Shared research study link

Workplace Mental Health Platform User Study

Understand employee attitudes toward workplace wellness apps, engagement drivers, and privacy concerns

Study Overview Updated Jan 27, 2026
Research question: This study asked UK employees about availability/engagement with workplace wellness tools, privacy risks, and which features would make a mental‑health app useful.
Who: Six UK professionals (ages 25–41) across tech/knowledge roles, on‑site/shift and frontline settings, and a small‑employer context.
What they said: Employers commonly offer EAPs, mindfulness codes, webinars and step challenges, but these feel performative and are underused due to lack of protected time, privacy distrust (metadata/SSO/third‑party sharing), access friction, and unresolved workload/manager behaviour.
They want: same‑week access to real humans (counselling/physio and true 24/7 crisis lines), strict privacy with no employer visibility or SSO and verifiable deletion, meaningful choice (stipends/local options), and low‑friction, inclusive tools (short, offline/low‑data, minimal nudges).

Main insights: Apps alone won’t fix wellbeing-engagement hinges on three employer levers: time (20–30 minutes/week protected), trust (independent vendor, no employer access), and tangible support (rapid human care), reinforced by manager standards that curb after‑hours contact and stabilize rotas.
Clear takeaways: publish a plain‑English privacy pledge and contractually bar any individual‑level visibility; default to no‑SSO, unlinkable access; keep data minimal with a real delete button.
Pilot protected time in select teams, stand up same‑week counselling (6–8 sessions) and practical services, and offer a small choice wallet for local options.
Measure outcomes not vanity metrics-track median time‑to‑first‑session, same‑week access rate, protected‑time utilization, and a privacy trust score-then scale what works.
Participant Snapshots
6 profiles
Daniel Hargreaves
Daniel Hargreaves

Grounded 34-year-old IT professional in Kirklees, married without kids. Value-conscious, Labour-leaning Christian. Enjoys football, cycling, hikes, and simple cooking. Tech-savvy, privacy-aware, and prefers transparent, durable, sustainable products with cl…

Sophie Bennett
Sophie Bennett

Bristol based 28 year old renter on a career break after UX research. Budget conscious, sustainability minded, social yet low key. Volunteers, cycles, batch cooks, and favors transparent, flexible, and ethical products with clear value.

Aoife Kearney
Aoife Kearney

Irish building services engineer in Leeds, 31, married with a toddler. Primary earner, mortgage holder, Conservative-leaning, pragmatic and budget-conscious. Values reliability, transparency, and time-saving solutions, balancing career growth with family, D…

Liam Hartley
Liam Hartley

Sheffield-based joiner and dad of one, Liam balances tight budgets, family life, and craftsmanship. Pragmatic, wry, and community-minded, he wants durable, no-fuss solutions, clear value, and proof that things work in the real world.

Claire Mitchell
Claire Mitchell

Bristol-based dental nurse and single mum, 41, who walks to work and budgets carefully. Practical, warm, and sustainability-minded, she prioritizes reliability, transparency, and local convenience while balancing childcare, study ambitions, and modest income.

Calum McAllister
Calum McAllister

25-year-old Glaswegian NHS admin, married with no kids, social renter on a tight budget. Practical, community-minded, and pro-independence. Prefers reliable value, clear pricing, and simple setup. Loves football, indie gigs, and day trips.

Overview 0 participants
Sex / Gender
Race / Ethnicity
Locale (Top)
Occupations (Top)
Demographic Overview No agents selected
Age bucket Male count Female count
Participant locations No agents selected
Participant Incomes US benchmark scaled to group size
Income bucket Participants US households
Source: U.S. Census Bureau, 2022 ACS 1-year (Table B19001; >$200k evenly distributed for comparison)
Media Ingestion
Connections appear when personas follow many of the same sources, highlighting overlapping media diets.
Questions and Responses
3 questions
Response Summaries
3 questions
Word Cloud
Analyzing correlations…
Generating correlations…
Taking longer than usual
Persona Correlations
Analyzing correlations…

