Request Demo Request Demo

Terms of Use

Privacy Policy

GDPR

Data Processing Amendment

Cookie Policy

List of Sub-Processors

Member Privacy Notice

Membership Agreement

GINA PHI Notice

Wellness Program Member Privacy Notice

Last modified: April 28, 2026

Related documents: Membership Agreement · GINA / PHI Notice · Privacy Policy · Trust Center

Introduction

This Wellness Program Member Privacy Notice ("Notice") explains how Wellness360 Technologies, Inc. ("Wellness360," "we," "us," or "our") collects, uses, shares, and protects your personal and health information when you participate in a wellness program offered through your employer or other sponsoring organization (your "Program Sponsor").

This Notice supplements our general Privacy Policy and applies specifically to wellness program members.

This Notice is provided in compliance with:

  • Health Insurance Portability and Accountability Act (HIPAA)
  • Americans with Disabilities Act (ADA)
  • Genetic Information Nondiscrimination Act (GINA)
  • California Consumer Privacy Act (CCPA / CPRA)
  • Other applicable state, federal, and international privacy laws

Your participation in the wellness program is completely voluntary. You are not required to participate, and your Program Sponsor has represented to Wellness360 that it will not take any adverse employment action against you if you choose not to participate.

1. Who We Are

Wellness360 Technologies, Inc.
548 Market St # 517464
San Francisco, California 94104-5401 US

Our Role

Wellness360 operates as a HIPAA Business Associate to your Program Sponsor when we handle your protected health information (PHI) in connection with wellness program services. Our security, privacy, and compliance posture is documented on our Trust Center.

2. What Information Do We Collect?

The information we collect depends on which wellness program features you choose to use and which features your Program Sponsor has enabled.

2.1 Registration and Profile Information

Required for Enrollment:

  • Name
  • Email address
  • Employee or Member ID
  • Date of birth
  • Gender (optional in some programs)

Optional Profile Information:

  • Phone number
  • Mailing address
  • Profile photo
  • Biographical information

2.2 Health and Wellness Information (Voluntary)

If you choose to participate, we may collect:

Health Risk Assessment (HRA) Data:

  • Medical history (chronic conditions, past surgeries, medications)
  • Family health history (for risk assessment only)
  • Current health status (symptoms, pain levels, functional limitations)
  • Lifestyle behaviors (smoking, alcohol use, exercise habits, diet, sleep patterns)
  • Mental health and stress indicators
  • Preventive care history (screenings, immunizations)

Biometric Screening Data:

  • Height, weight, Body Mass Index (BMI)
  • Blood pressure
  • Cholesterol levels (total, HDL, LDL, triglycerides)
  • Blood glucose / Hemoglobin A1C
  • Waist circumference
  • Other measurements offered by your Program Sponsor

Health Coaching Data:

  • Health goals and action plans
  • Progress notes from coaching sessions
  • Self-reported health behaviors and outcomes
  • Barriers to health behavior change

Activity and Engagement Data:

  • Physical activity (steps, exercise minutes, distance, calories)
  • Sleep data (if tracked via connected device)
  • Nutrition logs (if you choose to track)
  • Participation in wellness challenges and educational programs
  • Content you access or download

2.3 Device and Technology Data

If you connect fitness tracking devices or health apps:

  • Activity data synced from devices (Fitbit, Apple Health, Google Fit, Garmin, etc.)
  • Device type, model, and manufacturer
  • Sync history and connection status

Automatically Collected:

  • IP address, browser type, operating system
  • Pages viewed, features used, time spent
  • Login history and session data
  • Device identifiers

2.4 Information from Other Sources

From Your Program Sponsor:

  • Eligibility file (employee/member ID, name, contact information, employment status)
  • Enrollment status updates
  • Program tier and available features

From Biometric Screening Providers:

  • Lab results and biometric measurements (if you participate in screenings)

From Your Health Insurance Provider:

  • Medical claims data (if your Program Sponsor has enabled claims integration and you participate)
  • Preventive care completion information
  • CPT codes for services received (see Claims Data Addendum for details)

From Healthcare Providers:

  • Health information you authorize us to receive from your personal physician or clinic

3. How We Use Your Information

3.1 Wellness Program Administration

We use your information to:

  • Create and manage your wellness account
  • Verify your eligibility for the program
  • Track your participation and progress
  • Award points and incentives for completed activities
  • Generate personalized wellness recommendations
  • Facilitate health coaching sessions
  • Send program updates, reminders, and notifications (with your consent)

3.2 Health Insights and Recommendations

Based on your health data (if you choose to share it), we may:

  • Identify health risks and suggest appropriate wellness programs
  • Recommend preventive screenings or health services
  • Tailor educational content to your specific needs and interests
  • Provide personalized coaching and support

3.3 Program Evaluation and Improvement

We use aggregated, de-identified data to:

  • Evaluate overall program effectiveness
  • Identify trends and patterns to improve program design
  • Develop new features and wellness offerings
  • Conduct research on wellness program outcomes (using only de-identified data)

3.4 Reporting to Your Program Sponsor

We provide your Program Sponsor with:

  • Aggregate, de-identified reports only (e.g., "40% of employees have high cholesterol; 60% are physically inactive")
  • Population health trends and program participation rates
  • Program ROI and effectiveness metrics

Your employer CANNOT identify you from these reports.

