Privacy Policy

Last Updated: October 28, 2025

Introduction

This Privacy Policy (the "Policy") explains how Welltory Inc. ("Welltory", "we", "us", or "our") collects, uses, shares, and protects personal information obtained through our digital platforms and services. This includes our website at welltory.com (the "Website"), the Welltory mobile application available on iOS and Android (the "App"), and any other online services we operate that link to this Policy (collectively with the Website and App, the "Services").

At a Glance

Our Purpose

We process your data to deliver personalized wellness insights, help you track health metrics, and understand patterns in your physiological data. The core functionality of the Welltory Service relies on the analysis of health data you choose to share with us.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

(i) Your consent

We rely on your consent for specific types of data processing:

• Health data processing. Your explicit consent is required for processing health data, which forms the foundation of our Service and enables us to provide personalized wellness insights. The provision of the core Welltory features is only possible with your consent to process health data. You may withdraw your consent at any time; however, doing so will prevent us from continuing to provide the Service, and your account will be deleted, as there will be no legal basis for further processing, subject to minimal data retention required by law.
• Marketing communication. Separately, you may choose to consent to receive marketing communications from us, including partner offers. Withholding or withdrawing your marketing consent will not affect your access to or use of the Service.

(ii) Performance of the contract

To provide and administer the Services you have requested (for example, account registration, subscription processing, and essential communications).

(iii) Our legitimate interests

To operate, secure, and improve the Service (for example, debugging, fraud prevention, security scanning, and reviewing aggregated usage trends), after balancing these interests against your rights, through a Legitimate Interest Assessment (LIA) confirming that such processing is appropriate and does not compromise your privacy.

(iv) Compliance with legal obligations

When required to meet legal or regulatory duties.

Data Sources

We collect information directly from you (manual entries and measurements), automatically through your use of the Services, from health and fitness devices you connect, and from third-party applications you choose to integrate.

Your Rights

You maintain control over your personal information with rights to access, correct, delete, and export your data at any time through the App settings or by contacting us via [email protected].

Our Commitment

We implement robust security measures, never sell your personal data, and never use it for advertising purposes without your consent.

Data We Collect

Data You Provide Directly

Sign up and authentication information (required):

• Email address and password (encrypted) - required when registering through email
• Name and User ID and other data requested within the authentication via Google/Apple/Facebook accounts

Profile information:

• Photo/picture, name/nickname, workplace, date of birth, gender, age
• Gender may be inferred from your usage patterns of certain features (e.g., women's health tracking) or synced via connection of third-party services

Wellbeing and Health Personal Data:

• During registration/onboarding and while using the Services, you may voluntarily provide - and explicitly consent to our processing of - special category personal data related to your health. This includes measurements and data you provide or record through the Services, such as camera-based readings (PPG signals for heart rate and heart rate variability measurements), entries such as weight, height, blood pressure measurements, symptoms, mood and self-assessments, sleep stages and other sleep data, tags/labels, notes, fitness levels, activity and sedentary behavior, workouts and recovery metrics, lifestyle and environmental conditions (e.g., work patterns, productivity, weather, air quality); nutrition and hydration data; women's-health information (e.g., menstrual cycle, ovulation, pregnancy), medical diagnoses or conditions (including but not limited to hypertension, diabetes, cardiovascular disease, respiratory conditions such as asthma or COPD, thyroid disorders, musculoskeletal conditions such as arthritis, and mental-health states like depression or anxiety).

Information from third-party services (including wearables):

When you connect external services (such as Apple HealthKit, Google Health Connect, Strava, Accuweather, RescueTime, etc.) and wearable devices (e.g. Apple Watch, Fitbit, Pixel Watch, Samsung Watch, Whoop, Oura, Garmin, Withings, etc.), with your consent we may receive information about your health, activities, productivity and lifestyle, including but not limited to:

• Vital Signs: heart rate, HRV (heart rate variability), blood pressure, respiratory rate, body temperature, blood sugar, blood oxygen saturation, cardio fitness, ECG, peripheral perfusion index, electrodermal activity
• Physical Metrics: height, weight, body measurements, body mass index, body composition, body water
• Activity Data: steps, active and resting energy, exercise sessions, distance traveled, altitude changes, GPS coordinates (for outdoor activities), recovery metrics, workouts and all workout characteristics, walking heart rate, standing, physical efforts, flights climbed, swimming activity, cycling activity, wheelchair activity, snow sports activity, mobility characteristics
• Sleep Patterns: duration, stages (REM, deep, light), quality metrics, sleep timing, interruptions, snoring, respiration rate in sleep
• Wellness Tracking: stress levels, energy, mood, habits, productivity metrics
• Nutrition Data: Macronutrients: protein, carbohydrates, total fats; Micronutrients: vitamins, minerals (including but not limited to zinc, iron, calcium, etc.); Caloric intake, meal timing, food categories; water intake
• Women's Health: Menstrual cycle tracking, ovulation, pregnancy, sexual activity, basal body temperature, spotting, cervical mucus data, Symptoms (abdominal cramps with severity levels), Related health conditions and patterns
• Skin Health: acne tracking and skin condition monitoring
• Heart Rate Zones: resting, fat burn, cardio, peak zones with time spent in each
• Productivity and lifestyle: devices and applications usage patterns, time tracking, productivity scores and metrics, venue information and visit frequency, social interactions
• External factors: environmental sound levels, headphone audio levels, time in daylight, outdoor and indoor weather, air quality

All integrations of third-party services (including wearables) include: timestamps with zone offsets, recording method flags, version tracking, and source attribution data.

Some integrations (such as Apple HealthKit for iOS devices, and Google Health Connect or Samsung Health for Android devices) are strongly recommended to connect, as they enable the App to receive comprehensive and high-quality health and activity data directly from your devices. While you can use the App without these integrations, certain core features and insights may be limited. Connecting these sources allows Welltory to provide more accurate insights, personalized analytics, and an overall better user experience.

Other integrations and data sources are entirely optional and can be connected at your discretion. Each integration contributes its own unique set of metrics and insights expanding the range and depth of analytics available to you. While not required for the core functionality, these connections enhance the value of your Welltory experience by enabling new types of insights and helping you better understand how different aspects of your lifestyle interact and influence your wellbeing.