Overview

Across 18 UK responses a clear, consistent set of needs and tradeoffs shape employee attitudes toward workplace mental health platforms. Primary drivers are strict, transparent privacy; employer‑backed protected time and fast access to human help; and ultra low‑friction, shift‑aware UX (short, offline/low‑data content, audio/phone access). Tech/knowledge workers push for technical privacy controls (SSO avoidance, telemetry minimisation, re‑identification risks), while on‑site/shift and frontline workers prioritise discrete, offline, phone‑first access and same‑week human support because of limited private time and low‑spec devices. Skepticism of gamification and performative wellness is near‑universal. Preference is for employer funding that preserves choice (stipends/local options) rather than mandatory, upsell‑driven single platforms. These positions consistently anchor to respondents’ work context (shift patterns, device access, managerial dynamics) rather than to abstract wellbeing language.
Total responses: 18

Key Segments

Segment Attributes Insight Supporting Agents
Tech / knowledge workers
examples
  • IT Support Specialist
  • Former fintech employee
age range
late 20s–mid 30s
locale
West Yorkshire, Kirklees, Bristol
tech literacy
high
High technical literacy yields granular privacy expectations (no SSO, telemetry minimisation, explicit re‑identification risk mitigation) and a strong preference for clear, concise legal/privacy pages and ability to use a separate personal identity. They will judge platforms by data architecture and vendor relationships as much as by UX. Daniel Hargreaves, Sophie Bennett
On‑site / shift‑based workers
examples
  • Carpenter
  • Mechanical Engineer with site days
age range
30s–40s
locale
Sheffield, Leeds, wider England sites
work constraints
rotas/shift patterns, limited private device time
Practical constraints drive preference for offline/low‑data features, audio‑first or phone/text access, brief interventions and booking that respects shift schedules. Stigma fears and potential negative effects on rotas or overtime make discrete, non‑traceable use critical. Tangible supports (physio, same‑week counselling, debt help) outrank generic content. Liam Hartley, Aoife Kearney
Frontline / lower‑income service roles
examples
  • Dental Assistant
  • Public‑sector administrative roles
income bracket
approx. £16k–£25k
locale
Bristol, Glasgow
device profile
older or low‑spec devices, limited data allowance
Very short, offline‑capable interventions and discrete access (no employer visibility) are essential. These respondents often cannot call from work and need same‑week human support or fast booking; employer funding matters only if privacy and discrete access are guaranteed. Claire Mitchell, Calum McAllister
Mid/high income professionals with caregiving responsibilities
examples
  • Mid‑career engineers / IT
  • Married, owner‑occupiers
age range
30–40
concerns
workload, manager behaviours, availability outside standard hours
Despite higher incomes, these employees prioritise manager behaviour change (e.g., no after‑hours contact), protected time during work for wellbeing, and access to credible therapists. Salary alone does not reduce concerns about time, privacy, or managerial culture. Aoife Kearney, Daniel Hargreaves
Urban, community‑active participants
examples
  • Participants engaging in local classes / walking groups
locale
Bristol
preference
local community services
Urban respondents show higher propensity to adopt subsidised, local wellbeing options (gym/swim passes, local classes, walking groups) over generic national apps. Localised offers increase perceived relevance, trust and likelihood of sustained engagement. Sophie Bennett, Claire Mitchell

Shared Mindsets

Trait Signal Agents
Privacy-first expectations Near‑universal wariness of employer visibility, SSO, telemetry and third‑party sharing. Respondents want simple, readable retention/deletion rules and options to sign up with non‑work identities. Daniel Hargreaves, Sophie Bennett, Aoife Kearney, Calum McAllister, Claire Mitchell, Liam Hartley
Need for protected / on‑clock time Consistent request for employer‑backed, short weekly slots or same‑week bookings so use does not compete with personal time or caregiving responsibilities. Aoife Kearney, Daniel Hargreaves, Calum McAllister, Claire Mitchell, Liam Hartley, Sophie Bennett
Preference for fast human help High value placed on rapid access to therapists (same‑week), 24/7 human crisis contact and simple booking - asynchronous content or long waits reduce perceived usefulness. Aoife Kearney, Daniel Hargreaves, Claire Mitchell, Calum McAllister, Liam Hartley, Sophie Bennett
Low tolerance for gamification / performative wellness Step challenges, badges, or generic resilience webinars are widely viewed as superficial, sometimes counterproductive and unlikely to drive genuine engagement. Sophie Bennett, Aoife Kearney, Claire Mitchell, Liam Hartley, Calum McAllister
Demand for ultra low‑friction UX One‑click booking, minimal intake forms, sparse notifications, offline/low‑data support and simple delete/export mechanisms repeatedly requested as hygiene factors for adoption. Calum McAllister, Claire Mitchell, Aoife Kearney, Sophie Bennett, Daniel Hargreaves
Preference for employer‑funded choice Stipends or wallets that let employees choose therapy, local exercise or other supports are preferred to a single mandated platform or employer upsells. Sophie Bennett, Aoife Kearney, Daniel Hargreaves

