Pseudonymization
Research records can use random subject identifiers. This is not anonymization.
What data exists, who can see what, and which decisions remain deployment-specific.
A product transparency overview—not final legal privacy-policy wording.
CategoryPurposeVisibility principle
Identity & participationInvite, access, role, and consent decisionsAuthorized operational roles only
Candidate measurementProfile and Work Sustainability baselineEmployee; permitted summaries by role
AI preferencesExplicit support preferencesEmployee and controlled adaptation service
Behavioral calibrationExperimental task evidenceAuthorized product/research scopes
Observed work & outcomesSelected workflow evidence and follow-upRole-appropriate summaries; no blanket surveillance
Employee correctionsRecord disagreement and improve hypothesesOriginal baseline remains unchanged
Research recordsOptional, separately consented researchPseudonymous records and scoped access
Privacy principles
Designed for bounded use.
AI minimization
AI receives task-relevant context, not raw answers by default.
Research choice
Operational participation and optional research are separated.
Employee correction
Feedback does not silently rewrite baseline measurement.
Retention & deletion
Approved policy and operational evidence remain required.
No hidden collection
No claim is made to record emails, meetings, or private communications.
Finalized before pilot activation
Review security statusDeployment-specific legal configuration
Legal basis, controller/processor roles, retention duration, subprocessors, hosting location, transfers, approved notices, and deletion operations must be agreed for the actual pilot.