Data Collected Automatically

When you access or use the Services we may automatically collect and process certain personal data:

Account & System Identifiers

• User ID and internal identifiers (system-generated)
• Session IDs and authentication tokens
• Integration IDs for connected services
• Sync tokens for cross-device coordination

Device Information

• Hardware model and operating system version (e.g., iOS 17.0, Android 14)
• Device identifiers: IDFA, GAID, UUID, device-specific IDs
• Product type (e.g., iPhone14, Apple Watch 6, Galaxy S24)
• Bundle identifiers (e.g., com.apple.health, com.sec.android.app.shealth)
• Package names for Android applications
• Device manufacturer and model details
• Screen resolution and display characteristics
• Accessibility features enabled

App Usage Analytics & Payment information

• Features accessed with timestamps
• Session duration and frequency patterns
• In-app purchases and subscription events
• Application opens, updates, and first launch times
• Event logs with user interactions
• Performance metrics and crash information
• Push notification tokens and delivery status
• User engagement with specific features
• Payment transaction information (excluding full payment card details)

Network and API Data

• IP address for approximate geolocation
• API request logs with endpoints accessed
• Rate limiting information
• Data transfer sizes and frequencies
• Connection types (WiFi, cellular, bluetooth)
• API version compatibility checks

Cookie Technologies

• Automatic collection of information may be realized with cookies and other similar technologies
• Details available in our Cookie Policy

How We Use Your Data

Depending on the features you use, we process your personal data on: (i) your consent (e.g., for health data processing and marketing communications, including offers of our partners), (ii) contractual necessity to provide and administer the Services (e.g., account management and related administration), (iii) our legitimate interests to operate, secure, and improve the Services (e.g., bug fixing, detecting non-human activity, performance monitoring, subscription communications, security scanning, and reviewing aggregated usage trends) after balancing these interests against your rights, and (iv) compliance with legal obligations.

The table below outlines some of purposes for processing your personal data and the corresponding legal bases:

Purpose	What we actually do (examples) and Legal basis
Core app features & insights	Example: Process health and wellness data - including but not limited to stress, energy, HRV, sleep, activity, recovery, blood pressure, and body composition - whether entered manually or imported from third-party sources (e.g. Apple Health, Google Health Connect, Samsung Health, Garmin, Withings, and other devices and applications user chooses to connect and integrate), to generate personalized insights, visualize trends over time, and help users understand and improve their wellbeing Legal basis: Consent
AI-powered features (AI Chat)	Example: Analyze your questions and contextual data, documents you decided to share, provide general recommendations, not medical advices Legal basis: Consent
Account registration and management, authentication (signing in)	Example: Processing of your email, password, authentication data of your Apple/Google/Facebook accounts for registration and management of your account Legal basis: Contract
Subscriptions & payments	Example: Purchases via App Store, Google Play and other payment providers Legal basis: Contract
Customer support	Example: Respond to tickets, in-app/email support, debugging Legal basis: Contract
Transactional communications	Example: Technical alerts, receipts, subscription expiry/renewal reminders, service messages Legal basis: Contract / Legitimate interest
Security, fraud & compliance	Example: Logs, monitoring, incident investigations, regulator/legal responses Legal basis: Legal obligation / Legitimate interest
Analytics & product improvement	Example: Use of Amplitude, AppsFlyer, Firebase, and Crashlytics/Sentry to analyze app usage, stability, and user flows, helping us understand how users interact with the app and improve its performance. A/B tests to evaluate new features and optimize the user experience while avoiding collection of sensitive health data. Legal basis: Legitimate interest
Attribution & website - app onboarding link	Example: Identify existing users during onboarding (e.g. via AppsFlyer), link sessions Legal basis: Legitimate interest
Personalization & recommendations (non-health)	Example: Tailor content and tips based on app usage, preferences, language Legal basis: Legitimate interest (non-sensitive personalization). Consent required where trackers/cookies are used (jurisdiction-dependent).
Marketing emails & in-app	Example: Onboarding series, newsletters, in-app banners, offers, including partners' offers Legal basis: Consent / Legitimate interest (depending on jurisdiction and channel). Opt-out is always provided.
Push notifications (service)	Example: Measurement reminders, sync prompts, feature updates Legal basis: Legitimate interest with device-level opt-out.
Push for direct marketing / geo-based push	Example: Relevant offers, geo-targeted notifications (if location enabled) Legal basis: Consent / Legitimate interest
User profiling & personalization	Example: Create user profiles based on app usage, preferences, wellness goals, and engagement patterns to: personalize product recommendations and insights; show relevant offers (both Welltory and partner services); improve UX and personalized health insights. Legal basis: Consent (for partner offers and marketing profiling) / Legitimate interest (for service improvement and non-marketing personalization)
Remarketing & ads	Example: Facebook Custom Audiences/Remarketing, Google Ads Remarketing, Lookalike/Ad Manager (no health data used) Legal basis: Consent / Legitimate interest
Research, statistics & de-identification	Example: Aggregate and anonymize metrics for statistics, R&D, publications Legal basis: Legitimate interest (create aggregated/anonymized data, without re-identification attempts).
Cookies & similar tech on web	Example: Functional/analytics/marketing cookies, pixels, web beacons Legal basis: Consent (where legally required, e.g. EU/UK). Legitimate interest may apply for strictly necessary cookies.
International transfers	Example: Transfer data to processors/affiliates outside the user's country (e.g., US). Safeguards include SCCs Legal basis: Legal obligation / Contract / Legitimate interest. Use of SCCs/adequate safeguards as industry best practice.
Technical communication; security alerts; support and administrative messages; and customer satisfaction surveys	Example: To request that you update your App to ensure you have access to the latest features. Legal basis: Contract / Legitimate interest

Device Permissions and Access to Personal Data

To provide you with personalized health insights and app functionality, Welltory may request certain permissions from your device. These permissions allow us to access specific categories of Personal Data.

How permissions work:

• By default, you will be asked to grant access before Welltory can use the related data.
• You can revoke any permission at any time via your device settings.
• Revoking permissions may limit the functionality of the app.

Examples of permissions we may request:

• Health Data: read and update permissions to Apple Health, Google Health Connect, Garmin, Withings, or other connected apps and devices, so we can import and analyze your heart rate, HRV, sleep, workouts, and other wellness metrics.
• Motion & Sensors: access to accelerometer, gyroscope, or heart rate sensors to measure steps, activity type, or physiological signals.
• Location: approximate or precise, continuous or non-continuous, to provide location-based wellness features (e.g., environment and activity context).
• Biometric Data & Authentication: FaceID, TouchID, or similar, used for secure authentication only.
• Camera: to perform HRV measurements via the phone camera or for other in-app functions (without saving images unless explicitly requested by you).
• Bluetooth: to connect with wearables and health monitors.

