Welltory Care Privacy Addendum

Last updated: November 9, 2026

This Welltory Care Privacy Addendum ("Addendum") supplements Welltory’s Privacy Policy and applies to individuals who evaluate, reserve a place in, enroll in or use Welltory Care, including Care assessment, program selection, onboarding, Community matching, consent, waitlist and enrollment flows, and enrolled Members — in each case to the extent relevant to their stage of participation and the components they use. Care includes support for developing a personal wellness strategy, Community Services and Medical Expert educational guidance, as described in the Welltory Care Terms of Service (the “Care Terms”). This Addendum describes what data Welltory Inc. (“Welltory”, “we”, “us” or “our”) processes for Care, how it is used, who has access and your rights. It prevails over the main Privacy Policy only for the Care-specific processing it addresses. Ordinary App processing, including processing for Premium App features, remains governed by the corresponding provisions of the main Privacy Policy.

Capitalized terms not defined in this Addendum have the meanings given in the Care Terms and Privacy Policy. Document scope and priority are set out in “Document Hierarchy” in Part XIII of the Care Terms.

Data Controller

The data controller for personal data processed under this Addendum:

Welltory Inc.

541 Jefferson Avenue, Suite 100

Redwood City, CA 94063, USA

Email: [email protected]

Data We Collect — Care Data

“Care Data” means personal data processed by Welltory in connection with evaluating, enrolling in, accessing or using Care. It includes the relevant App data used for those purposes, Care-specific inputs and preferences, Care Assessment and Community Matching Data, Enrollment and Access Data, Community Participation Data, Group Case Data, Patient-Reported Outcome (PRO) Data, Research Data, consent records, moderation records and related operational records described below. “Community Data” is the subset relating to Community assessment, matching, participation, moderation and optional Community programs.

Different categories are collected at different stages and for the components you use, under the legal bases identified below. Enrollment in Care or a particular Care Program does not itself authorize a new health data purpose, a group case or research use. Care Data does not include information you provide directly to the Community platform provider outside Welltory-operated features, which is governed by that provider’s own privacy policy. References to Care Data or Community Data apply to the categories relevant to the stated purpose.

Care Assessment and Community Matching Data

To assess whether Care or a selected Care Program may be relevant for you, establish your Care starting profile, support development of your personal wellness and pacing strategy, support Community matching or cohort placement, personalize onboarding and educational features, and document the applicable health data processing consent, Welltory may process:

Data you have entered manually — including self-reported conditions, symptoms, health goals, health experiences, and related context you choose to provide in the App;
Data collected through your authorized connected sources — including HRV patterns, sleep data and activity data imported from Apple Health, Google Health Connect or other connected apps and devices, as described in the main Privacy Policy;
Responses you provide through Care assessment, program selection, matching, consent, waitlist or enrollment flows, including the required introductory onboarding questionnaire;
Responses you provide through Energy Profile-related questions or features, where you choose the “Find people like me” or similar Community option and consent to Community matching; and
Records of the consents, acknowledgments and choices you make in connection with Care and its components.

This processing is not a medical assessment, clinical evaluation, diagnosis or treatment recommendation. It supports Care and Community Services as described in this Addendum and the Care Terms.

Legal basis: Your explicit consent for health data processing, and contract performance for non-health data necessary to manage enrollment, access and your Subscription. We obtain the applicable consent before processing health-related onboarding responses or existing App data for an additional Care purpose. An existing App consent covers a Care purpose only to the extent that purpose is within its disclosed scope. A valid Community invitation is sent only after the required onboarding and applicable consent steps are complete and the selected program has opened and access is available, as described in Part III of the Care Terms. Payment, acceptance of the Care Terms or acknowledgment of this Addendum does not itself provide the required health data consent.

Enrollment and Access Data

When you enroll in or reserve a place in Care, Welltory processes data needed to manage your Subscription and access, including the selected Care Program, reservation or waitlist status, applicable offer and renewal price, Opening Date, onboarding completion, Subscription and component access status; payment confirmation or failed-payment status received from processors; grace-period dates, cancellation and refund records; cohort placement and Platform permissions; consent and notice versions and dates of consent or withdrawal; invitation dispatch and reminder records, Invitation Date, Care Access Date, Billing Start Date, scheduled renewals and applicable refund deadlines; and related support communications. Where access or a material component ends or is materially reduced, we also record the relevant notice, replacement or revised offer, any express agreement to continue and the resulting renewal, refund and access instructions.

