This is usually the question that decides whether a benefit gets approved. HR asks it on behalf of employees, and employees ask it on their own behalf: who sees what. This article answers both.

What the company sends us

Three fields per employee: first name, surname and email address. Nothing else.

No identification numbers, no addresses, no health information. The agreement expressly prohibits the company from sending us special categories of personal data, and data relating to criminal convictions or offences, unless separately agreed in writing with appropriate safeguards.

What HR can see

In the company panel an administrator sees, per employee: name, email address, credits allocated and credits spent.

That is the whole list. HR does not see the number of visits, the dates, the locations, or which activity or category was used.

This is deliberate and it matters more than it looks. It means an employee can book a psychologist, a nutritionist or a massage without their employer being able to see that they did. Employees who suspect otherwise do not use the benefit, so the limit protects your participation rate as much as it protects their privacy.

Sensitive services

Booking psychological sessions through the app involves mental health data, which is strictly protected under data protection law. FitKit processes it solely for safe and efficient scheduling and holds no additional data about anyone's health or the content of sessions. It is never visible to the employer.

Who is responsible for what

The company and FitKit act as separate and independent controllers. This is not joint processing:

• The company is controller for selecting which employees join the benefit programme and for managing its relationship with them.
• FitKit is controller for providing and running the app and platform, managing user accounts, enabling access to activities, its own operational analysis and its own marketing.

FitKit acts as a processor only where the company expressly instructs it, in writing, to process data for a purpose the company defines, for example producing an aggregated or pseudonymised report for the company's internal analysis. That processing then follows the controller to processor rules under GDPR.

What the company has to do

Two obligations sit with the employer, and both are easy to meet at launch:

• Tell employees, before they use the app, that their name and email are shared with FitKit, that FitKit acts as an independent controller for certain processing including its own marketing, and where to find the FitKit Privacy Policy.
• Do not send special categories of personal data.

Communications to employees

Operational and service messages need no separate consent: account and registration matters, credit balance updates, booking confirmations and reminders, new categories, cities or partners, platform and security notices, and service feedback surveys.

Marketing messages are different. Those require separate explicit consent, which FitKit obtains from the employee directly and which the employee can withdraw at any time.

Breaches, transfers and retention

Each party notifies the other of any personal data breach affecting shared data without undue delay and within 24 hours at the latest.

Where employees are in the EU or EEA, GDPR applies regardless of where processing happens, and transfers outside the EEA are made under standard contractual clauses approved by the European Commission.

Personal data is retained for as long as necessary for the purposes described in the Privacy Policy and for legal obligations. Employees can exercise access, rectification, erasure, restriction, objection and portability rights directly with FitKit at any time.

Your data protection officer will want to read the source rather than a summary. Ask FitKit for the data protection section of the agreement and the Privacy Policy for your country, and we will send both before any decision.