3.5 Communications

With your consent, we may send you:

  • Wellness program updates and announcements
  • Activity reminders and challenge invitations
  • Educational content and health tips
  • Reward notifications
  • Newsletters and surveys

You can opt out of non-essential communications at any time through your account settings.

4. Who Receives Your Information?

4.1 Your Program Sponsor (Employer)

What Your Employer Sees — Aggregate Reports Only:

Your Program Sponsor receives only aggregate, anonymized reports showing overall wellness trends. Your employer CANNOT identify you from these reports.

Example Aggregate Report:

  • "45% of employees completed health assessments"
  • "Average BMI: 26.5"
  • "30% of employees have elevated blood pressure"
  • "Top health risks: sedentary lifestyle, poor nutrition, stress"

What Your Employer Does NOT See:

  • Your Health Risk Assessment responses
  • Your biometric screening results (blood pressure, cholesterol, glucose, etc.)
  • Your health coaching notes or goals
  • Any specific health conditions, medications, or diagnoses
  • Individual activity details beyond rewards verification

Limited Exceptions (Identifiable Information Shared):

In specific, limited circumstances, we may share identifiable information with your Program Sponsor for:

  1. Rewards Administration: Confirmation that you completed qualifying activities to earn incentives (e.g., "Employee ID 12345 completed annual physical").
  2. Tax Reporting: If wellness incentives exceed IRS thresholds and are taxable income, your employer may receive information necessary for tax reporting (e.g., issuing Form 1099-MISC).
  3. Program Abuse Detection: If we detect fraudulent activity (e.g., falsifying activity data to earn undeserved rewards), we may report this to your employer.

Special Cases:

  • If your Program Sponsor is also your medical care provider (e.g., hospital, healthcare organization): We may share additional health information to facilitate treatment and coordinate care.
  • If your Program Sponsor is your health plan: We may share additional participation information to provide access to plan benefits and ensure continuity of care.

4.2 Wellness360 Employees

Only authorized Wellness360 employees who need access to provide services to you can view your information, including:

  • Health coaches assigned to work with you
  • Member Services representatives who respond to your inquiries
  • Technical staff who maintain the Platform (with strict access controls and audit logging)
  • Data analysts who generate aggregate reports (working only with de-identified data)

All employees are:

  • Trained on HIPAA, data privacy, and confidentiality requirements
  • Bound by strict privacy policies and confidentiality agreements
  • Subject to disciplinary action for unauthorized access or disclosure

4.3 Business Associates and Service Providers

We share your information only as necessary with third-party vendors who help us provide services, including:

Infrastructure and Hosting:

  • Amazon Web Services (AWS) — Secure cloud hosting and data storage (HITRUST certified)

Biometric Screening Providers:

  • Third-party labs or mobile screening companies (if you participate in screenings)

Health Coaching Providers:

  • Partner organizations that provide coaching services on our behalf

Communication and Support:

  • Intercom — Customer support chat and messaging
  • SendGrid / Twilio — Transactional email and SMS delivery

Analytics and Insights:

  • Google Analytics — Website usage analytics (de-identified data only)
  • Analytics platforms for program insights (de-identified data only)

All Business Associates:

  • Sign HIPAA Business Associate Agreements (BAAs)
  • Are contractually required to protect your information
  • May use your information only for specified purposes
  • Are subject to audit and oversight

For a complete list of subprocessors, see wellness360.co/list-of-sub-processors.

4.4 Program Partners

Depending on your program, you may have access to services from our Program Partners (e.g., fitness apps, nutrition programs, mental health resources, diabetes management tools).

If you choose to use Program Partner services:

  • You will be subject to the Partner's privacy notice and terms of use
  • You may need to provide additional information directly to the Partner
  • The Partner may share relevant information with us to support your wellness goals or manage incentives
  • We are not responsible for Partner privacy practices

You can see a list of available Program Partners by selecting "Devices & Apps" in your account.