Legal basis: Contract performance for non-health Subscription and access administration; legal obligations where applicable; and the applicable explicit consent for health data. Limited consent and withdrawal records may be retained as necessary to implement your choice and demonstrate compliance, subject to the safeguards and retention rules below.

Personal Wellness Strategy

We process the Care assessment responses, relevant existing App data and preferences needed to support development of your personal wellness and pacing strategy. The categories and sources of those data are described under Care Assessment and Community Matching Data above. Ordinary collection of App data and operation of Premium App features are governed by the main Privacy Policy.

Routine App use does not automatically enroll you in an optional PRO series, group case or research study. Using Care does not itself publish your private data to the Community or give Medical Experts access.

Legal basis: The applicable explicit consent for health data processing for Care. Ordinary App collection, technical records and retention remain governed by the main Privacy Policy.

Community Participation Data

During your participation in the selected Care Program’s Community and educational activities, we process:

posts, comments, messages, questions, files and other content you publish in Community spaces or submit in Care educational activities, including AI output or conversation excerpts you choose to share;
your participation in group Q&A sessions and educational events;
your reactions, votes, and interactions with other members’ content;
records of optional programs you choose or consent to participate in; and
moderation-related records (warnings issued, content removed, appeals).

Legal basis: Contract performance for operating the Community component you requested and legitimate interests in Community safety and integrity and preserving the continuity and context of existing Community discussions, including after an author’s participation ends. Where the content includes health data, the applicable explicit health data consent is required; contract performance or legitimate interests does not replace that consent.

Group Case Data

Within Care, Welltory may form group cases — educational analyses of patterns among Members who separately agree to a particular case. Before each case, we ask for your explicit consent describing the topic, requested data and period, intended use, applicable group-size threshold, de-identification approach and permitted audiences, such as the Community, educational materials, Welltory’s blog or social media. Declining or withdrawing from a case does not affect your Care Subscription or ordinary Care access.

Sharing group case results in scientific or academic publications or on preprint servers, such as medRxiv or bioRxiv, follows the separate research participation process described under Research Data below. Separate research consent is obtained before personal data or de-identified individual-level contributions are included. Where IRB oversight is required or used, an IRB-compliant informed consent is provided. Educational or quality-improvement group cases are shared only with the audiences specified in the case consent.

If you voluntarily consent to participate in a specific group case, we process the health metrics identified in that specific group case consent (e.g., HRV readings, sleep data for a specified date range), a de-identification record (transformation steps only — not the data itself), and your consent record for that case.

De-identification. Before Medical Experts, other Members or an external audience receive group case material, Welltory removes identifying information and aggregates it at group level. Medical Experts do not receive individual-level case records. We also assess re-identification risk, including rare attributes, small subgroups and identifying dates or details, and suppress or generalize information where necessary. Group size alone does not establish anonymity, and merely coded or pseudonymized data are not treated as anonymous.

Minimum group size thresholds vary by intended use, as set out in the table below. We will specify the applicable threshold in the per-case consent you receive.

Use case	Minimum N
Internal educational review by Medical Experts only	N ≥ 7
Sharing within the Community	N ≥ 10
Public educational sharing outside the Community (social media and blog posts)	N ≥ 20

For external publication tracks, Welltory additionally applies removal of all 18 categories of identifiers prior to sharing. Scientific publications and preprint submissions follow the separate research process described under Research Data below; meeting a group-size threshold does not replace that process or any required consent.

Legal basis: Consent, obtained separately for each group case

Patient-Reported Outcome (PRO) Questionnaires

Welltory may offer optional PRO questionnaire series within Care, such as symptom severity scales or quality-of-life measures. These may collect symptom scores, functioning, quality of life, energy, activity tolerance, sleep or related experiences specified in the questionnaire notice. Participation and withdrawal are voluntary and do not affect your Care Subscription or ordinary Care access. Routine App entries remain governed by the main Privacy Policy and are distinct from a separately offered PRO series. For other optional surveys or educational activities, the relevant notice describes the data requested, purposes, audiences and any additional consent. Input needed for a particular feature does not make participation in an optional program a condition of Care.

Legal basis: Consent

Research Data

Anonymized and Aggregated Insights. Welltory may use genuinely anonymized and aggregated Care data, from which no individual can be identified, for internal product improvement, quality improvement, service analytics, feature development and educational materials. Processing personal data before anonymization still requires an applicable legal basis, including explicit consent where required for health data. Formal research uses remain subject to the research process below.