Platform-specific rules:

• On iOS, Welltory integrates with Apple Health and requests granular read/write permissions for specific data types.
• On Android, we follow Google Play Console's "Health and Fitness" permission rules, requesting only the minimum permissions needed to support app functionality.

We will never access your device data without your consent, and we use these permissions strictly to deliver the services described in this Privacy Policy.

Communications

We may communicate with you through different channels, including email, in-app messages, push notifications, and, where appropriate, through third-party platforms such as social media. These communications may cover both essential service matters and optional updates or offers.

Always Sent

Some messages are necessary for your use of Welltory and cannot be opted out of. These include:

• Account verification, subscription confirmations, and billing updates
• Security alerts, incidents, and legal or policy updates
• Notifications about critical technical issues, such as data synchronization errors or major changes to connected services

Push Notifications

Welltory may send you push notifications to support the functionality of the app (for example, reminders, updates, or alerts) as well as for marketing purposes (such as personalized offers, new features, or relevant content). You can opt out of receiving push notifications at any time by changing the notification settings on your device for Welltory. Please note that disabling push notifications may limit certain features of the app, but you remain in full control of your preferences at all times.

Social Media and Public Platforms

We also engage with users on platforms such as X (Twitter), Reddit, Instagram, Facebook, App Store, and Google Play. When you interact with us on these platforms (for example, by leaving comments, reviews, or sharing posts), we may process the information you make publicly available (such as your username, profile picture, or review content) for the purposes of customer engagement, feedback, and community support. Please note that these platforms process your data under their own privacy policies.

AI-powered features

We use artificial intelligence ("AI"), meaning machine-based systems that analyze input data to generate outputs that may support your experience with our Services. Some of this AI operates behind the scenes (for example, improving product functionality, quality assurance, personalization and tailoring in-app content and insights to your wellness profile). In other cases, you may interact with AI directly through AI-powered features:

• AI Chat – a conversational assistant that helps interpret your health and lifestyle data, explain metrics, and provide personalized insights.
• Megan (AI Customer Support Bot) – an automated assistant that helps answer common product and support questions.
• AI Coach (external feature on the ChatGPT platform)
  • The AI Coach is available as an external feature hosted on OpenAI's ChatGPT platform and is not part of the Welltory App or Services.
  • If you choose to connect your Welltory account to the AI Coach, the connection is established through a secure authorization flow: when you give consent within ChatGPT, you are redirected to Welltory's authorization page, where you explicitly confirm that you allow sharing certain data with ChatGPT. Only after this confirmation does OpenAI receive access to your selected Welltory data via a secure API endpoint.
  • Welltory does not receive or access any of your conversations, messages, or other information you share within ChatGPT. The AI Coach cannot send data back to Welltory - we do not collect, store, or process any content from ChatGPT dialogs.
  • When connected, the AI Coach may access limited wellness information from your Welltory profile, such as height, weight, age, and selected measurement parameters (e.g., HRV, steps, sleep, workouts). Tags or personal notes are not shared.
  • The information you provide or discuss through ChatGPT is processed by OpenAI under its own Terms of Use and Privacy Policy. Welltory does not control or monitor the processing of your data within ChatGPT, and we recommend that you avoid sharing information beyond what you are comfortable disclosing in that environment.

When you use these AI Features, you are informed that you are interacting with AI, not a human, and you always have the choice whether to engage with it.

What our AI does:

• Helps you reflect on your well-being and understand your data.
• Provides personalized content and suggestions to support your health journey.
• Assists with onboarding, navigation, and app functionality questions.
• Supports our customer care team by answering routine questions.
• Processes your interactions (including chat messages) in an anonymized form, with personal identifiers removed, to improve the accuracy and quality of Welltory's internal, non-public language models (LLMs) and provide you with safe and reliable personalized insights, with all such data stored and handled in compliance with applicable laws and security standards.

What our AI does not do:

• Diagnose or treat medical conditions.
• Replace professional medical advice, therapy, or coaching.
• Provide clinical or emergency guidance.

We continuously test and monitor our AI systems to improve safety, accuracy, and user experience. Your privacy remains a top priority: AI interactions may involve processing the data you provide (including health-related data) to generate responses and insights.

Personally identifiable information (such as your name, email address, or other strong identifiers) is not shared by Welltory with AI feature providers (e.g., OpenAI), unless you voluntarily include such information in your message or query.

When you interact with AI features hosted by third-party providers, your prompts and responses may be temporarily stored by those providers for a limited period (for example, up to 30 days) to ensure service reliability, detect misuse, and maintain safety. These providers do not use such data to train or improve their models.

Where technically feasible, Welltory implements Zero Data Retention settings and minimizes the amount of data processed or stored by external AI providers.

Welltory does not sell your data to third parties and ensures that any processing by external AI providers complies with applicable data protection laws and contractual safeguards.

Our Data Handling Principles

We process your personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and relevant U.S. state privacy laws (such as the CPRA, VCDPA, and similar frameworks). Our processing is based on the following principles:

1. Lawfulness, Fairness & Transparency – We process your data only on valid legal grounds (such as your consent, contract performance, or our legitimate interest) and always in a clear, transparent manner. You are informed about the purposes, legal bases, and your rights in an accessible form.
2. Purpose Limitation – We collect your data only for specific, explicit, and legitimate purposes and do not process it for incompatible purposes without your additional consent.
3. Data Minimization – We collect and process only the data necessary to deliver our services and regularly review categories of data to avoid excess.
4. Accuracy – We take reasonable steps to keep your personal data accurate and up to date, and we provide you with mechanisms to correct inaccuracies.
5. Storage Limitation – We keep your data no longer than necessary to fulfill the purposes of processing or comply with legal obligations. After that, we apply secure deletion or anonymization.
6. Integrity & Confidentiality – We use technical and organizational safeguards (encryption, role-based access, monitoring, staff training) to protect your data against unauthorized or unlawful processing, loss, or damage.
7. Accountability and DPIA – We maintain records of our processing activities and conduct regular audits. When processing operations are likely to result in a high risk to your rights and freedoms - particularly in relation to sensitive health data - we conduct a Data Protection Impact Assessment (DPIA). A DPIA allows us to identify and mitigate risks before starting the processing and ensures that your data is handled in compliance with the highest privacy standards.

You have the right to exercise control over your data (including access, rectification, deletion, portability, and objection), as specified in this Privacy Policy. Where international transfers are involved, we apply appropriate safeguards such as Standard Contractual Clauses (SCCs). We never sell or trade your personal data, and your sensitive health data is never shared with data brokers.

Third-Party Services and Data Processors

All our service providers (data processors) are required to implement appropriate technical and organizational measures to protect your personal data. We have executed Data Processing Agreements (DPAs) with all processors who handle personal data on our behalf, ensuring compliance with GDPR.

