did not.^[1][2]

• How often is engagement reported, at what granularity, and can the vendor show a sample report with the minimum-group threshold actually applied?

• Where does the content come from? Is advice cited to research, are experts verified, and is there a visible line between evidence and opinion?

• What does it replace or duplicate — EAP, insurer apps, fitness stipends? Only a minority of employees typically take part in a workplace wellness intervention; a benefit that duplicates three others starts lower still.^[3]

Commercial terms

The price on the slide is rarely the price on the invoice.

• What is the all-in price per seat per month — and what costs extra: onboarding, support, reporting, AI features?

• What is the seat minimum, and how are seats added or reduced mid-term?

• What are the cancellation terms, and what is returned or deleted on exit — for the company and for each employee?

• Can you run a pilot with a small team first, and does the pilot pricing carry over?

How to use it

1. 1

   Send the six privacy questions to every vendor in writing before the demo. Written answers are what your data-protection officer can act on.

2. 2

   Score two vendors side by side on the eight criteria. A 'policy' answer where a 'structural' one was needed is a no, not a maybe.

3. 3

   Ask for a sample engagement report with the minimum-group threshold applied to a team of five.

4. 4

   Lamplit for Business is built to answer every question here in writing — €5 per seat per month billed annually, from 10 seats, aggregate-only reporting hidden below five active members, employee-owned accounts, EU hosting — and to be scored on the same sheet as everyone else.

Common questions