GDPR NOTICE (EU DATA SUBJECTS)
Last Updated: November 14, 2025
Introduction
This GDPR Notice supplements the Wellness360 Technologies, Inc. Privacy Policy and applies to individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland.
Identity & Contact Details
- Data Controller: Typically your employer, health plan, or sponsoring organization (the “Program Sponsor”).
- Data Processor: Wellness360 Technologies, Inc., 548 Market St # 517464, San Francisco, California 94104-5401 US
- EU/UK DPO Contact: privacy@wellness360.co
Categories & Sources of Data Collected
Refer to our Privacy Policy for the categories collected: identification, contact details, program participation, biometrics, device data, and communication records. Sources: Yourself, your employer (via eligibility files), biometric/lab providers, and device integrations.
Lawful Bases for Processing
We process your Personal Data based on:
- Contractual necessity (to deliver your wellness program)
- Legitimate interests (security, product improvement, fraud prevention)
- Consent (for special categories, direct marketing, or device connections)
- Legal obligations (tax, compliance) You may withdraw consent at any time via your profile or by emailing privacy@wellness360.co.
International Data Transfers
Your data may be transferred to the USA for hosting and processing by:
- Amazon Web Services (primary hosting/data center)
- Intercom (support queries and chat)
- Microsoft (Office 365, email/calendar, productivity)
- Any vendors listed on our Subprocessors page
Your Rights
- Access to your data
- Rectification of inaccuracies
- Data deletion (‘right to be forgotten’), subject to legal retention
- Restriction or objection to processing
- Portability (copy of your data)
- Withdraw consent (where applicable)
- Lodge complaints with your national Data Protection Authority
Contact privacy@wellness360.co to exercise your rights.
Automated Decision-Making
Wellness360 does not use fully automated decision-making that produces legal or similarly significant effects. Automated processing for incentives is always available for challenge/correction by you.
Children’s Data
We do not knowingly process data of individuals under 18 in the EEA/UK/Switzerland without parental consent.
Updates
We may revise this notice from time to time. The date at the top indicates the latest version.
Contact Us
If you have any questions regarding how we protect customer personal data and comply with the GDPR terms, contact us at – support@wellness360.co or leave a message at – Contact Us