Request Demo Request Demo
AI / ML Disclosure | Wellness360

Artificial Intelligence and Machine Learning Disclosure

Last updated: May 1, 2026
Version: 1.0

Related documents: Privacy Policy · Member Privacy Notice · Membership Agreement · GINA / PHI Notice · Trust Center

Why this document exists

Wellness360 is committed to using artificial intelligence (AI) and machine learning (ML) responsibly. As AI capabilities are introduced into the Wellness360 platform, this document explains:

  • Where and how AI/ML is used
  • What categories of personal data are processed by AI/ML systems
  • The decisions AI/ML systems do and do not make about you
  • Your rights and choices
  • The safeguards we apply

This disclosure aligns with the requirements of the EU AI Act, Colorado AI Act (effective February 2026), Texas Responsible AI Governance Act (HB 149), Utah Artificial Intelligence Policy Act, and applicable HIPAA and US state privacy law obligations.

Current status: As of the date above, Wellness360 does not deploy AI/ML features that make individualized decisions about Program participants in production. Features described below are in development or are planned. We will update this document and notify affected users before any AI/ML feature that processes personal data of participants is launched.

1. Definitions

For purposes of this disclosure:

  • AI / ML system — any algorithm, model, or system that uses statistical or machine-learning techniques to generate insights, predictions, classifications, recommendations, or content from data.
  • Generative AI — AI systems that produce new content (text, code, summaries, suggestions) in response to prompts or input.
  • Predictive AI — AI systems that classify, score, rank, or forecast outcomes based on input data.
  • Automated decision-making — a decision made solely by automated means without meaningful human review that produces legal or similarly significant effects on an individual.
  • High-risk AI system — an AI system that, under applicable law, may significantly affect a person's access to employment, healthcare, financial services, or other essential outcomes.

2. Where AI / ML is used (or planned)

2.1 In production today

Wellness360 currently uses AI/ML in the following limited, non-decisional ways:

  • Aggregate analytics — applying statistical models to fully de-identified, aggregated data sets to identify population-level wellness trends for Program Sponsors. No individual is identifiable in inputs or outputs.
  • Operational tooling — internal use of common third-party developer tools that may include AI features (for example, code completion, IT-helpdesk assistants). These tools do not process Program participant personal data or PHI.

2.2 In development or under evaluation

The following AI/ML features are in development, pilot, or active evaluation. They are not deployed to production accounts at the date above. When we launch any of them, we will update this document and provide notice as described in Section 8.

  • Personalized wellness content recommendations — suggesting articles, challenges, or programs to a participant based on their voluntary inputs (for example, HRA topics they showed interest in). Outputs are recommendations, not decisions.
  • Health Risk Assessment (HRA) summaries and explanations — using generative AI to translate HRA results into plain-language summaries for the participant. The underlying scoring logic is rule-based and not produced by AI.
  • Health coaching support tools — AI-assisted drafting and summarization for our human health coaches (for example, summarizing prior session notes for the assigned coach). The participant continues to interact with a human coach. Coaching content and decisions remain with the human coach.
  • Member Services assistants — AI-assisted suggested responses for Member Services agents handling support inquiries. A human agent reviews and sends the response.
  • Anomaly and abuse detection — ML-based pattern detection for fraudulent activity (for example, device-shake patterns suggesting falsified step counts). Where suspicion is flagged, a human reviews before any account action is taken.

2.3 What we do NOT and will NOT do

Wellness360 does not, and will not:

  • Use AI/ML to make automated decisions that produce legal or similarly significant effects on a participant (such as determining eligibility for health insurance coverage, premium pricing, or employment outcomes).
  • Use AI/ML to generate medical diagnoses, treatment plans, or prescriptions. The Wellness360 platform is not a medical device and does not provide medical advice.
  • Use Program participant personal data or PHI to train third-party general-purpose AI models without that participant's affirmative, separate consent and a Business Associate Agreement (or equivalent) with the model provider.
  • Sell personal data to AI developers or third-party model providers.
  • Use participant data to train models that benefit other customers without contractual safeguards and Program Sponsor instructions.

3. How we handle personal data when AI / ML is used

3.1 Categories of data

Where an AI/ML feature processes personal data, we classify the data into one of three tiers and apply controls accordingly:

Tier Examples Handling
Public / synthetic Anonymized aggregate datasets, public health research data, synthetic test data May be used for model training, testing, and evaluation
Operational Marketing-site analytics, anonymized product telemetry May be used for internal model improvement under our Privacy Policy
Sensitive Program participant personal data, PHI, HRA responses, biometric results, coaching notes Used only for the purpose disclosed to the participant; never used to train external general-purpose models; subject to HIPAA, GINA, and BAA controls

3.2 Training and improvement

Where AI/ML systems learn from data:

  • Customer-isolated learning. Models that personalize a single participant's experience use only that participant's data and do not transfer learning across customers without contractual permission.
  • Aggregated learning. Models that learn from population-level patterns operate on de-identified, aggregated datasets that meet the HIPAA Safe Harbor or Expert Determination standard for de-identification.
  • No training on PHI by third-party LLM providers. When we use third-party large language models (LLMs) for features like HRA summaries or coaching support, we use enterprise / API configurations with zero-retention or no-training contractual terms, and we sign a Business Associate Agreement with any provider that may incidentally process PHI.