4.5 Health Insurance Providers

If your Program Sponsor has enabled claims data integration:

  • Your health plan administrator (TPA) shares limited medical claims data with us
  • We use this data to automatically identify preventive care completion and award incentives
  • See our Claims Data Addendum for complete details on what claims information we receive and how it's used

4.6 Legal and Regulatory Authorities

We may disclose your information when required by law, including:

  • In response to a subpoena, court order, or legal process
  • To comply with federal, state, or local laws and regulations
  • To cooperate with law enforcement or government investigations
  • To report suspected abuse, neglect, or domestic violence (as required by law)
  • To prevent serious harm to you or others (e.g., imminent threat of violence)

4.7 Business Transfers

If Wellness360 is involved in a merger, acquisition, bankruptcy, or sale of assets:

  • Your information may be transferred to the new entity
  • The new entity will be bound by this Privacy Notice
  • We will notify you before your information is transferred and becomes subject to a different privacy policy

5. Your Privacy Rights

5.1 Right to Access

You have the right to access your information at any time.

How to Access:

  • Log into your Wellness360 account to view your profile, activity history, HRA results, biometric data, and coaching notes
  • Request a complete copy of all information we hold about you by emailing privacy@wellness360.co or using the Data Requests tool in your account settings

Timeline: We will respond within 30 days.

5.2 Right to Correct

You have the right to correct inaccurate or incomplete information.

How to Correct:

  • Update your information directly in your account settings (profile, contact information, preferences)
  • Contact Member Services at support@wellness360.co to request corrections to health data
  • Submit a formal amendment request via privacy@wellness360.co

Timeline: We will respond within 30 days.

5.3 Right to Delete

You have the right to request deletion of your information.

How to Delete:

Timeline:

  • Phase 1 (30 days): Account deactivation. You can still access your account if you change your mind.
  • Phase 2 (Additional 30 days): Permanent, irreversible data deletion.
  • Total: 60 days from deletion request to permanent removal.

Exceptions: Some information may be retained for legal, tax, audit, or compliance purposes (typically 7 years for audit records). Following your deletion request, we may still receive information about you from your Program Sponsor's eligibility files or claims data. To stop that data flow, contact your Program Sponsor directly.

5.4 Right to Data Portability

You have the right to receive a copy of your information in a portable format.

How to Request:

  • Email privacy@wellness360.co with your portability request
  • Specify the format you prefer (e.g., CSV, JSON, PDF)

Timeline: We will provide your data within 30 days.

5.5 Right to Restrict Processing

You have the right to limit how we use your information.

How to Restrict:

  • Choose not to share certain types of information (e.g., skip optional HRA questions, don't participate in biometrics or coaching)
  • Opt out of non-essential communications through your account settings
  • Request account suspension while concerns are resolved by emailing privacy@wellness360.co

Note: Limiting participation may affect your ability to earn rewards or use certain Platform features.

5.6 Right to Object

You have the right to object to processing of your information.

How to Object:

Timeline: We will respond within 30 days.

5.7 Right to Opt-Out of Sale

We do not sell your Personal Information.

Wellness360 does not and will not sell, rent, or lease your information to third parties for monetary consideration. We share information only as described in this Notice for wellness program administration and service delivery.

5.8 State-Specific Privacy Rights

California Residents (CCPA/CPRA): You have the right to know what Personal Information is collected, used, shared, or sold; delete Personal Information (with some exceptions); opt out of sale of Personal Information; and non-discrimination for exercising your rights.

Virginia, Colorado, Connecticut, Utah, Texas, and Oregon Residents: You may have similar rights under your state's privacy laws, including rights to access, correct, delete, port, opt out of targeted advertising, and appeal decisions. Contact privacy@wellness360.co to exercise your rights.

To Exercise Your Rights:

  • Use the Data Requests tool in your account settings
  • Email privacy@wellness360.co
  • Call Member Services: +1 415 463 1515

6. Voluntary Participation

6.1 Participation is Completely Voluntary

Participation in the wellness program and sharing health information is COMPLETELY VOLUNTARY.

You are NOT required to:

  • Participate in the wellness program
  • Complete Health Risk Assessments
  • Participate in biometric screenings
  • Share health information with us
  • Participate in health coaching
  • Connect fitness tracking devices

6.2 No Employment Consequences

As a condition of offering this wellness program, your Program Sponsor has represented to Wellness360 that:

  • You will not be required to participate as a condition of employment
  • No adverse employment action (discipline, termination, demotion, denial of promotion) will be taken if you choose not to participate
  • You will not be denied health insurance coverage if you choose not to participate
  • You will not be provided different health insurance terms or coverage based on your participation

Because employment decisions are made by your Program Sponsor and not by Wellness360, direct any employment-related concerns to your Program Sponsor's HR department. Wellness360 will not share your participation status or health data with your employer in any form that would permit identification.