For data processors located outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), which are incorporated into our DPAs where applicable.

For integrations with independent third-party services (such as Apple Health or Google Health Connect) that you choose to connect, please note that these providers act as separate data controllers. Their collection and processing of your data is governed by their own privacy policies.

Advertising & Remarketing

Vendor / Service	Purpose, Place of processing, Opt-out option and Notes
Meta ads conversion tracking (Meta pixel) (Meta Platforms, Inc.)	Purpose: Connects Meta ads with actions in the app; measures conversions Place of processing: United States Opt out Notes: Helps us see if Facebook/Instagram ads worked. Some tracking technologies may be used.
Facebook Lookalike Audience (Facebook, Inc.)	Purpose: Shows ads to people similar to our audiences Place of processing: United States Opt Out · Facebook opt-out page Notes: Uses Custom Audience signals to "find people like you" across Facebook apps/services.
Google Ads conversion tracking (Google LLC)	Purpose: Links Google Ads with in-app actions Place of processing: United States Notes: Lets us know which ads resulted in app activity.
Google Ad Manager (Google LLC)	Purpose: Runs ad campaigns with external networks; uses DoubleClick Place of processing: United States YourOnlineChoices · Opt Out · Google Ads Settings Notes: Uses the "DoubleClick" cookie to understand ad interactions; you can disable DoubleClick cookies in Ad Settings.
Facebook Custom Audience (Facebook, Inc.)	Purpose: Remarketing & behavioral targeting on Facebook Place of processing: United States (via service) Opt Out · Facebook opt-out Notes: Lets us show Welltory ads to users who interacted with us.
Facebook Remarketing (Facebook, Inc.)	Purpose: Shows Welltory ads after you visited/used the app Place of processing: United States (via service) Opt Out Notes: Uses tracking to serve relevant ads on Facebook after your visit.
Google Ads Remarketing (Google LLC)	Purpose: Remarketing across Google using Google Ads/DoubleClick Place of processing: United States (via service) Opt Out · Google Ads Settings Notes: Controls available via Google's ad settings for personalization.

You can also opt out of interest-based ads using device settings and the industry tools listed below.

Analytics & Attribution

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
Amplitude Analytics (Amplitude Inc.)	Purpose: Product & behavioral analytics Personal Data processed: Cookies; Usage Data Place of processing: United States Policy / Docs: Privacy Policy Notes: Helps us understand feature usage and improve the app.
AppsFlyer (AppsFlyer Ltd)	Purpose: Attribution & campaign performance Personal Data processed: Cookies; Usage Data Place of processing: Israel Policy / Docs: Privacy Policy · Opt Out Notes: Shows which campaigns bring users to the app; supports opt-out.
Google Analytics for Firebase (Google LLC)	Purpose: App analytics; may share with other Firebase tools Personal Data processed: Application opens/updates; device info; first launches; geography/region; in-app purchases; number of sessions/users; OS; session duration; Cookies Place of processing: United States Policy / Docs: Privacy Policy · Google's partner policy Notes: May interoperate with Crash Reporting, Authentication, Remote Config, Notifications; you can turn off certain features in device settings.
Kibana (Elasticsearch, Inc.)	Purpose: Data analytics & observability Personal Data processed: Log data, usage metrics, and system event information Place of processing: United States Policy / Docs: Privacy Statement Notes: Used exclusively to process technical and operational data to monitor stability and security, detect and resolve issues, and improve overall product performance.

Hosting, Backend & AI

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
Firebase Cloud Firestore (Google LLC)	Purpose: Hosting & backend (managed DB) Personal Data processed: Usage Data; various data as per service policy Place of processing: United States Policy / Docs: Privacy Policy Notes: Cloud data storage used to run Welltory and deliver features.
Amazon Web Services (AWS) (Amazon)	Purpose: Hosting & backend infrastructure Personal Data processed: Various data as per service policy Place of processing: United States Policy / Docs: Privacy Policy Notes: Geographically distributed servers; exact storage location can vary.
Openrouter (OpenRouter, Inc.)	Purpose: API gateway for AI models Personal Data processed: Prompts and other data contained in API requests submitted by users (including identifiers, account data, user-generated content, technical information, and usage information) Place of processing: United States Policy / Docs: Privacy Policy · Privacy, Logging, and Data Collection Notes: API gateway to access and route requests to various AI models. This allows us to securely process user prompts and select the least-loaded model to deliver faster and more efficient responses.
OpenAI API, Groq, Phala, Baseten, Together, Cerebras, SambaNova (OpenAI L.L.C., Groq Inc, Hashforest Technology LLC, BaseTen Labs Inc., Together Computer Inc., Cerebras Systems Inc., SambaNova Systems Inc.)	Purpose: Generation of responses for AI-powered features (AI Chat, AI Coach, Megan AI Support Bot) Personal Data processed: User question (text input), User ID, Relevant conversation history, health data from Service Usage, Contextual properties, User profile elements (only as needed: age group, gender, height/weight, geodata), Device/platform metadata. No strong identifiers (e.g., full name, email, phone) are transmitted by Welltory Place of processing: United States Policy / Docs: OpenAI Privacy Policy, Groq Privacy Policy, Phala Privacy Policy, Baseten Privacy Policy, Together Privacy Policy, Cerebras Privacy Policy, SambaNova Privacy Policy Notes: Support of AI-powered features.

App Stores & Payments

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
Apple App Store (Apple Inc.)	Purpose: In-app purchases Personal Data processed: Payment data Place of processing: United States Policy / Docs: Privacy Policy Notes: Apple processes purchase data directly; we receive status only.
Google Play Store (Google LLC)	Purpose: In-app purchases Personal Data processed: Payment data Place of processing: United States Policy / Docs: Privacy Policy Notes: Google processes purchase data directly; we receive status only.
Stripe (Stripe Inc.)	Purpose: Web payments Personal Data processed: Various data as per Stripe policy Place of processing: United States Policy / Docs: Privacy Policy Notes: You enter payment details with Stripe; we get a success/failure notice.

