Request Demo Request Demo

Terms of Use

Privacy Policy

GDPR

Data Processing Amendment

Cookie Policy

List of Sub-Processors

Member Privacy Notice

Membership Agreement

GINA PHI Notice

GINA / PHI Notice

Last modified: April 28, 2026

Related documents: Member Privacy Notice · Membership Agreement · Privacy Policy · Trust Center

Introduction

This notice provides important information about how Wellness360 Technologies, Inc. ("Wellness360") handles genetic information and protected health information (PHI) in compliance with federal law.

This notice applies to wellness program members who participate in health-related activities such as Health Risk Assessments, biometric screenings, or health coaching.

This notice supplements, and does not replace, the Notice of Privacy Practices (NPP) provided by your Program Sponsor's group health plan. Wellness360 operates as a HIPAA Business Associate; the formal HIPAA Notice of Privacy Practices applicable to your health plan is issued and maintained by your Program Sponsor or its health plan administrator. Contact your benefits administrator for a copy of that NPP.

1. Genetic Information Nondiscrimination Act (GINA)

1.1 What is GINA?

The Genetic Information Nondiscrimination Act (GINA) is a federal law that protects individuals from genetic discrimination in health insurance and employment.

GINA prohibits:

  • Health insurers from using genetic information to deny coverage, set premiums, or impose pre-existing condition exclusions
  • Employers from using genetic information in hiring, firing, promotion, or other employment decisions

1.2 What is Genetic Information?

Under GINA, "genetic information" includes:

  • Your genetic tests (e.g., DNA tests, genetic screening results)
  • Genetic tests of your family members
  • Family medical history (your family's history of disease or disorders)
  • Requests for or receipt of genetic services by you or your family members
  • Participation in clinical research that includes genetic services
  • Genetic information about a fetus or embryo

Important: Family medical history is considered genetic information under GINA.

1.3 Wellness360's Policy on Genetic Information

We do NOT require genetic information:

  • Participation in the Wellness360 wellness program is completely voluntary
  • We do NOT require you to provide genetic information (including family medical history) as a condition of participation
  • We do NOT require you to undergo genetic testing

Family Health History Questions Are Optional:

  • Some Health Risk Assessments (HRAs) may include optional questions about family health history to help assess your health risks and provide personalized wellness recommendations
  • You are never required to answer these questions
  • If you choose to provide family health history: it is used only to generate personalized health insights and recommendations for you; it is NEVER shared with your employer in identifiable form; it is protected as Protected Health Information (PHI) under HIPAA

1.4 How We Protect Genetic Information

If you voluntarily provide family health history or other genetic information:

  • It is encrypted in transit and at rest
  • It is accessible only to authorized personnel who need it to provide wellness services to you
  • It is NEVER shared with your employer in a way that could identify you
  • Your employer receives only aggregate, de-identified reports that do not include genetic information in identifiable form
  • It is protected by HIPAA and GINA

1.5 Your Rights Under GINA

You have the right to:

  • Decline to provide genetic information without penalty
  • File a complaint if you believe your genetic information rights have been violated

Employers are prohibited from:

  • Requesting, requiring, or purchasing genetic information about you or your family members
  • Using genetic information in employment decisions (hiring, firing, promotion, compensation, etc.)
  • Disclosing genetic information except as permitted by law

Health Plans are prohibited from:

  • Using genetic information to deny coverage or set premiums
  • Requesting or requiring genetic testing

1.6 Filing a GINA Complaint

If you believe your genetic information rights have been violated:

For Employment-Related GINA Violations:
U.S. Equal Employment Opportunity Commission (EEOC)
Website: eeoc.gov
Phone: 1-800-669-4000

For Health Insurance-Related GINA Violations:
U.S. Department of Health & Human Services (HHS)
Office for Civil Rights
Website: hhs.gov/ocr/complaints
Phone: 1-800-368-1019

2. Protected Health Information (PHI) Notice

2.1 What is PHI?

Protected Health Information (PHI) is individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate in connection with providing healthcare services.

