diff --git a/Server/db/MongoDB.js b/Server/db/MongoDB.js
index 1dc26ce2c..ab2d626f4 100644
--- a/Server/db/MongoDB.js
+++ b/Server/db/MongoDB.js
@@ -42,7 +42,9 @@ const insertUser = async (req, res) => {
     }
     const newUser = new UserModel(userData);
     await newUser.save();
-    return await UserModel.findOne({ _id: newUser._id }).select("-password"); // .select() doesn't work with create, need to save then find
+    return await UserModel.findOne({ _id: newUser._id })
+      .select("-password")
+      .select("-profileImage"); // .select() doesn't work with create, need to save then find
   } catch (error) {
     if (error.code === DUPLICATE_KEY_CODE) {
       throw new Error(errorMessages.DB_USER_EXISTS);
@@ -65,8 +67,10 @@ const insertUser = async (req, res) => {
 const getUserByEmail = async (req, res) => {
   try {
     // Need the password to be able to compare, removed .select()
-    // We can strip the hash before returing the user
-    const user = await UserModel.findOne({ email: req.body.email });
+    // PW hash is removed in controller
+    const user = await UserModel.findOne({ email: req.body.email }).select(
+      "-profileImage"
+    );
     if (user) {
       return user;
     } else {
@@ -102,7 +106,9 @@ const updateUser = async (req, res) => {
       candidateUserId,
       candidateUser,
       { new: true } // Returns updated user instead of pre-update user
-    ).select("-password");
+    )
+      .select("-password")
+      .select("-profileImage");
     return updatedUser;
   } catch (error) {
     throw error;