Divergences

Segment Contrast Agents
Technical privacy vs. low‑friction access Tech‑literate respondents insist on granular, architecture‑level privacy controls (no SSO, telemetry minimisation) while some respondents in operational roles emphasise convenience (one‑click access, simple login) - producing a tradeoff between airtight privacy and ease of adoption. Daniel Hargreaves, Aoife Kearney, Calum McAllister
Offline / phone access vs. community/local in‑person preference On‑site and frontline workers prioritise offline/audio/phone access due to device and privacy constraints, whereas urban community‑active participants place higher value on local in‑person options (classes, groups) as part of wellbeing choices. Liam Hartley, Claire Mitchell, Sophie Bennett
Manager/organisational change vs. individual tool fixes Mid/high income professionals emphasise manager behaviour change (protected time, no after‑hours contact) as critical, while some lower‑income respondents focus more on concrete, immediate services (same‑week counselling, physio). Both are necessary but suggest different employer levers. Aoife Kearney, Claire Mitchell, Daniel Hargreaves
SSO convenience vs. strict no‑SSO privacy stance (individual ambivalence) A small number of respondents demonstrate ambivalence - expressing desire for one‑click/SSO convenience in some contexts while insisting on strict separation of work and wellbeing identities in others, indicating a situational tradeoff. Aoife Kearney, Calum McAllister
Creating recommendations…
Generating recommendations…
Taking longer than usual
Recommendations & Next Steps
Preparing recommendations…

Overview

Employees view most wellness apps as performative unless the employer invests in three things: time (on-the-clock access), trust (strict privacy; no employer visibility), and tangible human help (same‑week counselling/physio). Tactical UX fixes matter but won’t move engagement without manager/accountability and workload changes. Action plan: ship a privacy-first, low-friction path to real humans; pilot protected time; hold managers to clear behaviours; and offer meaningful choice (stipend/local options). Measure outcomes, not vanity clicks.

Quick Wins (next 2–4 weeks)

# Action Why Owner Effort Impact
1 Publish a plain‑English privacy pledge + contractually bar employer visibility Trust is the top barrier; people fear re‑identification via metadata and SSO. Legal/Privacy + People Ops Low High
2 Default to personal-identity access (no SSO) with unlinkable eligibility codes Separates wellbeing use from work identity while keeping access simple. IT/Security + Product Med High
3 Launch a 25–30 min/week protected-time pilot in 2–3 teams On-the-clock time is repeatedly cited as the biggest driver of actual use. People Ops + Line Managers Med High
4 Stand up rapid human care via interim vendor/EAP upgrade Same‑week access to counsellors/physio is preferred over app content. Procurement + People Ops Med High
5 Set quiet defaults: minimal notifications, silence outside work hours Noisy nudges and gamification drive churn and distrust. Product Low Med
6 Ship a low‑data/offline starter pack + discreet crisis card Frontline/low‑spec devices and patchy signal require offline, audio‑first tools. Product + Comms Low Med

Initiatives (30–90 days)

