Why does your employer want your resting heart rate? The wellness program will say it’s about healthy habits, lower premiums, maybe a free wearable. That’s the pitch. The question nobody asks in the enrollment meeting is where the numbers go once they leave your wrist.
The pitch
Wellness programs wrap themselves in benefit language. Step challenges, smoking-cessation coaching, sleep-tracking apps—all at no charge or with a discount on your health plan. The framing is always the same: the company cares about your well-being, and this tool helps you take control. What the brochure leaves out is that the tool is also a sensor pointed inward, and the employer often holds the readout.
What they collect
A step-counting app reveals more than your daily total. A continuous trace of movement tells anyone reading it where you live, where you work, and roughly when you sleep. Add a heart-rate sensor and the data can suggest stress patterns, illness onset, or alcohol consumption. Employers already access health information through background checks, but wellness programs open a new, ongoing stream: whether you’re exercising, losing weight, have really quit smoking, or are succeeding in controlling an anger management problem, as the Electronic Frontier Foundation has documented.
The collection often extends beyond the wearable. Some platforms pull in pharmacy claims, biometric screenings, or health-risk assessments. The privacy policy may mention this in clause eleven, framed as personalization. But the honest answer to whether a step counter needs your contacts is that it does not.
What they don't tell you
The resale question is the one the terms-of-service update buries. Aggregated wellness data is valuable to insurers, research brokers, and third-party analytics firms, and the partnerships that move that data are often disclosed in dense legal prose nobody reads during onboarding. This is legal in most jurisdictions and not, by itself, a scandal. It is, however, a thing the employee should know before agreeing.
The regulatory backstop is thinner than people assume. The Health Insurance Portability and Accountability Act generally covers health providers and health plans, but when an employer operates a wellness program directly, HIPAA may not apply. The Federal Trade Commission can step in if a company makes privacy promises it doesn’t keep—the FTC Act requires living up to express or implied claims—and the Health Breach Notification Rule may kick in if a breach occurs. But no comprehensive federal law stops an employer from seeing your step count or sharing it with a data broker, provided the fine print nods in that direction.
Even the consent mechanisms can be porous. Written permission is supposed to precede background-check health inquiries, yet the exceptions for law enforcement, judicial processes, and administrative needs carve out wide paths around that requirement. In a wellness program, consent is often bundled into the enrollment clickthrough, and the default is sharing, not silence.
Your move
The fix is small. Open the app permissions and remove what the function doesn’t require. If the device offers an option to opt out of data sharing without losing core functionality, take it on day one. Read the privacy policy—really read it—and note the section that describes who the data can be disclosed to. If that section includes affiliates, business partners, or service providers without further limitation, assume the data travels.
Ask the benefits administrator a direct question: who sees the raw data, and can I use the program without contributing to the aggregate pool? A program that truly exists for your health will have a clear, standalone opt-out. One that exists for the data will make you search for it.
FAQ
Can my boss really see my step count?
Yes. If the wellness program is employer-run, HIPAA often doesn’t apply, and the fine print may grant access to raw or aggregated data. Assume they can see it unless you’ve confirmed otherwise in writing.
What’s the worst that could happen with this data?
Wellness data can be sold to data brokers, used to adjust your premiums, or even cited in employment decisions. The FTC can punish broken privacy promises, but the data flow itself is largely unregulated.
How do I opt out without losing the discount?
Ask your benefits administrator for a standalone opt-out that doesn’t require participating in data sharing. If they can’t provide one, the discount is likely the price of your privacy.
