Privacy & security
Your people's data, protected by design.
People join because they trust what happens to their data. So employers see groups, never individuals, and nothing is counted without consent.
Groups, never people.
Your company sees
- How many people take part, and how many keep going.
- Results for teams, sites and the company, once a group is large enough.
- Rewards spent against the budget and the cap.
- The impact record, each tier labelled.
Your company never sees
- What any one person did, or didn't do.
- Any group too small to keep its members anonymous.
- Health information, which stays off unless the person turns it on.
- Anything it could use in an appraisal or discipline.
Privacy at every step.
Malaysia's PDPA
We handle personal data under the Personal Data Protection Act 2010. Our privacy notice says what we collect and why.
Consent at the start
A privacy screen shows what the employer sees before anyone takes part. Consent is recorded, and health features start off.
Leaving is simple
Withdrawing consent stops all future counting. Past retirements stand, because the registry has recorded them.
How small groups are protected
Aggregate-only reporting
Employer dashboards and reports show groups only. HR never sees individual activity.
A minimum group size
A group below the threshold is hidden, with the next smallest, so no one can be found by subtracting one total from another. Each company sets its threshold at onboarding, above a floor the platform keeps.
Never used against anyone
Taking part is kept apart from performance management, and never used in appraisals or discipline.
Locked down where it matters.
Each company kept apart
Every request checks who is asking before anything is shown.
Sign-in without passwords
A one-time code by email. Company admins and Bloom staff add an authenticator app.
Two people for big changes
Overrides need a second person's approval, and each is logged for good.
More security practices
Only the access a role needs
Roles decide what each person can see and do. Bloom staff give a reason before opening anyone's account history, and the reason is logged.
A log that is never erased
Sensitive actions, as well as overrides, are written to a log that is never erased.
Limits on repeated attempts
Sign-in codes, join codes and forms are rate-limited, so they can't be guessed or flooded.
Backups that are checked
The database and stored documents are copied by a backup tool that checks each copy as it is made.
Questions people ask
Can my manager see what I did?
No. Your company sees results for groups large enough to keep everyone anonymous. It never sees what you, or anyone else, did.
What if our team is very small?
Then its results are hidden. A group below the threshold never appears in a report, on its own or by subtraction.
Do you collect health data?
Not unless you choose to. Health features are optional and off by default.
What happens if I stop taking part?
Withdraw your consent and we stop counting from that moment. What was already retired in the registry stays retired.
Do you take data from our HR system?
Only what is needed to let the right people join: single sign-on and an eligibility list. Never performance, appraisal or health data.
A question about your people's data?
Ask us anything about how the platform handles personal data. A founder replies within two working days.