Messaging, Support & Surveys

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
GetResponse (GetResponse S.A.)	Purpose: Email communication Personal Data processed: Email address Place of processing: Poland Policy / Docs: Privacy Policy Notes: Used for sending emails to users, including marketing ones
Postmark (AC PM, LLC)	Purpose: Email communication Personal Data processed: Email address Place of processing: United States Policy / Docs: Privacy Policy Notes: Used for sending transactional emails to users
ZeroBounce (Hertza L.L.C.)	Purpose: Email validation Personal Data processed: Email address Place of processing: United States Policy / Docs: Privacy Policy Notes: Used for email validation (flagging invalid, disposable, catch-all, and spam-trap/abuse emails to reduce bounces and improve deliverability)
Firebase Notifications (Google LLC)	Purpose: Notifications Personal Data processed: Various data as per service policy Place of processing: United States Policy / Docs: Privacy Policy Notes: Can integrate with Firebase Analytics to target audiences and track opens/conversions.
Firebase Cloud Messaging (Google LLC)	Purpose: Push messaging Personal Data processed: Various data as per service policy Place of processing: United States Policy / Docs: Privacy Policy Notes: Sends messages to individual devices, groups, topics, or segments.
Intercom (Intercom Inc.)	Purpose: User database & in-app support Personal Data processed: Cookies; email address; Usage Data; other data per service policy Place of processing: United States (via service) Policy / Docs: Privacy Policy Notes: Used for support messaging and guidance inside the app.
Typeform (TYPEFORM S.L)	Purpose: Surveys & forms Personal Data processed: Company name; data you enter while using the form; email; other per service policy Place of processing: Spain (service) Policy / Docs: Privacy Policy Notes: Collects survey responses to improve features and services.

Content, Fonts & CDN

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
YouTube video widget (Google LLC)	Purpose: Embedded videos Personal Data processed: Cookies; Usage Data Place of processing: United States Policy / Docs: Privacy Policy Notes: YouTube may collect usage data on pages where videos are embedded—even if you don't play them.
Google Fonts (Google LLC)	Purpose: Typeface delivery Personal Data processed: Usage Data; other per service policy Place of processing: United States Policy / Docs: Privacy Policy Notes: Loads fonts so pages render correctly; certain usage data may be processed.
Cloudflare (Cloudflare Inc.)	Purpose: CDN, traffic optimization, DDoS protection Personal Data processed: Cookies; various data per service policy Place of processing: United States (service) Policy / Docs: Privacy Policy Notes: All web traffic is routed through Cloudflare to improve speed and security.

Registration & Authentication

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
Facebook Authentication (Facebook, Inc.)	Purpose: Sign-in with Facebook Personal Data processed: Various data per Facebook policy Place of processing: United States (service) Policy / Docs: Privacy Policy Notes: Lets you log in using your Facebook account.
Google OAuth (Google LLC)	Purpose: Sign-in with Google Personal Data processed: Various data per Google policy Place of processing: United States (service) Policy / Docs: Privacy Policy Notes: Connects your Google account for quick login.
Sign in with Apple (Apple Inc.)	Purpose: Sign-in with Apple / private relay Personal Data processed: First name; User ID Place of processing: United States (service) Policy / Docs: Privacy Policy Notes: Apple may create a private relay address to keep your real email hidden.

Stability & Monitoring

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
Crashlytics (Google LLC)	Purpose: Crash reporting Personal Data processed: Crash information; device information; UUID Place of processing: United States Policy / Docs: Privacy Policy Notes: Helps us find and fix app crashes.
Sentry (Functional Software, Inc.)	Purpose: Error monitoring Personal Data processed: Various data per service policy Place of processing: United States Policy / Docs: Privacy Policy Notes: Improves performance and reliability by tracking errors.

Location-based Interactions

Service	Purpose, Personal Data processed, Notes
Geolocation / Non-continuous geolocation (Welltory)	Purpose: Provide location-based features Personal Data processed: Geographic position Notes: Location is not tracked continuously; you can opt-out using device/browser controls.

Activity & Health Data Integrations (you can connect)