Research Data. Formal research studies, scientific or academic publications, preprint submissions and other formal research involving Care-derived datasets follow the separate research participation process in Part VI of the Care Terms. Before including personal data or de-identified individual-level contributions, we obtain separate research consent. Where IRB oversight is required or used, we provide an IRB-compliant informed consent form. The study materials describe purposes, data, how data will be used and protected, risks and benefits, publication, any compensation, how to ask questions and withdrawal. Research participation and withdrawal do not affect your Care Subscription or ordinary Care access.

Legal basis: Explicit consent for research involving personal data or de-identified individual-level contributions; no consent required for data that is already anonymized and no longer identifiable.

How We Use Your Data

We use Care Data for the following purposes:

Care assessment, Community matching, recommendation and cohort placement. We use Care Assessment and Community Matching Data to assess whether the selected program may be relevant, establish your Care starting profile, recommend a Community, place you in a cohort or group, or place you on a waitlist where no suitable program or cohort is available.

Care enrollment, access and Subscription management. We use Enrollment and Access Data to manage your Subscription, verify payment status, grant or remove Care access, assign Community roles or cohorts, maintain consent records and provide support. Invitation and related records are used to administer the paid term, renewal schedule, payment grace period, cancellation and refunds under Part III of the Care Terms, including notices, stopping renewals and recording any express agreement to a revised offer where applicable. The actual billing and refund rules remain in the Care Terms.

Personal wellness strategy. We use your Care assessment responses, preferences and relevant existing App data to support development of your personal wellness and pacing strategy. Personalization concerns wellness information and use of Care; it does not provide individual diagnosis or treatment.

Operating, personalizing and improving Community Services. We use Community Data to operate the Community component of Care, maintain published discussions and their context after an author’s participation ends, deliver educational content and Community updates, including updates in the App where offered, facilitate group Q&A, personalize onboarding and educational features, understand engagement and improve the Community experience. Topics prepared for Medical Experts do not identify individual Members.

Safety and moderation. We monitor Community channels to detect prohibited content and crisis signals, to protect the safety of all members, and to enforce Community Guidelines.

Group cases. Where you separately consent, we use your health data to generate anonymized, aggregated group case reports for educational purposes.

Research. With your separate consent, as described above, we may use your data for research and scientific publication.

Analytics. We share relevant Care activity data with service providers for analytics as described in the main Privacy Policy, under Data Processing Agreements restricting their use to our instructions and agreed purposes. Health-related data remain subject to the applicable health data consent and safeguards; labeling activity as analytics does not remove those protections.

Use of anonymized and aggregated data. We may use genuinely anonymized, aggregated Care data to improve Care and the Welltory App, develop features and prepare educational materials. Processing personal data before anonymization remains subject to the applicable legal basis and health data consent. Formal scientific or academic publication and preprint submissions follow the separate research process described above.

Processing identifiable App or connected-source health data, Care-specific inputs and preferences, self-reported health information, health-related assessment and matching data, group case contributions, PRO responses and research contributions is based on your explicit consent where required. Non-health participation and access records may also be processed as necessary to operate Care, perform our contract, maintain safety and integrity, comply with law, resolve disputes or enforce agreements. Consent screens distinguish health data processing necessary to provide Care, including Community participation, from separately consented optional programs. Separate marketing choices remain governed by the main Privacy Policy.

Optional personalization of communications and offers. We may use Care health data to infer characteristics for personalizing Welltory’s own communications and offers only with your separate, explicit consent and subject to the health-data and advertising restrictions in the main Privacy Policy and any restrictions imposed by the relevant data source. This does not authorize health-data advertising audiences or disclosure of Care health data to advertising partners.

Genuinely anonymized data are not personal data. Preparing them from personal data still requires an applicable legal basis. Declining or withdrawing from optional group cases, PRO series, surveys or research does not affect your Care Subscription or ordinary Care access. Your choices and the consequences of withdrawing consent for a particular component are described under Your Data Privacy Rights below.

How We Disclose Your Data

We do not sell your Care Data or share Care health data for cross-context behavioral advertising. We disclose Care Data only as described below.

