HR can see
- Participation rate and active-employee counts
- Challenge status and completion, in aggregate
- Headcounts for a targeted audience, including a health-risk category
- Aggregate leadership insights over the whole population
Features · enterprise
Employee wellness data privacy, in plain terms.
Company-scoped isolation, a data region you pick, and a hard line between what HR can see and what stays with the individual. Private things are private by design here, not by policy alone.
Your tenantIsolated & in-region
- Company-scoped dataEvery record tied to your companyIsolated
- Data regionEU, fixed at onboardingIn-region
- Individual health dataNever on an admin screenEmployee-only
Illustrative sample data.
Each customer sits in a company-scoped tenant on Vantage Fit, hosted in a data region you choose, with individual health data kept off every admin screen. HR sees aggregated, anonymized trends, not named health records. For current certification status and supporting documentation, request the security packet.
Your own tenant, in your own region.
Each company is an isolated tenant, and every query, including anything touching health data, is scoped to that company. You choose where it is hosted.
- India
- United States
- European Union
- UAE
Company-scoped isolation
Your data is a separate tenant. Records carry your company identifier throughout, and cross-company access is not possible by design.
Regional data residency
Choose India, the US, the EU or the UAE at onboarding, served from region-specific endpoints so data stays in region.
Signed off at setup
The region is set at onboarding and does not change afterwards without a planned migration, so there are no surprises later.
What HR can see, and what HR cannot.
The whole model comes down to this split.
Individual health data remains employee-only.
HR cannot see
- An individual's steps, sleep, weight or vitals
- A person's mood check-in, ever
- The names behind a health-risk headcount
- A lab report or its raw biomarker values
The controls in place today.
Here is what is built today, and where we point you to your own due diligence rather than over-claim.
Access & account controls
- SAML 2.0 single sign-on with your identity provider
- Account lockout after five failed password attempts
- Single-use password-reset links expire in one hour; one-time codes are valid for ten minutes
- SSL pinning on mobile and a captcha on web and admin sign-in
- On deletion, identity is anonymized and tokens cleared, while historical records are preserved for reporting
Compliance posture
We describe only what we can stand behind, and give your team the paperwork to verify the rest.
- HIPAA-guideline aligned, with BAA provisions scoped to the lab-report pipeline
- EU data residency is available; residency is distinct from a compliance certification
- A security and compliance packet is available from our team for your due diligence
How is one company's data kept separate?
Each customer's data is logically isolated, so one company's employees, participation and health records are never visible to another. Access is scoped to your organization, and the aggregate-only rule for HR sits on top of that separation. Isolation between customers and de-identification within a customer are two different guarantees, and Vantage Fit applies both.
Residency is a fact, not a badge.
Employee data is stored in the region selected at onboarding: India, the US, the EU or the UAE. We describe this as a data-handling fact, not a certification claim. EU data residency is available, and residency is distinct from GDPR compliance or any other certification.
Your security review, covered
For anything beyond this page, your account team shares the current security and compliance documentation.
We do not publish a certification claim we cannot substantiate here. For the current status and supporting documentation, request the security packet from your account team and assess it as part of your due diligence.
We are HIPAA-guideline aligned, with business associate agreement (BAA) provisions scoped specifically to the lab-report pipeline. That is different from a company-wide HIPAA certification, and we state it that way on purpose.
In whichever region you choose at onboarding: India, the US, the EU or the UAE, served from region-specific endpoints. EU residency is available. Residency and compliance certification are two different things.
No. Admins see aggregate org and department metrics only. No screen or export exposes an individual's health profile, lab values or biomarkers, and health-risk targeting returns a count with no name list.
Their identity is anonymized: name and email hashed, tokens cleared. Historical activity stays for reporting, and the behavior is configurable per company.
No. Recommended Actions are rule-based and never model-generated. The only AI surfaces are aggregate leadership insights and lab-report text extraction, and neither profiles an individual for HR.
Yes. Share your questionnaire through your account team and we will complete it, describing the controls we have in place today.
The participation number stays reportable, the person stays private.
Built to pass the questions you have to ask.
Walk through the isolation model, the residency options and the privacy boundaries with our team, and take the security packet to your reviewers.