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
Apple HealthKit (Apple Inc.)	Purpose: Provision of personalized health insights Personal Data processed: Activity & Fitness: Workouts, Activity, Active energy, Resting energy, Stand minutes and hours, Physical Effort, Exercise Minutes, Steps, Flights Climbed, Walking + Running Distance, Cycling Distance, Cycling Cadence, Cycling Speed, Swimming Distance, Swimming Strokes, Downhill Snow Sports Distance, Wheelchair Distance, Pushes, Stand Hours, NikeFuel, Cardio Fitness, Number of Times Fallen, Cross Country Skiing Distance, Cross Country Skiing Speed, Move Minutes, NikeFuel, Paddle Sports Distance, Paddle Sports Speed, Rowing Distance, Rowing Speed, Running Power, Running Speed, Skating Sports Distance, Underwater Depth Cardiovascular & Respiratory: Heart Rate, Resting Heart Rate, Walking Heart Rate Average, Heart Rate Variability, Blood Pressure (Systolic, Diastolic), Blood Oxygen, Respiratory Rate, Peak Expiratory Flow Rate, Forced Expiratory Volume 1 sec (FEV1), Forced Vital Capacity (FVC), Peripheral Perfusion Index, Electrodermal Activity, Cardio Recovery, Cardio Fitness Body Composition & Anthropometrics: Height, Weight, Body Mass Index, Lean Body Mass, Waist Circumference, Body Fat Percentage Temperature: Body Temperature, Basal Body Temperature Mental Health & Mindfulness: Mindful Minutes, Sexual Activity Sleep: Sleep with sleep phases info Nutrition & Substances: Dietary Energy, Protein, Carbohydrates, Total Fat, Saturated Fat, Monounsaturated Fat, Polyunsaturated Fat, Dietary Sugar, Dietary Cholesterol, Fiber, Water, Caffeine, Blood Alcohol Content, Blood Sugar Vitamins & Minerals: Vitamin A, B6, B12, C, D, E, K, Biotin, Calcium, Chloride, Chromium, Copper, Folate, Iodine, Iron, Magnesium, Manganese, Molybdenum, Niacin, Pantothenic Acid, Phosphorus, Potassium, Riboflavin, Selenium, Sodium, Thiamin, Zinc Reproductive & Women's Health: Menstruation, Ovulation Test Result, Spotting, Cervical Mucus Environmental & Device Data: Environmental Sound Levels, Headphone Audio Levels, Time In Daylight, UV Index Medication & Interventions: Inhaler Usage, Insulin Delivery Place of processing: United States Policy / Docs: Privacy Policy Notes: Access occurs only with your permission; adjustable in iOS settings. You control which categories are accessed/stored.
Google Fit (Google LLC)	Purpose: Provision of personalized health insights Personal Data processed: Activity & Fitness: Activity, Workout, Step count cadence, Step count delta, Move Minutes, Heart Points, Calories expended, Power, Speed, Distance delta, Cycling wheel revolution RPM, Cycling wheel revolution cumulative, Cycling pedaling cadence, Cycling pedaling cumulative Cardiovascular & Respiratory: Heart rate, Blood glucose, Blood pressure, Oxygen saturation Body Composition & Anthropometrics: Body fat percentage, Height, Weight Temperature & Metabolism: Basal metabolic rate (BMR), Body temperature, Basal body temperature Sleep: Sleep activity values Nutrition & Hydration: Nutrition, Hydration Place of processing: United States Policy / Docs: Privacy Policy Notes: Access/store occurs only if you connect and permit. You control which categories are accessed/stored.
Health Connect (Google LLC)	Purpose: Provision of personalized health insights Personal Data processed: Activity & Fitness: Active calories burned, Exercise, Distance, Elevation gained, Floors climbed, Power, Speed, Steps, Total calories burned, VO2 max, Wheelchair pushes Cardiovascular & Respiratory: Blood glucose, Blood pressure, Heart rate, Heart rate variability, Oxygen saturation, Respiratory rate, Resting heart rate Body Composition & Anthropometrics: Body fat, Body temperature, Body water mass, Bone mass, Height, Lean body mass, Weight Temperature & Metabolism: Basal body temperature, Basal metabolic rate Sleep: Sleep Nutrition & Hydration: Nutrition, Hydration Reproductive & Women's Health: Cervical mucus, Intermenstrual bleeding, Menstruation, Ovulation test, Sexual activity System & Background: Health data history, Health data in background Place of processing: United States Policy / Docs: Privacy Policy Notes: Access/store occurs only if you connect and permit. You control which categories are accessed/stored.
Samsung Health (Samsung Electronics)	Purpose: Provision of personalized health insights Personal Data processed: Biochemical Markers: Albumin, Alkaline phosphatase (ALP), Alanine aminotransferase (ALT), Amylase, Aspartate aminotransferase (AST), Blood urea nitrogen (BUN), Creatine phosphokinase (CPK), Creatinine, Direct bilirubin, Gamma-glutamyl transferase (GGT), Globulin, Hemoglobin A1c (HbA1c), High-density lipoprotein cholesterol (HDL-C), Homocysteine, Lactate dehydrogenase (LDH), Low-density lipoprotein cholesterol (LDL-C), Total bilirubin, Total cholesterol, Total protein, Triglycerides, Urine pH, Urine specific gravity Cardiovascular Indicators: Blood glucose, Blood pressure, Electrocardiogram (ECG), Heart rate, Oxygen saturation (SpO₂) Body Composition: Body fat, Muscle mass, Body temperature, Height, Hip circumference, Waist circumference, Water intake, Weight Sleep & Activity: Exercise, Forced expiratory volume in 1 second (FEV1), Forced vital capacity (FVC), Floors climbed, Nutrition, Sleep, Sleep stage, Step count, Daily step trend Environmental & Context Data: Ambient temperature, UV exposure Documents & Profile: Health document, User profile (age, gender, etc.) Place of processing: United States Policy / Docs: Privacy Policy Notes: Access/store occurs only if you connect and permit. You control which categories are accessed/stored.
Fitbit: Health & Fitness (Fitbit, Inc.)	Purpose: Provision of personalized health insights Personal Data processed: Daily activity summary (steps, calories, floors, active minutes), Step count, Distance traveled, Calories burned, Workout sessions, Weight, Body Fat, Heart Rate, Nutrition, Water, Sleep Policy / Docs: Fitbit Privacy Policy Notes: Access/store occurs only if you connect and permit. You control which categories are accessed/stored.
Withings Health Mate (Withings SA)	Purpose: Provision of personalized health insights Personal Data processed: Goals, Measures, Activity, Intraday activity, Workouts, ECG, Sleep, Sleep summary Policy / Docs: Withings Health Mate Privacy Policy Notes: Access/store occurs only if you connect and permit. You control which categories are accessed/stored.
Garmin Connect (Garmin Ltd.)	Purpose: Provision of personalized health insights Personal Data processed: Activity, Activity details, Activity files, All day respiration, Blood pressure, Body composition, Daily data, Epoch data, Body composition (fat %, BMI, muscle mass, bone mass, water %), Health snapshot, HRV, Manually updated activities, Menstrual cycle tracking, Move IQ activities, Pulse OX, Respiration, Sleep, Stress details, Third party dailies, User metrics Policy / Docs: Garmin Connect Privacy Policy Notes: Access/store occurs only if you connect and permit. You control which categories are accessed/stored.
Oura Ring (Oura Health Oy & Ouraring Inc.)	Purpose: Provision of personalized health insights Personal Data processed: Daily activity summary (calories, MET minutes, activity levels), Readiness score with contributors (HRV, temperature, recovery), Sleep quality score with phases (deep, REM, light), Heart Rate, User profile (age, gender, height, weight), Workout sessions, User-tagged lifestyle factors (caffeine, alcohol, etc.) Place of processing: United States Policy / Docs: ŌURA Health Privacy Policy Notes: Access/store occurs only if you connect and permit. You control which categories are accessed/stored.
Netatmo	Purpose: Provision of personalized health insights Personal Data processed: Weather station data, Public weather data (temperature, humidity, pressure), Home coach air quality data Place of processing: France Policy / Docs: Netatmo Privacy Policy Notes: Access/store occurs only if you connect and permit.
RescueTime	Purpose: Provision of personalized health insights Personal Data processed: Time tracking data, Focus time metrics, Distraction analysis, Application usage Place of processing: United States Policy / Docs: RescueTime Privacy Notice Notes: Access/store occurs only if you connect and permit.

Other Connections (Automations)

Vendor / Service	Purpose, Personal Data processed, Place of processing, Policy / Docs, Notes
IFTTT (IFTTT, Inc.)	Purpose: User-authorized workflows between services mostly for lifestyle analytics Personal Data processed: Event metadata, comments/descriptions, source identifiers, user IDs and timezones, activity log entries usage Place of processing: United States (service) Policy / Docs: Privacy Policy Notes: Allows user to connect/integrate various applications and import data

Interest-Based Advertising Opt-outs (Legacy + Current)

Option	What it does, Link, Notes
NAI industry opt-out (legacy)	What it does: Classic industry tool to opt out of interest-based ads from participating companies Link: optout.networkadvertising.org Notes: We keep this legacy link because some users expect it.
YourOnlineChoices (EU/UK)	What it does: EU portal to manage behavioral advertising preferences Link: youronlinechoices.com Notes: Recognized industry tool
Google Ads / My Ad Center	What it does: Turn off ad personalization across Google services Link: adssettings.google.com Notes: Controls how Google personalizes ads to you.
Device settings (iOS / Android)	What it does: Limit/reset your mobile advertising ID; control tracking prompts Notes: Your device provides system-level ad controls

Integrated Data & Accuracy Notice

When you connect third-party sources, their data structures and accuracy vary (e.g., user-entered flags, device-recorded gaps, GPS precision). We retain metadata that indicates origin, recording method (automatic vs. manual), and last modified time; we apply validation rules, including anomaly checks and cross-validation where available. You are responsible for the accuracy of manual entries, correct device use, and granting appropriate permissions. We cannot guarantee the accuracy of external measurements, third-party calculations, user-entered information, or GPS-based location data.

