Confidentiality is not a footnote. It is part of the product.
Company-wide FUSIONscore™ works only if people can answer honestly without wondering whether their manager will later inspect what they said.
That is why the wider-company assessment is designed around confidential aggregate reporting rather than individual employee results.
Why we say confidential, not automatically anonymous.
An anonymous survey is one where the respondent cannot reasonably be identified from the information held. FUSIONscore™ may need limited information such as organisational level, function, location, tenure band or invitation/completion status to create useful organisational analysis.
For that reason, we do not make a blanket promise that every response is technically anonymous. We make a clearer promise:
COMPANY LEADERS DO NOT SEE INDIVIDUAL EMPLOYEE ANSWERS.
Results are reported in eligible groups.
What company leaders can see.
- ✓overall organisation scores
- ✓eligible group scores
- ✓eligible role comparisons
- ✓eligible function comparisons
- ✓eligible location comparisons
- ✓Leadership Reality Gaps
- ✓Red Flags at eligible aggregate level
- ✓knowledge-gap patterns
- ✓response dispersion
- ✓participation percentage
- ✓whether an invited person has completed the assessment where this is needed to manage participation
What they do not get.
Company leaders must not receive:
- ✕an individual's question answers
- ✕an employee's personal scorecard
- ✕raw employee-response rows
- ✕an identifiable response export
- ✕a list showing which employee gave which score
- ✕small-group results below reporting thresholds
- ✕unrestricted filter combinations that expose individuals
Knowing that you completed is not the same as knowing what you answered.
A company administrator may need to know whether an invitation has been sent, opened, started or completed so participation can be managed. Where this functionality is enabled, completion status is handled separately from the analytical reporting of responses.
RECOMMENDED PARTICIPANT WORDING
Your organisation may be able to see whether you have completed the assessment so it can manage participation. It cannot see your individual answers.
Small groups are suppressed.
The default reporting threshold is:
5 RESPONDENTS
A segmented group with fewer than five submitted respondents should not produce a visible company result. This applies to areas such as role level, function, location and other supported organisational slices.
Five people in a group does not automatically make every question reportable.
Example: Seven people work in a department. Only three feel they know enough to answer one particular statement numerically. That statement result should remain suppressed for that department. A reportable metric therefore needs enough valid responses, not simply enough names in the group.
We also protect against results being worked out indirectly.
Example: Sales has 12 respondents. Operations has 15. Finance has only 3. Simply hiding Finance may not be enough if somebody can subtract the visible groups from the company total and calculate the Finance result. FUSIONscore™ reporting should therefore protect against this kind of indirect inference. Where necessary, additional results or filter combinations should also be hidden.
More filters are not always better.
A dashboard might technically allow somebody to filter Location, then Department, then Level, then Tenure until only one or two people remain. FUSIONscore™ should not treat that as useful analytics.
The reporting system should limit or suppress combinations that create identifiable micro-groups. Confidentiality takes priority over an interesting chart.
The person who starts the diagnostic has one special case.
The initiating leader receives their own private Leadership Baseline. They may later compare their own view with eligible company aggregates. That does not mean their individual baseline automatically becomes a shared company result. If a wider leadership cohort does not meet the reporting threshold, shared company dashboards should not expose identifiable individual leadership responses.
What does Q Branch see?
Q Branch may need access to organisational account information and aggregate diagnostic results in order to operate FUSIONscore™ and support client work. Normal Q Branch access should be designed around company-level results, eligible group results, assessment-wave data, participation, company metadata, Leadership Reality Gaps and trend analysis.
Q Branch should not treat employee-response rows as a casual browsing dataset. Any privileged access to raw response information, if ever technically required for support, analysis or legal purposes, should be restricted and controlled.
The final Privacy Notice must describe actual data access and processing accurately.
Why Version 1 does not need an open comment box.
Free text can easily identify a respondent even when the underlying survey is aggregated. A comment such as "Since I took over the Birmingham team last October..." may reveal exactly who wrote it.
For that reason, open employee comments are not required in Version 1. If qualitative responses are introduced later, they should have a separate confidentiality and de-identification design.
What FUSIONscore™ does not promise.
We do not promise that:
- ✕a respondent can never be identifiable under any circumstance
- ✕every group will receive a result
- ✕every filter requested by leadership will be available
- ✕completion status is invisible to administrators
- ✕confidentiality means the absence of all respondent metadata
Instead, FUSIONscore™ should explain the real protections clearly.
USER-FACING COMPANY-DASHBOARD LANGUAGE
RESULT PROTECTED
This group does not currently meet FUSIONscore™'s confidentiality threshold. Invite more participants or view a broader eligible group.
Do not show "N = 2" next to the suppressed group if doing so increases identification risk.
Participant summary.
YOUR RESPONSE
Your individual answers are confidential.
YOUR ORGANISATION
Receives eligible aggregate reporting, not your individual answers.
SMALL GROUPS
Are suppressed.
COMPLETION
Your administrator may be able to see whether you completed the assessment, but not how you answered.
PERSONAL DATA
Is handled according to the FUSIONscore™ Privacy Notice.
Trust produces better data.
People are more likely to give useful answers when they understand what is being collected, why it is being collected, who can see it and where the boundaries sit. FUSIONscore™ should make those boundaries explicit before somebody submits a single answer.