Medical Experts. In their Care role, Medical Experts do not have access to the Community Platform, including its channels, posts, messages or Member profiles. Welltory provides them only de-identified, aggregated group-level material for educational review. They are not given access to individual App records, personal pacing records, dashboards, individual reports, connected-source history, support messages or external AI conversations. Welltory collects and screens Member questions and prepares de-identified, aggregated themes before providing them to Medical Experts. Welltory shares the experts’ educational responses with the group; experts do not receive identifiable Member questions or individual case material.

Other Members. Other participants may see the questions, posts and content you choose to publish in their Community spaces and group-level reports shared with that audience under the relevant notice. Your private App data and personal strategy inputs are not automatically made available to other Members. Authorized Welltory personnel and providers process data needed to operate Care, support you and handle privacy or safety matters under the safeguards in the main Privacy Policy.

Community AI Features

Welltory uses artificial intelligence to support two core functions within the Community: facilitation and moderation. Both functions are powered via the OpenAI API — OpenAI OpCo, LLC (Privacy Policy) and Claude API — Anthropic, PBC (Privacy Policy) — under Data Processing Agreements that prohibit OpenAI and Anthropic from using Community Data to train or improve their models.

Moderation AI processes only the text content of messages posted to Community channels, together with minimal metadata (timestamp and channel identifier, but not member display names or profile data). No member’s individual App health data (such as HRV readings, sleep metrics, or activity data) is transmitted to AI providers for moderation purposes. However, if you include identifying or health information in a Community message, that information may be processed as part of the message content.

Facilitation AI receives only de-identified, aggregated group case material meeting the applicable safeguards and minimum group-size threshold. It does not receive individual Members’ identifiable App or Care records for that purpose. AI providers do not retain Community Data beyond the retention period specified in our Data Processing Agreements. The AI does not provide medical advice or make binding decisions autonomously — see Human Oversight below.

Community facilitation. Facilitation AI assists with structured summaries of the de-identified, aggregated material described above for educational review by Medical Experts. It does not give experts direct access to Community channels or individual records.

Content moderation. Community channels are monitored by an AI-assisted moderation system that may detect crisis signals and display automated crisis-resource messages, including local emergency guidance where available and U.S. resources such as 911 and 988 where applicable; detect and flag prohibited content for human review; and apply or suggest required disclaimers or labels where appropriate. Where AI-generated messages are published in channels — such as crisis resource prompts — they are clearly identifiable as automated responses, not communications from a human.

Human oversight. AI flags and moderation actions are reviewed by human moderators before any enforcement action is taken against a member. No member’s access to Community Services is restricted solely on the basis of an automated decision. If you believe a moderation action was taken in error, you may contact [email protected] to request a review.

Limitations. AI moderation is designed to support — not replace — human judgment. The system may occasionally miss content that should be flagged, or flag content incorrectly. Welltory does not guarantee that all harmful or prohibited content will be detected and removed.

Community Platform

The Community Platform is identified for your selected Care Program. We identify the provider and provide relevant privacy information before you participate on that Platform. Where Discord (Discord Inc.) is used, it processes Discord account information, Community messages, files, interactions, device information and related platform activity under Discord’s own Terms of Service and Privacy Policy. In some circumstances, it may also process data on Welltory’s behalf under the relevant contractual arrangements. The Platform does not receive your private App data merely because you hold a Care Subscription.

Welltory does not control Discord’s independent processing of your Discord account data or platform-level activity. Discord’s privacy practices, data retention, deletion tools, and account controls are described in Discord’s Privacy Policy and related documentation.

Important: Where your Community is hosted on Discord, Community messages and files are transmitted to and stored on Discord’s servers. Moderation, facilitation and support may also involve processing by Welltory and its providers as described above. Do not post personally identifiable medical information in Community channels, including medical records, insurance or government identifiers, prescription details, lab reports, identifying photos or unredacted App or AI screenshots. Use a pseudonym where possible. Contact [email protected] if you accidentally share such information.

Your Community content after leaving. When your Community participation ends, you lose access to that Community, including past messages and other content. Your posts, messages, comments, questions, files and other content published there stay in the Community and remain visible to other Members with access to the relevant spaces. Leaving the Community or cancellation, expiry or termination of your Care Subscription does not automatically delete that content or withdraw your consent. We keep this content available to preserve useful discussions and their context, subject to the consent, retention limits and privacy rights described in this Addendum. Content may also be removed under the Community Guidelines.

Deletion requests. You can request deletion of your Community content or personal data in Community discussions by emailing [email protected], including after you leave or lose access. We handle requests in accordance with applicable law, including any required deletion or genuine anonymization of personal data. A request limited to specific content does not itself cancel your Care Subscription or delete your App account.