Legal Disclosures & Business Transfers

We may disclose information if required by law, to protect rights and safety, to investigate potential violations, or with your explicit consent. In the event of a merger, acquisition, or asset sale, your information may be transferred to the acquiring entity; we will notify you before any transfer that changes this Policy and provide the option to delete your data.

Third-Party Research

We do not sell your data to third parties. We do not sell or rent personal data for monetary gain; we share personal data only as described in this Policy with our service providers/vendors.

Your data, your choice. You can export your data for your own use and share it with third parties if you wish (data portability).

Aggregated/anonymized sharing for research and improvement of our services and app functionality. We may share aggregated and/or anonymized data - data that cannot reasonably be used to identify you - with third parties for research that helps improve our services and app functionality. We may also use such anonymized or statistically re-worked data to publish findings that contribute to open science. Similar practices are reflected across the digital health space (e.g., aggregate sharing with academic researchers).

What this means in practice

• We remove direct identifiers, generalize timestamps where needed, and aggregate location to reduce re-identification risk before any research use. (Consistent with industry approaches to "anonymized data.")
• No individual-level data is shared with external researchers unless we have your additional consent (if such a program is ever offered). (Comparable consent-based programs are standard.)

Sub-processor Notifications

We follow industry best practices to ensure transparency around our sub-processors. We publish updates about material sub-processor changes on our website and encourage users to review them periodically.

Your Data Protection Rights

We believe that privacy rights should be clear, transparent, and easy to exercise, no matter where you live. Regardless of your location, you have fundamental rights regarding your personal and health data, as outlined below. Additional rights may apply depending on your jurisdiction.

A. Your Core Privacy Rights

You have the following rights with respect to your personal and health data:

• Right to withdraw consent – you may withdraw your consent for processing health data or marketing communications at any time. Because Welltory's core Service relies on the processing of health data, withdrawing consent will make it impossible for us to continue providing the Service. In this case, your account and associated data will be deleted unless retention is required by applicable law. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to access – you can request confirmation whether we process your personal data, obtain a copy, and receive information about the purposes, categories, recipients, transfers, retention periods, and your rights.
• Right to correction (rectification) – you can request correction or completion of inaccurate or incomplete data.
• Right to deletion ("right to be forgotten") – you can request deletion of your data when it is no longer necessary for the purpose it was collected, when consent is withdrawn, or when processing is unlawful. Deleting your account in the App permanently removes your personal and health data, subject to minimal data retention required by law.
• Right to restriction – you can request that we limit processing while verifying accuracy, handling an objection, or when you need the data to establish or defend legal claims.
• Right to data portability – you can request your data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) and transfer it to another service provider.
• Right to object – you can object to processing based on our legitimate interests, and always object to direct marketing, free of charge.
• Rights related to automated decision-making – you will not be subject to decisions based solely on automated processing that have significant effects on you, unless based on consent, contract, or law.
• Right to lodge a complaint – you may contact your local data protection authority or, where applicable, your state Attorney General if you believe your rights have been violated.

B. Jurisdiction-Specific Additions

California (CCPA/CPRA):

In addition to the core rights above, California residents have the following rights:

• Right to opt out of the "sale" or "sharing" of personal information. We do not sell your personal data for monetary consideration and do not share health data for advertising. We also do not share other categories of personal information for targeted advertising as defined under the CPRA.
• Right to limit the use of sensitive personal information to essential service-related purposes. Please note that limiting the use of sensitive data, including health data, may prevent us from providing the core features of the Service, as they rely on the processing of such information based on your consent.
• Right to non-discrimination for exercising your rights - you will not face different pricing, service levels, or quality for exercising your rights under the CCPA/CPRA.

Washington State (MHMDA)

Applies specifically to consumer health data. In addition to the rights above, residents of Washington State may:

• Request a list of all categories of consumer health data collected, the purposes of use, and the third parties with whom it was shared.
• Request confirmation that deletion requests have been transmitted to all processors and sub-processors.
• File an appeal if your request is denied.

Additional protections under MHMDA:

• We do not sell or license consumer health data without your signed authorization.
• We do not use geofencing around healthcare facilities, pharmacies, or clinics for collecting or targeting consumer health data.

Other U.S. States (Virginia, Colorado, Connecticut, Utah, Nevada, etc.)

These states provide similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, or profiling.

If you reside in Virginia, Colorado, or Connecticut, and we decline to act on your privacy rights request, you have the right to appeal that decision. If your appeal is denied, you may contact your state Attorney General.

We honor browser-based opt-out signals such as Global Privacy Control (GPC) where applicable.

C. How to Exercise Your Rights

In-app deletion

• You may delete your account directly in the app (Settings → Account).
• Deleting your account or withdrawing consent to health data processing permanently removes your personal and health-related data and stops the provision of the Service, subject to minimal data retention required by law.

Contact us

• Email: [email protected]
• Data Protection Officer: [email protected]

Verification

• We will verify your identity using your registered account or email. Additional information may be required if necessary.

Response time

• GDPR: 1 month, extendable up to 3 months for complex cases.
• U.S. States: 45 days, extendable to 90 days.

Cost

• Exercising your rights is free of charge.
• We may charge a reasonable fee or refuse manifestly unfounded, repetitive, or excessive requests.

Third-party notifications

• Where feasible, we notify third parties of corrections, deletions, or restrictions you request.

Complaints

• EEA/Switzerland: you may lodge a complaint with your national supervisory authority. Supervisory authority contact details are available here.
• If you reside in the UK, you may contact the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint.
• U.S.: you may escalate unresolved appeals to your state's Attorney General.

Data Retention

We retain your Personal Data only for as long as necessary to provide you with our Services, fulfill the purposes for which it was collected, or comply with applicable legal, regulatory, or contractual obligations. The exact retention period depends on the type of data and the purpose of processing.