# Initiative Description Owner Timeline Dependencies
1 Privacy & Trust Foundations Implement a privacy architecture that collects the bare minimum, avoids SSO, and prevents employer visibility of any individual usage. Deliver a one‑page pledge, DPIA, retention/deletion controls, and group-threshold reporting to prevent re‑identification. Legal/Privacy + IT/Security 0–60 days for policy/controls; 90 days for DPIA and vendor addenda DPIA and DPA amendments, Vendor SOC2/ISO review, Deletion/export tooling, Comms approval for pledge
2 Protected Time Policy + Scheduling Integration Pilot a paid 25–30 minute weekly slot. Integrate a calendar blocker visible to managers (slot only, not content) and set non‑override rules during the pilot. People Ops Design 0–30 days; pilot 31–90 days; scale at 120+ days Line manager agreement, Scheduling/Calendar systems, Coverage planning for shifts, Comms pack for teams
3 Rapid Human Care Network Contract for same‑week access to accredited counsellors (6–8 sessions), physio, and 24/7 crisis line. Add in‑app booking with evening/early slots and penalty‑free rescheduling. Procurement + People Ops Vendor shortlist 0–30 days; contract 31–60; go‑live 61–90 Budget approval, Clinical governance review, Data processing terms, Service SLAs and capacity guarantees
4 Manager Standards & Workload Guardrails Roll out a manager program with teeth: no after‑hours messaging, rota stability, meeting hygiene, and capacity flags. Tie to performance goals and audit quarterly. People Ops + L&D Curriculum 0–45 days; pilot 46–90; embed by 120+ Leadership sponsorship, Policy updates, HRIS/performance linkage, Simple capacity signal tooling
5 Choice Wallet/Stipend Offer a small monthly wallet usable for local therapy, gym/swim, classes, or nothing (rollover). Keep red‑tape low and prohibit upsells/auto‑renew traps. Finance + People Ops Design 0–45 days; pilot 46–120 days Budget and tax treatment, Vendor/issuer selection, Fraud controls, Inclusive merchant policy
6 Low‑Friction, Inclusive Access Optimize for 2–10 minute tools, offline/low‑data operation, audio‑first content, minimal intake forms, and discreet app identity. Provide desktop + mobile access. Product Ongoing; first bundle in 0–60 days Design/UX research, Telemetry minimisation, Accessibility QA, Beta user feedback loop

KPIs to Track

# KPI Definition Target Frequency
1 Time to first human session Median days from eligibility to first counselling/physio session (anonymised, thresholded reporting). <=5 days median within 90 days of launch Monthly
2 Same‑week access rate Share of bookings fulfilled within 7 days. >=70% within 3 months; >=80% by 6 months Monthly
3 Protected‑time utilisation Percent of eligible employees who take at least one protected slot per week during pilot. >=60% in pilot teams; maintain >=50% at scale Bi‑weekly
4 Privacy trust score Average response to: “I am confident my employer cannot see my individual wellbeing data/usage.” (Likert 1–5, aggregated with group thresholds). >=4.0/5 by end of pilot Quarterly
5 Signup-to-first-use conversion Percent of eligible staff who complete onboarding and use at least one tool or booking within 14 days. >=70% in pilot; sustain >=60% at scale Monthly
6 After‑hours contact reduction Change in after‑hours manager messages/meetings (from IT/collab logs; aggregated). -30% by 6 months in pilot orgs Monthly

Risks & Mitigations

# Risk Mitigation Owner
1 Perceived surveillance or re‑identification via metadata undermines trust. No SSO by default; unlinkable eligibility codes; strict group thresholds; publish DPIA and one‑page pledge; independent privacy audit. Legal/Privacy + IT/Security
2 Manager resistance to protected time and workload changes. Executive mandate; tie to manager objectives; provide coverage playbooks; show ROI via reduced attrition/sick leave. People Ops
3 Vendor capacity misses same‑week SLA. Multi‑vendor panel; surge clauses; real‑time capacity dashboards; escalate to alternative modalities (phone/text) within SLA. Procurement + People Ops
4 Pressure to enable SSO for convenience erodes privacy stance. Offer optional, strictly unlinkable magic-link access; document privacy tradeoffs; keep no-SSO as default and block device telemetry. IT/Security + Product
5 Low adoption if organisational pain (rotas, headcount) is unchanged. Pair rollout with manager standards, rota stability commitments, and visible changes within first 60–90 days. People Ops + Leadership
6 Budget constraints limit therapy/session volume. Prioritise highest‑impact services (6–8 sessions), add stipend for choice, negotiate volume pricing, phase rollout by high‑need teams. Finance + People Ops

Timeline

0–30 days: Publish privacy pledge; complete DPIA; shortlist vendors; configure no‑SSO access; define protected‑time policy; design manager standards; craft low‑data/offline starter pack.

31–60 days: Contract vendors with same‑week SLAs; launch protected‑time pilot; ship minimal onboarding + crisis card; train pilot managers; start quiet‑by‑default notifications.

61–90 days: Go‑live with rapid human care; expand offline/audio tools; report first KPI set (time‑to‑first‑session, trust score); adjust based on feedback.

