How confidentiality works
Responses are stored so that completion can be tracked (that's how you chase non-responders), but individual scores are never displayed to admins. The only view an admin ever sees is aggregated group results. Workers are told this clearly at the start of every survey.
Anonymous and identified pathways
ReFresh supports both, depending on how the survey is configured:
Anonymous: the response is recorded against a token, not the person. The system can confirm the survey was completed, but cannot link the answers to a specific individual.
Identified: the response is recorded against the worker's own record (still aggregated for admins, but kept identifiably for that worker's own history).
Either way, admins only ever see aggregates.
The five-response floor
Group-level results are only shown to admins once at least five people in that group have completed the survey. Below five, an admin can see that the survey is in progress but cannot see any scores.
This protects against the small-group identification problem: in a team of three, an "aggregate" would effectively expose each person's individual answers. The same five-response floor applies across all of ReFresh's wellbeing analytics, not just surveys.
Plan your groups so results can display: To get results for a group, make sure it has at least five recipients and enough of them complete the survey to clear the floor. Very small teams may never surface on their own; consider reporting them within a larger parent group. See Getting more survey responses.
What admins can and cannot see
Admins can see:
Aggregated group scores, once the five-response floor is met
Per-group participation counts (completed, in progress, not started)
Trends across surveys over time
Admins cannot see:
The specific answers any one person gave
Any identified score for a single worker
Group scores below the five-response floor