General Principles

• Service provision: We keep your data for as long as your account remains active and you use our Services.
• Consent-based processing: Where processing is based on your consent (e.g., health data integrations), we retain the data until you withdraw consent.
• Legal obligations: Certain records (e.g., payment data) may be kept for longer to comply with tax, accounting, or regulatory requirements.
• Anonymization: We may retain anonymized or aggregated data indefinitely for research, statistics, and service improvement, as such data can no longer be used to identify you.

Account Deactivation or Deletion

• Your right to delete: You may request deletion of your account and associated data at any time through the in-app settings or by contacting us. Once your deletion request is confirmed, we will remove your data within one month, with complete erasure from backup systems within up to 90 days.

App Deletion or Inactivity

• App deletion without account deletion: If you delete the app from your device but do not delete your account, your account and data remain active. Your data will still be retained and can be accessed if you reinstall the app or log in from another device.
• Inactivity: If your account becomes inactive (e.g., you stop using the Services without deleting your account), we may retain your data for up to three years in case you decide to reactivate your account. After three years of inactivity, your personal data will be deleted. You may request earlier deletion at any time.

Specific Retention Periods

• Health and activity data (raw measurements, integrations with Apple Health, Google Health Connect, Garmin, Withings, etc.): Retained while your account is active. Deleted when you disconnect a provider or delete your account.
• Processed insights and reports: Retained as long as your account is active, since they are tied to your use of the Services.
• Payment and billing records: Retained for 7 years after your last transaction, in line with tax and accounting laws.
• Support communications: Retained for 3 years from the last contact.
• Technical logs (API logs, error logs, request data): Retained for up to 90 days for troubleshooting and security.
• Marketing preferences and consents: Retained until you unsubscribe or withdraw your consent.

Secure Deletion

When the applicable retention period expires, we securely and permanently delete or anonymize your data using industry-standard methods, ensuring it cannot be reconstructed or associated with you. Where third-party processors store data on our behalf, they are contractually required to apply the same deletion standards.

Security Measures

We take the security of your personal data very seriously. Welltory implements a combination of technical, organizational, and legal safeguards to protect your information from unauthorized access, disclosure, alteration, misuse, or destruction. Our security program is designed to account for the sensitivity of personal data and the risks involved in processing it.

Technical Safeguards

• Encryption: All personal data is encrypted in transit and at rest using industry-standard cryptographic protocols. Passwords are stored with strong one-way hashing algorithms and additional security measures.
• Access Controls: Strict application of the Principle of Least Privilege and Role-Based Access Control (RBAC) ensures employees only access data necessary for their duties. Access to production systems requires multi-factor authentication for administrative and privileged accounts.
• Monitoring & Logging: We maintain logs of access, configuration changes, and privileged activities. Logs are securely stored and monitored through automated anomaly detection and threat intelligence systems.
• Data Integrity & Segmentation: Integrity checks, backups, and secure key management protect against tampering or loss, following recognized security standards.
• Vulnerability Management: Automated vulnerability scanning, penetration testing (annual), and patch management ensure timely remediation of risks. We remediate vulnerabilities based on their severity.
• Business Continuity & Recovery: Our disaster recovery program includes backup restoration testing and post-incident reviews to ensure service continuity.

Organizational and Legal Safeguards

• Employee Responsibilities: All staff complete annual information security training. Developers receive additional secure coding training. Employees are bound by confidentiality agreements and disciplinary measures apply for policy violations.
• Vendor & Sub-Processor Oversight: We assess vendor risks before integration, require Data Processing Agreements (DPAs) under GDPR, and notify customers in advance of any new sub-processors.
• Privacy by Design & Default: Security and privacy impact assessments (DPIAs) are performed for new features, especially where sensitive data is involved.
• Audit & Certification: Annual external audits and internal automated audits are conducted.

Incident Response & Breach Notification

• Incident Response: We follow recognized incident response methodologies to detect, classify, contain, and remediate incidents.
• Breach Notification: If a personal data breach poses risks to individuals, we will notify the competent Data Protection Authority within 72 hours (GDPR Article 33) and affected users without undue delay (GDPR Article 34). Steps may include logging out all users, password resets, and containment measures.
• Documentation: All incidents are logged, reviewed post-mortem, and used to improve future security processes.

Your Role in Security

You also play an important role in protecting your information. We encourage you to:

• Use a strong, unique password for your Welltory account.
• Keep your device secure and consider enabling additional protection (such as passcode, biometrics).
• Avoid sharing your login details or allowing others to access your device.
• Report any suspicious activity or suspected incidents to [email protected].

Storage and International Data Transfers

Welltory operates globally and uses a distributed cloud infrastructure to provide reliable and secure services to our users. Depending on your location and the services you use, your personal data may be processed and stored in different countries, including the United States, European Union, and other jurisdictions where our service providers maintain facilities.

Primary Data Storage

• United States: Our main infrastructure and backend systems are hosted in secure cloud data centers.
• European Union: For certain categories of user data, especially health-related data of EU residents, we may use regional storage to comply with local requirements.
• Other locations: Some of our partners and integrations (such as Apple HealthKit, Google Health Connect, Fitbit, Garmin, Withings, Strava, and Samsung Health) process data using their own infrastructure, which may involve international transfers.

International Transfers and Safeguards

If you access Welltory from the EEA, UK, or Switzerland, your personal data is protected by the GDPR and UK GDPR. When we transfer your personal data outside these regions, we ensure appropriate safeguards are in place, such as:

• Executing data transfer agreements based on the European Commission's Standard Contractual Clauses (SCCs) or equivalent UK-approved terms;
• Conducting transfer risk assessments to evaluate the level of protection in the recipient country;
• Applying technical measures such as encryption in transit and at rest, pseudonymization, and strict access controls; and
• Partnering only with service providers who meet our security and compliance standards.

Your Rights and Contact Information

If you would like further information about cross-border data transfers or the safeguards we apply, please contact us at [email protected] or our Data Protection Officer at [email protected].

Children's Privacy

Our Services are intended for adults only. You must be at least 18 years old to use the Welltory App and Services.

We do not knowingly collect or solicit personal information from individuals under the age of 18. If we become aware that a person under 18 has provided us with personal information, we will promptly delete such information and terminate the associated account.

If you are a parent or legal guardian and believe that your child under 18 has provided us with personal information, please contact us at [email protected] so that we can take appropriate action.

Updates to This Policy

We keep this Privacy Policy under regular review. Any updates will be posted on this page and in the Welltory App.

This Privacy Policy was last updated on October 28, 2025.

Contact Information

---

Questions? We're here to help. Contact us at [email protected] or reach our Data Protection Officer at [email protected].

Thank you for trusting Welltory with your health journey.