The privacy first financial wellness pilot checklist

Define the buying decision before building a report

Start with one sentence: after three months, what would justify continuing, changing or stopping the program? An initial decision should ask whether the service is accessible, explanations are understandable, relevant next steps are useful and delivery is dependable. Retention, productivity and healthcare savings are longer-chain hypotheses, not automatic results of a successful launch.

Distinguish general research, vendor results and your own pilot. Randomized research on two human financial-coaching programs found improvements in selected financial outcomes, with differences between sites. That supports careful evaluation, not an assumption that MoneyBadger's digital coaching produces the same effects. Urban Institute's financial-coaching evaluation (opens in a new tab).

Write the privacy boundary in plain English

Employees need to understand what the provider sees, what the sponsor sees and what happens after the pilot. Security and privacy differ. NIST notes that ordinary data processing can cause privacy harm without a cybersecurity incident. A secure system can still disclose more than an employee expected. NIST Privacy Framework overview (opens in a new tab).

Set four boundaries before enrollment. First, collect only information needed for the agreed participant experience. Do not request financial histories merely because a dashboard could display them. Use synthetic data when testing configuration, calculations and employer-specific rules.

Second, separate eligibility administration from financial activity. Establishing who is covered should not give the sponsor access to questions, balances, debts, transactions, documents, selected financial actions or financial-health measures. Managers should not receive participation lists or risk flags. Put restrictions on employment, performance, disciplinary and credit-related uses in the agreement.

Third, define a narrow sponsor report. Allow only agreed service-delivery information, such as aggregate activation and use, access reliability and consent-safe product feedback. Exclude financial-well-being scores, stress responses, financial-status summaries and their aggregates. Suppress small groups and prohibit granular filters. A threshold such as ten is only a starting point, not an anonymity guarantee; repeated reports can also reveal individuals.

Fourth, specify retention, deletion, access controls, subprocessors, AI-provider data handling and incident response. Explain whether any data can train models. Distinguish anonymous feedback from coded longitudinal records. Matched baseline and follow-up responses require a linkage mechanism unless independently anonymized; they should not be marketed as fully anonymous.

Keep service metrics separate from private progress

Agree event definitions and denominators before launch. Invitation, activation and meaningful use differ. A login does not prove improved financial health. A suggested action is not a completed action. Sponsor metrics should describe the delivery of a useful service, not employees' financial condition.

• Reach: aggregate eligible, invited and activated counts, with clear denominators and suppression rules.
• Use: agreed generic service-use events, without financial topics, document contents or individual histories.
• Delivery: access reliability, support response times and correction handling, using de-identified operational information.
• Usefulness: optional product-experience feedback with explicit consent and no financial-status questions in sponsor reporting.
• Private progress: participant-selected actions and personal assessments stay with the participant and are excluded from employer reports.

The CFPB offers a researched Financial Well-Being Scale and scoring guidance. If offered, it should be an optional participant-private tool using the official instrument, not a branded lookalike. Neither individual nor aggregate results belong in the sponsor dashboard. Taking it, skipping it or declining follow-up must not affect service access or continuation. CFPB scale and scoring materials (opens in a new tab).

Any study of financial outcomes should be separately governed, independently controlled research with specific informed consent and a defined protocol. It is not a routine employer-reporting feature. Before-and-after change alone cannot isolate causal impact: voluntary participation, missing follow-ups, pay changes, seasonality and other benefits can all affect results. A research plan must address those limits without opening private financial-health reporting to the employer.

Use three months to test usefulness and readiness

Before day one, agree the population, participant notice, support routes and privacy terms. Demonstrate the product with synthetic profession-specific scenarios. MoneyBadger is a digital profession-aware coach without a built-in human adviser. AI supports document reading and text processing; server-side deterministic rules and templates produce coaching. Do not present it as free-form AI financial advice or promise human escalation that does not exist.

Make launch contingent on resolving material gaps. Do not assume bank or payroll connections, live sponsor reporting, enterprise billing or security certifications are operational. Specify a safe interim method only if it meets the agreed scope and privacy requirements.

In month one, test whether employees understand the invitation and can reach a useful first experience. Fix access problems before interpreting low use as disinterest. In month two, review operational support themes and quality issues, using synthetic reproductions for calculation errors. Never put a participant's financial situation into a sponsor update. Pause affected functionality if an error could cause harm.

In month three, review service usefulness and readiness against the original buying criteria. Report unfavorable findings as clearly as favorable ones. Optional surveys should not become access gates. Agree continued access, applicable export and deletion arrangements. Useful learning can justify a revised pilot without justifying immediate workforce-wide rollout.

Make the procurement checklist the launch gate

• Confirm the exact service, coaching architecture, limitations and available support routes.
• Distinguish live features, configuration work and proposed capabilities.
• Approve the data map, permitted uses, sponsor exclusions and reporting suppression rules.
• Request security evidence appropriate to the data; do not assume certifications.
• Protect voluntary participation and service access regardless of survey answers.
• Agree delivery measures, definitions and continuation or stop criteria.
• Document fees, renewal terms, participant exit and deletion responsibilities.

For any vendor outcome claim, ask for the funder, methods, comparison group, exclusions and limitations. Vendor-funded or vendor-reported evidence can inform a decision; it does not remove selection bias or guarantee your result. Retention and financial-return estimates remain exploratory without stronger evidence.

Proposed commercial pilot: 100 covered pilot seats for a three-month term with agreed start and end dates, at $1,000 per month ($3,000 total). Participation is voluntary; covered seats are not a promise of 100 active participants. Any later program is separately contracted at $10 per covered employee or union member per month, regardless of adoption or usage. No automatic pilot renewal or conversion. Scope, supported coverage, launch arrangements and reporting terms must be agreed; enterprise billing, payroll connectors and sponsor analytics are not assumed to exist.

Next step: agree that bounded pilot and approve its privacy boundary and launch gates before collecting employee financial information. The goal is a credible buying decision, not financial surveillance.

Agree the path to broader coverage before kickoff

Name the next buyer, legal payer and budget owner, scope the next covered population and price, and book 30-, 60- and 90-day decision meetings before kickoff. For a police pilot, involve municipal HR and the budget owner from the outset; expansion to Fire and then other municipal employees needs its own authority, scope and approval. A nursing pilot can progress to broader nursing coverage and then the hospital system. A union can expand only within the population and purchasing authority it actually represents. Expansion is a separate buying decision, not an automatic pilot outcome.