Platform copies and coordination. Where Discord is used, its independently held copies and account-level records remain subject to its own Privacy Policy and deletion tools. Requests concerning Discord’s independent processing may also need to be made directly to Discord. For data processed on Welltory’s behalf, we coordinate with the Platform and other providers and handle recipient notifications where required by law. Any Platform migration and advance notice follow Part VII of the Care Terms; relevant privacy information is provided before your participation on another Platform.

Other Service Providers

We share Care Data with service providers, such as analytics, infrastructure and customer support providers, acting on our behalf under the arrangements described in the main Privacy Policy. These arrangements restrict use to the agreed purposes and prohibit use for providers’ own commercial purposes.

Legal Disclosures

We may disclose your data if required to do so by law, court order, or governmental authority; to protect the rights, property, or safety of Welltory, our members, or others; or in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any material changes to data handling.

Security and Data Retention

Welltory applies the technical and organizational security measures described in the main Privacy Policy to all Care Data, including but not limited to encryption in transit and at rest, role-based access controls, vulnerability management, and annual external audits.

Community-specific considerations: Where your Community is hosted on Discord, messages and files shared in Community channels are transmitted to and stored on Discord's servers, and are subject to Discord's own security practices in addition to Welltory's. Content processed by the OpenAI API and Claude API for moderation and facilitation purposes is transmitted over encrypted connections under contractual data protection obligations. Welltory does not store the outputs of AI moderation beyond what is necessary for safety and compliance purposes.

While we take these measures seriously, no system is entirely immune from security risks. We cannot guarantee that unauthorized access, disclosure, or loss will never occur. You can reduce risk on your end by using a strong, unique password, enabling two-factor authentication on your account, and not posting personally identifiable medical information in Community channels.

We retain Care Data, including published Community content, program selection, reservation, onboarding, consent, invitation, activation, access, Subscription, failed-payment, service-change, revised-offer acceptance, cancellation and refund records, only as needed to provide the relevant services, administer access and your choices, demonstrate compliance, comply with law, resolve disputes or enforce agreements. Published Community content may remain after its author leaves for as long as needed to preserve existing discussions and their context, subject to deletion requests, applicable consent and other privacy rights. We delete or genuinely anonymize data when no longer needed. Withdrawal stops processing based on that consent; the affected data are deleted or genuinely anonymized unless limited retention is independently permitted for a separate purpose described here or in the main Privacy Policy, with any additional conditions and safeguards required for health data.

Care Assessment and Community Matching Data. If you complete an assessment, matching, waitlist or enrollment flow but do not subscribe, these Care-specific data are deleted or anonymized within 90 days after your last interaction with that flow, unless we have a legal basis or obligation to retain them longer. This does not delete source App data independently retained under the main Privacy Policy.

You may request deletion of your Care Data at any time by contacting [email protected]. Lawful retention limits are explained above. Finalized, genuinely anonymized reports may not permit removal of individual contributions where those contributions can no longer be identified or recovered. Identifiable or merely pseudonymized data remain subject to applicable rights and retention limits.

Expiry or termination of Care, closing a program, or restricting Community access does not by itself withdraw every consent or delete underlying App entries, measurements or history. A Care-only deletion request applies to the data and processing in its scope; data still needed for independently authorized App features remain governed by the main Privacy Policy. You may request their deletion as well.

Your Data Privacy Rights

You have the following rights in relation to Care Data, in addition to all rights described in Welltory’s main Privacy Policy. Additional rights may apply depending on your jurisdiction — see the jurisdiction-specific sections below.

Right to Access. You may request a copy of the personal data Welltory holds about you in connection with Care, including relevant Care assessment and matching data, personal strategy inputs, enrollment and access records, Community participation data, group case consent records and contributions, PRO responses and research participation records, depending on your involvement.

Right to Correction. You may request correction of inaccurate Care Data, including relevant profile or matching data, Care-specific inputs, PRO responses and participation records. You may update certain information through available App or Community controls; for other corrections, contact [email protected].

Right to Deletion. You may request deletion of your Care Data, including Community posts, messages, comments, questions and files, subject to the retention and de-identification limits described above. A request limited to Community Data does not itself request deletion of independently processed App data or your Energy Profile. You may also request deletion of the underlying App data through the main Privacy Policy’s procedures.

Right to Data Portability. You may request a machine-readable export of your Care Data where applicable.