3.3 Vendor and subprocessor management

AI/ML vendors are subject to the same vendor-management standards as other subprocessors:

  • Listed on our Subprocessors page
  • BAA in place for any vendor with potential PHI exposure
  • Data Processing Addendum (DPA) signed
  • Pre-engagement security review
  • Annual reassessment

4. Human oversight

For every AI/ML feature in scope of this disclosure, Wellness360 commits that:

  • A human is in the loop for any output that is sent to a participant as advice, suggestion, or response from Wellness360 (for example, coaching messages, Member Services replies).
  • A human reviews any flagged output before account actions such as suspension, reward forfeiture, or referral for fraud review are taken.
  • A named owner within Wellness360 is responsible for each AI/ML feature, including its monitoring, retraining cadence, and incident handling.
  • Each feature has a rollback path so it can be disabled without disrupting the rest of the platform.

5. Bias, fairness, and accuracy

We recognize that AI/ML systems can produce biased or inaccurate outputs, particularly in healthcare contexts where training data may underrepresent certain groups.

To address this, we:

  • Test AI/ML features for disparate performance across demographic groups before launch and at regular intervals after launch.
  • Avoid using protected characteristics (race, ethnicity, national origin, religion, sex, sexual orientation, gender identity, age, disability status, genetic information) as direct inputs to AI/ML features that personalize content or make recommendations.
  • Do not use family medical history as an AI/ML input in any feature, in line with GINA.
  • Provide a path to report a bad output (Section 7) and treat such reports as input to model improvement.
  • Document the limitations of each feature in user-facing copy or in this disclosure.

6. Your rights and choices

You have the following rights and choices regarding AI/ML processing:

6.1 Right to know

You can ask whether and how AI/ML processes your personal data by emailing privacy@wellness360.co. We will respond within 30 days.

6.2 Right to opt out of AI / ML personalization

Where an AI/ML feature personalizes content for you (for example, recommended articles or challenges), you may opt out without losing access to the underlying program. To opt out:

Opting out may reduce personalization but will not prevent you from earning rewards or accessing core program features.

6.3 Right to human review

If an AI/ML system flags your account for fraud or abuse, you have the right to:

  • Be informed of the flag
  • Request human review before any consequence is applied
  • Submit additional information for the human reviewer

This right does not apply to outputs that are merely informational (for example, an article recommendation).

6.4 Right to challenge automated decisions

If you believe an automated process has produced an unfair outcome for you, you may submit a written challenge to privacy@wellness360.co. We will review and respond within 30 days.

6.5 State-specific rights

Residents of certain US states have additional rights under state AI and privacy laws. We will honor rights afforded under, at minimum:

  • Colorado AI Act (consumer notice for high-risk AI, right to opt out of profiling for certain decisions)
  • Texas Responsible AI Governance Act
  • Utah AI Policy Act
  • California Consumer Privacy Act / CPRA (right to opt out of automated decision-making for consequential decisions)
  • Connecticut, Virginia, Oregon consumer privacy law equivalents

To exercise these rights, email privacy@wellness360.co or use the Data Requests tool in your account.

7. Reporting AI / ML concerns

If you believe an AI/ML feature has produced an inaccurate, unfair, biased, or harmful output, please report it to:

Please include:

  • The feature involved (if known)
  • A description of the output
  • The date and approximate time
  • Any harm or concern you experienced

We will acknowledge within 5 business days, investigate, and respond within 30 days. Reports help us improve our systems and are not used adversely against the reporter.

8. Notice of new AI / ML features

When we launch a new AI/ML feature that processes Program participant personal data or PHI, we will:

  • Update this document with a new version number and Last Updated date
  • Notify affected users via email or in-Platform notification at least 30 days before launch, unless launch is required to address a security issue
  • Update the Trust Center with any related controls
  • For features that constitute "high-risk AI" under applicable law, complete and document a pre-deployment impact assessment

If notice is not legally required and the feature does not change how personal data is processed (for example, an internal tooling change), we may update this document without individual notice but will reflect the change in the version history.

9. Generative AI input restrictions for users

When using any AI-assisted feature in the Wellness360 platform (for example, an AI summary generator or chat assistant), you agree that you will not:

  • Submit input that includes personal data of others without their consent
  • Submit input that includes credentials, secrets, or non-Wellness360 confidential information
  • Use AI features to generate content that violates the Wellness Program Membership Agreement (for example, abusive content, attempts to manipulate program rewards)
  • Attempt to bypass safety guardrails or extract underlying model parameters

We may suspend access to AI-assisted features for users who violate these restrictions.

10. Output disclosures

When you interact with an AI-generated output in the Wellness360 platform, we will identify the output as AI-generated where required by law and where it is reasonably feasible. AI-generated chat responses, summaries, and recommendations will be labeled.

AI outputs are tools to support your wellness journey, not medical advice. Always consult your physician or a qualified healthcare provider for medical questions. See Membership Agreement Section 8 for the full medical disclaimer.

11. Governance

Wellness360 maintains an AI Governance Program that includes:

  • A documented AI/ML policy approved by the Privacy Officer and security leadership
  • An inventory of all AI/ML features and the data they process
  • A risk classification process aligned with the EU AI Act risk tiers
  • Pre-deployment impact assessments for higher-risk features
  • Quarterly review of AI/ML features in production
  • Annual review of this disclosure document

Documentation supporting our governance program is available on request to enterprise customers under NDA via privacy@wellness360.co or through our Trust Center.

12. Contact

Privacy Officer
Wellness360 Technologies, Inc.
548 Market St # 517464
San Francisco, California 94104-5401 US

  • Email: privacy@wellness360.co
  • Phone: +1 415 463 1515
  • Hours: Monday – Friday, 9:00 AM – 7:00 PM Central Time

Version history

Version Date Summary
1.0 May 1, 2026 Initial publication. Pre-deployment disclosure for planned AI/ML features.

© 2026 Wellness360 Technologies, Inc. All rights reserved.

×