PHI includes:

  • Health Risk Assessment (HRA) responses
  • Biometric screening results (blood pressure, cholesterol, glucose, BMI, etc.)
  • Health coaching notes and goals
  • Activity and wellness engagement data
  • Medical claims data (if your program includes claims integration)
  • Any other health information that can be linked to you

2.2 Wellness360's Role as a HIPAA Business Associate

Wellness360 operates as a HIPAA Business Associate to your employer's group health plan (Program Sponsor) when we handle your PHI.

What this means:

  • We are legally required to protect your PHI in accordance with HIPAA Privacy and Security Rules
  • We have signed a Business Associate Agreement (BAA) with your Program Sponsor
  • We may use and disclose your PHI only as permitted by HIPAA and our BAA
  • We are subject to HIPAA enforcement and penalties for violations

For our current security certifications and compliance attestations (HITRUST r2, SOC 2 Type II, ISO 27001, and others), see our Trust Center.

2.3 How We Collect PHI

We collect PHI only when you voluntarily choose to participate in health-related wellness activities:

  • Completing a Health Risk Assessment (HRA)
  • Participating in biometric screenings
  • Participating in health coaching
  • Sharing data from fitness tracking devices
  • Allowing us to receive medical claims data from your health plan (if enabled)

You are NEVER required to participate in these activities or share PHI as a condition of employment or to receive health insurance coverage.

2.4 How We Use Your PHI

We use your PHI to:

  • Generate personalized health insights and wellness recommendations
  • Facilitate health coaching sessions
  • Track your progress toward health goals
  • Award incentives for preventive care completion (if applicable)
  • Generate aggregate, de-identified reports for your Program Sponsor (you cannot be identified from these reports)

2.5 Who Can Access Your PHI

Authorized Access Only:

  • Health coaches assigned to work with you
  • Member Services representatives responding to your inquiries
  • Technical staff maintaining the platform (with strict access controls and audit logging)
  • Data analysts generating aggregate reports (working only with de-identified data)

All personnel:

  • Are trained on HIPAA requirements
  • Have signed confidentiality agreements
  • Can access PHI only on a "need to know" basis
  • Are subject to disciplinary action for unauthorized access or disclosure

2.6 What Your Employer Receives

Aggregate, De-Identified Data Only:

Your employer receives only population-level reports that show overall trends. Your employer CANNOT identify you from these reports.

Example Aggregate Report:

  • "30% of employees have elevated cholesterol"
  • "Average BMI: 27.2"
  • "Top health risks: physical inactivity, poor nutrition, stress"

Your Employer Does NOT Receive:

  • Your HRA responses
  • Your biometric screening results
  • Your health coaching notes
  • Any specific health conditions or diagnoses
  • Individual PHI, except in limited circumstances for rewards administration, tax reporting, or program abuse detection

2.7 Your HIPAA Rights Regarding PHI

Right to Access: You can view your PHI at any time by logging into your account or requesting a copy by emailing privacy@wellness360.co.

Right to Amend: You can request corrections to your PHI if you believe it is inaccurate or incomplete. Email privacy@wellness360.co.

Right to an Accounting of Disclosures: You can request a list of disclosures of your PHI we have made (other than for treatment, payment, healthcare operations, or to you directly). Note that certain disclosures may be made by your Program Sponsor's group health plan rather than by Wellness360; we will direct you accordingly. Email privacy@wellness360.co.

Right to Request Restrictions: You can request that we restrict how we use or disclose your PHI. We are not required to agree to your request, but if we do, we will honor it except in emergencies. Email privacy@wellness360.co.

Right to Confidential Communications: You can request that we communicate with you about your PHI in a specific way or at a specific location (e.g., call only your cell phone, not home phone). Email privacy@wellness360.co.

Right to Be Notified of a Breach: You have the right to receive notification if your unsecured PHI is breached. See Section 2.9 for details.

Right to a Paper Copy of This Notice: You can request a paper copy of this notice at any time by emailing privacy@wellness360.co or calling +1 415 463 1515. We will provide a paper copy within 30 days of your request.