Right to Withdraw Consent. You may withdraw your Care health data consent or consent for an optional program through available feature controls or by contacting [email protected]. Withdrawal does not affect the lawfulness of earlier processing. Its practical effect depends on the consent withdrawn:

Care health data consent (including Community): We stop processing based on that consent and end access to Care, including its Community. Your Care Subscription, if any, ends and future renewals stop under Parts III and VIII of the Care Terms. Refunds are governed by Part III. This does not by itself delete your App account or withdraw consent to independently provided App features. Withdrawal of consent for the core Welltory Service has the account and data consequences explained in the main Privacy Policy.
Group case consent (per case): Withdrawal applies prospectively as described in the consent and applicable law. Finalized, genuinely anonymized reports may not permit removal where individual contributions are no longer identifiable or recoverable. Identifiable or merely pseudonymized contributions remain subject to applicable rights. Withdrawal does not affect your Care Subscription or ordinary Care access.
PRO questionnaire consent (per series): Withdrawal closes participation in that series and does not affect your Care Subscription or ordinary Care access. The same principle applies to other optional surveys or educational activities, as described in the relevant notice.
Research consent (per study): Withdrawal applies prospectively under the study consent and applicable law. Finalized, genuinely anonymized analyses, publications or outputs may not permit removal where individual contributions are no longer identifiable or recoverable. Identifiable or merely pseudonymized data remain subject to applicable rights and lawful retention limits. Withdrawal does not affect your Care Subscription or ordinary Care access.

Subscription terms and privacy requests. Billing, renewals, cancellation, access and refunds are governed by the Care Terms. Cancelling a Subscription, receiving a refund or ending access does not by itself withdraw consent or request deletion. A request limited to one component is not treated as a request to delete all Welltory data. To exercise Care privacy rights, contact [email protected]. If the scope of your request is unclear, we may ask for clarification so that it is applied correctly.

Right to Human Review of Automated Decisions. Where an AI moderation system has contributed to an enforcement action against you (such as content removal or access restriction), you have the right to request that the decision be reviewed by a human moderator. To exercise this right, contact [email protected] with a description of the action you wish to have reviewed.

California Residents (CCPA/CPRA). Care health data, including health-related assessment and matching data, participation content and group case contributions, constitute Sensitive Personal Information under CCPA/CPRA and are processed under the applicable explicit consent. You have the right to limit use of your Sensitive Personal Information as applicable under CCPA/CPRA. To exercise California privacy rights, including access, correction, deletion, portability or limitation of Sensitive Personal Information use, contact [email protected] with the subject line “California Privacy Request — Care.” We acknowledge and respond to requests within the time limits required by applicable law, as described in the main Privacy Policy. Welltory does not sell your Care health data or share it for cross-context behavioral advertising. Optional personalization of Welltory communications and offers is subject to the separate consent and restrictions described under How We Use Your Data above.

EEA, UK, Switzerland, and Other Non-U.S. Residents

If you are located in the EEA, UK, Switzerland or another jurisdiction with privacy rights applicable to Care, you may have additional rights under applicable law, including access, correction, deletion, restriction, objection, portability, withdrawal of consent and the right to lodge a complaint with a supervisory authority.

Where Care Data includes health data or other special-category data, Welltory processes it based on your explicit consent where required by applicable law, only for the purposes described in this Addendum and the relevant notice. Non-health data may be processed for contract performance, legitimate interests or legal obligations as described above and in the main Privacy Policy.

Welltory Inc. is located in the United States. If your personal data is transferred from the EEA, UK, Switzerland, or another jurisdiction to the United States or another country that may not provide the same level of data protection, Welltory uses appropriate safeguards where required by law, such as Standard Contractual Clauses, data processing agreements, and supplementary security measures.

Changes to This Addendum

Welltory may update this Addendum from time to time. We indicate the date the last changes were published. If changes are significant, we provide a more prominent notice as required by law, such as by email or through Care, the App or the Community. Publishing an updated Addendum, changing a program or adding a feature does not authorize a new or expanded purpose requiring consent; we obtain the required consent before that processing starts. Program-specific notices and consents apply only to the relevant optional program and cannot authorize unrelated processing or override rights under the Care Terms.

Contact Us

If you have questions, concerns, requests or complaints about this Addendum or processing in connection with Care, contact [email protected]. To help us route your request, include “Welltory Care Privacy Request” in the subject line.