Body composition, and the charter rule we wrote against it
Charter rule C6 banned body composition framing at every age. Then we specified a product built on exactly those numbers. Here is the whole argument.
The failure mode
An employer can see that a named employee's activity dropped sharply in March. That is workplace wellbeing data about a person, and it is health information about a person, inferred from a wellbeing benefit they were encouraged to use, sitting in a dashboard belonging to the people who decide their promotion.
It does not matter that the intent was supportive. The capability is the problem, and a role-based permission is not a control — it is a setting, and settings change when somebody senior asks.
Absent, not gated
There is no API that returns per-person activity to an organisation. Not restricted, not audited, not available to a super-admin. The response type has no field for it, so a client asking for one does not compile.
Cohort metrics require at least eight contributing people. Below that the value is replaced with a suppression marker, and the suppression is enforced in the query planner and again as a database constraint.
The intersection attack
k-anonymity of eight is not sufficient on its own. Filter by department, then by site, then by age band, and each filter is above the threshold while the intersection is one person.
So the check runs across filter combinations rather than per query, and a combination that would narrow to fewer than eight is suppressed even when every individual filter looks safe. This makes some legitimate questions unanswerable in small organisations, which is the correct outcome.
What an employer does get
The workplace wellbeing data an employer does receive: participation, aggregate movement trend, sedentary-risk distribution by cohort, and a return-on-investment model with its assumptions written down. Enough to run a programme. Not enough to manage an individual.
Why the type system rather than a permission
The usual objection is that a permission is fine as long as nobody grants it. In practice a permission is a conversation waiting to happen: a senior person asks, an administrator finds the toggle, and the control that existed on paper is gone in an afternoon with no code review and no record.
Removing the capability changes the conversation entirely. There is no toggle to find. Adding one means a schema change, a migration, a code review and a deliberate decision by named engineers — which is exactly the amount of friction a decision like that deserves.
It also changes the sales conversation, and not always in our favour. Some buyers want the individual view and go elsewhere when told it does not exist. That is a cost we have decided to keep paying.
What the suppression marker looks like
When a cohort falls below the threshold the response carries a suppression marker rather than a number, and the marker is a distinct value in the type rather than a zero or a null. A client cannot accidentally render it as "0 people moved this week", which would be both wrong and worse than saying nothing.
The dashboard shows it as "too few people to report", with the threshold stated. Administrators of small organisations see a lot of it, and the honest answer to their complaint is that an eleven-person company cannot have anonymous reporting, and a product that pretends otherwise is selling them a risk rather than a feature.
What the organisation actually buys
Participation and engagement at cohort level. Aggregate sedentary-risk distribution. Trend over time against a baseline. A return-on-investment model with its assumptions written down and adjustable, so nobody has to take our multiplier on faith.
That is enough to decide whether to renew, where to run a campaign, and which sites need attention. It is not enough to have a conversation with one employee about their activity, and it is not supposed to be.