2.8 When We May Disclose PHI Without Your Authorization

We may use or disclose your PHI without your written authorization in the following situations:

To Your Program Sponsor:

  • To generate aggregate, de-identified reports
  • For rewards administration (confirming activity completion)
  • For tax reporting (if rewards are taxable)
  • To report program abuse or fraud

For Treatment, Payment, or Healthcare Operations:

  • To facilitate health coaching or other wellness services
  • To coordinate care with Program Partners (biometric screening vendors, coaching providers, etc.)
  • For quality assurance and program evaluation

As Required by Law:

  • In response to a subpoena, court order, or legal process (we will notify you where legally permitted and practicable)
  • To public health authorities (e.g., reporting infectious disease outbreaks)
  • To law enforcement (e.g., in response to a warrant)
  • To prevent serious harm (e.g., reporting suspected abuse or imminent threat of violence)
  • For workers' compensation purposes (if applicable)

To Business Associates:

  • To third-party vendors who provide services on our behalf (e.g., AWS for hosting, biometric screening companies)
  • All Business Associates sign HIPAA Business Associate Agreements and are required to protect your PHI

All other uses and disclosures require your written authorization.

2.9 Breach Notification

If your PHI is breached (unauthorized access, use, or disclosure), we will:

  • Notify you within 60 days of discovering the breach
  • Provide details about what PHI was affected
  • Advise you on steps to protect yourself
  • Report the breach to the U.S. Department of Health & Human Services (HHS) and your Program Sponsor

2.10 State Privacy Laws

Members who are residents of California, Virginia, Colorado, Connecticut, Utah, Texas, or Oregon may have additional rights under state privacy laws (including rights to access, correct, delete, port, opt out of targeted advertising, and appeal). For details on how to exercise these rights, see the Member Privacy Notice Section 5.

3. Voluntary Participation

Your participation in the wellness program is completely voluntary.

  • You are NOT required to participate in HRAs, biometric screenings, coaching, or any other health-related activities
  • As a condition of offering this wellness program, your Program Sponsor has represented to Wellness360 that no adverse employment action will be taken against you if you choose not to participate
  • You will NOT be denied health insurance coverage if you choose not to participate
  • You may withdraw from the program at any time without penalty

If your program offers incentive rewards:

  • Participation is still voluntary
  • You may choose not to participate and forego the incentives
  • Reasonable alternative standards are available if you have a medical condition that prevents you from meeting a health-related goal (contact Member Services)

4. Security of Your Information

Wellness360 maintains HITRUST r2 certification and SOC 2 Type II attestation, demonstrating compliance with the highest standards for healthcare and SaaS data security. Current certifications are published on our Trust Center.

We protect your genetic information and PHI with:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Role-based access controls and multi-factor authentication
  • Audit logging of all access to PHI
  • Regular security audits and vulnerability assessments
  • Employee HIPAA training and confidentiality agreements
  • Business Associate Agreements with all vendors
  • Incident response and breach notification procedures

For complete details on our security practices, see our Member Privacy Notice Section 7.

5. Changes to This Notice

We may update this GINA / PHI Notice from time to time. Material changes will be communicated to you via email or Platform notification. The "Last Updated" date at the top reflects the latest version.

6. Contact Us

Questions About This Notice

Privacy Officer
Wellness360 Technologies, Inc.
548 Market St # 517464
San Francisco, California 94104-5401 US

  • Email: privacy@wellness360.co
  • Phone: +1 415 463 1515
  • Hours: Monday – Friday, 9:00 AM – 7:00 PM Central Time

File a Complaint

If you believe your genetic information or PHI rights have been violated:

Wellness360 Privacy Officer:
Email: privacy@wellness360.co

HHS Office for Civil Rights:
hhs.gov/ocr/complaints · 1-800-368-1019

You will not be retaliated against for filing a complaint.

7. Acknowledgment

By acknowledging this GINA / PHI Notice, you confirm that:

  • You understand that providing genetic information (including family medical history) is completely voluntary
  • You understand that you will not be penalized for not providing genetic information
  • You understand how your PHI will be used and protected
  • You understand that your employer receives only aggregate, de-identified reports
  • You understand your HIPAA rights regarding your PHI
  • You understand that participation in health-related wellness activities is voluntary

END OF GINA / PHI NOTICE

Last Updated: April 28, 2026

© 2026 Wellness360 Technologies, Inc. All rights reserved.

×