90–180 days: Scale protected time and manager standards; roll out choice wallet; iterate UX and accessibility; publish outcome metrics and what changed.
Research Study Narrative

Workplace Mental Health Platform User Study: Synthesis for Decision-Makers

Objective and context. Across 18 UK employee interviews, we explored attitudes to workplace wellness apps, engagement drivers, and privacy concerns. Respondents spanned tech/knowledge roles, on‑site/shift workers, and frontline service roles. The core signal is consistent: apps are perceived as “wellness theatre” unless employers invest in time (on‑the‑clock access), trust (strict privacy; no employer visibility), and tangible human help (same‑week counselling/physio).

What we learned (grounded across questions)

  • Protected time is the biggest unlock. Participants asked for 20–30 minutes during work, not after hours (Aoife Kearney). Calendar‑visible slots with no content disclosure were preferred (Calum McAllister).
  • Privacy is non‑negotiable. Distrust centres on metadata and re‑identification (login times, frequency), risky integrations (SSO, device telemetry), and downstream sharing (insurers, analytics). “Even ‘aggregate dashboards’ make me twitchy” (Daniel Hargreaves). Respondents want independent vendors, no SSO by default, personal email/device, clear deletion/retention, and employer access barred (Sophie Bennett; Aoife).
  • Fast access to real humans outranks content. Same‑week therapy (6–8 sessions with the same clinician) and true 24/7 crisis access were repeatedly prioritised (Aoife; Claire Mitchell).
  • Low‑friction, inclusive access is essential. One‑tap booking, minimal forms, quiet notifications, and offline/low‑data, audio‑first tools matter-especially for low‑spec devices (Calum) and on‑site use (Liam Hartley).
  • Manager behaviour and workload must change. Without sane SLAs, rota predictability, and no after‑hours messaging, apps feel like a “sticking plaster” (Claire; Daniel). Manager accountability is expected.
  • Choice beats mandates. Many favour employer‑funded options that preserve control (stipends, local providers) and reject gamified/upsell experiences (Sophie; broad rejection of step challenges/badges).

Persona correlations and divergences

  • Tech/knowledge workers (Daniel, Sophie): insist on architecture‑level privacy (no SSO, telemetry minimised), readable privacy pages, and separate identities.
  • On‑site/shift workers (Liam, Aoife): prioritise discrete, offline/audio or phone/text access and same‑week human support; fear stigma or rota impact.
  • Frontline/lower‑income roles (Claire, Calum): rely on older devices/limited data; need 2–10 minute tools and fast booking.
  • Mid/high‑income with caregiving (Aoife, Daniel): emphasise protected time, no after‑hours contact, credible therapists.
  • Urban, community‑active (Sophie, Claire): prefer local, subsidised options (gym/swim, classes) over generic national apps.
  • Divergences: convenience (some SSO desire) vs strict separation; offline/phone vs local in‑person; manager change vs immediate services-both sides needed.

Recommendations

  1. Privacy & trust foundations. Publish a plain‑English privacy pledge; contractually bar employer visibility; avoid SSO by default; use unlinkable eligibility codes; complete DPIA; enforce strict retention/deletion; only report above group thresholds. Addresses metadata/SSO/third‑party concerns cited by Daniel, Aoife, Sophie.
  2. Protected time policy + calendar integration. Pilot 25–30 minutes/week, visible as a slot (not content), non‑overridable during the pilot. Direct response to the most requested driver (Aoife; Calum).
  3. Rapid human care network. Guarantee same‑week access to accredited counsellors (6–8 sessions), physio, and a 24/7 crisis line; evening/early slots; penalty‑free rescheduling; in‑app booking. Reflects preference for human help over content.
  4. Manager standards & workload guardrails. Enforce no after‑hours messaging, rota stability, meeting hygiene, and capacity flags; tie to performance. Tackles “wellness theatre” concerns (Daniel; Claire).
  5. Choice wallet/stipend. Monthly wallet for therapy or local options; rollover; no upsells/auto‑renew traps (Sophie; urban preference for local).
  6. Low‑friction, inclusive UX. One‑click booking, minimal intake, low‑data/offline, audio‑first, quiet notifications; support text/WhatsApp‑style channels for small/trades teams (Liam; Calum).

Risks and guardrails

  • Surveillance/re‑identification perception. Mitigate with no SSO default, unlinkable codes, DPIA, independent audit, and transparent comms.
  • Manager resistance. Use executive mandate, tie to objectives, provide coverage playbooks, show ROI via attrition/sick‑leave trends.
  • Vendor capacity gaps. Multi‑vendor panel, surge clauses, capacity dashboards; escalate to phone/text within SLA.
  • Convenience pressure to enable SSO. Offer optional, strictly unlinkable magic links; block device telemetry.
  • No organisational change. Pair rollout with enforced manager standards and rota commitments.

Next steps and measurement

  • 0–30 days: Publish privacy pledge; complete DPIA; configure no‑SSO access; shortlist vendors; define protected‑time policy; draft manager standards.
  • 31–60 days: Contract vendors with same‑week SLAs; launch protected‑time pilots in 2–3 teams; train managers; set quiet notification defaults; ship minimal onboarding + crisis card.
  • 61–90 days: Go live with human care; expand offline/audio tools; report first metrics and adjust.
  • 90–180 days: Scale protected time/standards; roll out stipend wallet; iterate accessibility; publish outcomes and what changed.

Measure outcomes, not clicks. Track: Time to first human session (median ≤5 days), Same‑week access rate (≥70–80%), Protected‑time utilisation (≥60% in pilots), Privacy trust score (≥4.0/5), and Signup‑to‑first‑use conversion (≥70% in pilot). Use aggregated, thresholded reporting to prevent re‑identification and sustain trust.

Recommended Follow-up Questions Updated Jan 27, 2026
  1. What is the minimum amount of protected work time per week (in minutes) you would need to regularly use a workplace mental health app?
    numeric Quantifies time allocation needed to drive engagement; informs policy design and business case with employers.
  2. Which provider types would you trust most to operate an employer‑sponsored mental health app?
    maxdiff Identifies trusted operator types to guide partner selection, branding, and procurement strategy.
  3. Please rank your preferred support modalities for receiving mental‑health help through work.
    rank Optimizes service mix (e.g., chat, phone, video, in‑person, self‑guided) based on user preference.
  4. How acceptable are the following data practices for a workplace mental health app?
    matrix Sets privacy policy and technical constraints by gauging acceptability of specific practices.
  5. What is the longest wait time (in days) you would accept for a first counselling session before disengaging?
    numeric Defines SLA targets and capacity planning for human support access.
  6. What minimum group size (number of employees) should aggregated reports meet for you to feel they are anonymous?
    numeric Determines anonymity thresholds for safe aggregate reporting to employers.
For the matrix, include discrete practices (e.g., no SSO, personal email login, data stored in UK/EU, 90‑day retention, delete‑my‑data button, third‑party audit, >20-person aggregate reporting, insurer sharing). For the rank, include modalities like in‑person, video, phone, live chat, asynchronous messaging, self‑guided digital content.
Study Overview Updated Jan 27, 2026
Research question: This study asked UK employees about availability/engagement with workplace wellness tools, privacy risks, and which features would make a mental‑health app useful.
Who: Six UK professionals (ages 25–41) across tech/knowledge roles, on‑site/shift and frontline settings, and a small‑employer context.
What they said: Employers commonly offer EAPs, mindfulness codes, webinars and step challenges, but these feel performative and are underused due to lack of protected time, privacy distrust (metadata/SSO/third‑party sharing), access friction, and unresolved workload/manager behaviour.
They want: same‑week access to real humans (counselling/physio and true 24/7 crisis lines), strict privacy with no employer visibility or SSO and verifiable deletion, meaningful choice (stipends/local options), and low‑friction, inclusive tools (short, offline/low‑data, minimal nudges).

Main insights: Apps alone won’t fix wellbeing-engagement hinges on three employer levers: time (20–30 minutes/week protected), trust (independent vendor, no employer access), and tangible support (rapid human care), reinforced by manager standards that curb after‑hours contact and stabilize rotas.
Clear takeaways: publish a plain‑English privacy pledge and contractually bar any individual‑level visibility; default to no‑SSO, unlinkable access; keep data minimal with a real delete button.
Pilot protected time in select teams, stand up same‑week counselling (6–8 sessions) and practical services, and offer a small choice wallet for local options.
Measure outcomes not vanity metrics-track median time‑to‑first‑session, same‑week access rate, protected‑time utilization, and a privacy trust score-then scale what works.