6.3 Incentive Programs Remain Voluntary

If your employer offers incentive rewards for wellness participation, participation is still voluntary. You may choose not to participate and forego the incentives without any employment consequences.

ACA Wellness Program Compliance:

If incentives are offered, the program is designed to comply with Affordable Care Act (ACA) wellness program rules:

  • Incentives do not exceed 30% of the cost of employee-only health coverage (or 50% for tobacco cessation programs)
  • The program is reasonably designed to promote health and prevent disease
  • Alternative pathways to earn incentives are available if you have a medical condition that prevents you from meeting a health-related standard
  • Reasonable alternative standards will be provided upon request (contact Member Services)

6.4 Right to Withdraw

You may withdraw from the wellness program and terminate your account at any time without penalty. See Section 5.3 for deletion procedures.

7. Data Security

7.1 Our Security Commitment

Your health information is personal and should be kept private. We have taken extensive steps to ensure your information is safe and secure. For a complete view of our current certifications, controls, and policies, visit our Trust Center.

7.2 Compliance Certifications

Wellness360 maintains the following certifications and attestations, verified through independent third-party audits:

  • HITRUST r2 — Healthcare data security framework aligned with HIPAA, NIST, and ISO/IEC 27001
  • SOC 2 Type II — Security, availability, and confidentiality controls
  • ISO/IEC 27001 — Information security management system
  • HIPAA — Business Associate compliance
  • GDPR — European Union data protection compliance
  • CPRA (formerly CCPA) — California consumer privacy
  • US TX-RAMP Level 2 — Texas Risk and Authorization Management Program

Current status and audit reports are available on our Trust Center.

7.3 Technical Safeguards

Encryption:

  • All data is encrypted in transit using TLS 1.2+ (Transport Layer Security)
  • All data is encrypted at rest using AES-256 encryption

Access Controls:

  • Role-based access control (RBAC) — employees can only access information necessary for their job functions
  • Multi-factor authentication (MFA) required for all system access
  • Automatic session timeouts
  • Unique user IDs and strong password requirements

Audit Logging:

  • Every access to your information is logged with user ID, timestamp, and action taken
  • Logs are monitored for suspicious activity
  • Regular access reviews and audits

Network Security:

  • Firewalls and intrusion detection/prevention systems (IDS/IPS)
  • Regular vulnerability scanning and penetration testing
  • DDoS protection
  • Secure VPN access for remote employees

7.4 Physical Safeguards

  • Data is stored in HITRUST-certified AWS data centers with 24/7 physical security
  • Restricted physical access with badge readers, biometric scanners, and video surveillance
  • Secure server rooms with environmental controls
  • Redundant power and network infrastructure
  • Disaster recovery and business continuity plans

7.5 Administrative Safeguards

Employee Training:

  • All employees receive comprehensive HIPAA and data privacy training upon hire and annually thereafter
  • Security awareness training covering phishing, social engineering, and incident response
  • Confidentiality agreements required for all employees and contractors

Policies and Procedures:

  • Written security policies and procedures covering all aspects of data protection
  • Incident response plan for data breaches or security events
  • Regular risk assessments and security audits

Vendor Management:

  • All vendors sign Business Associate Agreements (BAAs)
  • Vendor security assessments before engagement
  • Ongoing monitoring of vendor compliance

7.6 Data Breach Response

In the unlikely event of a data breach affecting your information:

  • We will notify you within 60 days of discovering the breach (as required by HIPAA)
  • We will provide details about what data was affected
  • We will advise you on steps to protect yourself
  • We will report the breach to the U.S. Department of Health & Human Services (HHS) and your Program Sponsor
  • We will take corrective actions to prevent future breaches

7.7 No Guarantee

Despite our extensive security measures, no system is 100% secure. We cannot guarantee absolute security of your information. However, we continuously monitor and improve our security practices to protect your data.

8. Data Retention

8.1 How Long We Keep Your Information

Active Accounts: We retain your Personal Information for as long as your account is active or as needed to provide wellness program services.

After Account Termination:

  • We permanently delete your identifiable information within 60 days of account termination (30-day deactivation period + 30-day deletion grace period)
  • Exception: Information required for legal, tax, audit, or compliance purposes is retained for 7 years (standard audit retention period)

Claims Data: If your program includes claims integration, we retain claims data for 7 years from the date received to comply with HIPAA record retention requirements and IRS audit requirements.

Backup Systems: Your information may continue to appear in backup systems for up to 90 days after deletion while backups are cycled.

9. Genetic Information Nondiscrimination Act (GINA)

9.1 No Genetic Information Required

Wellness360 does NOT require you to provide genetic information (including family medical history) as a condition of participation in the wellness program.

9.2 Optional Family Health History

If a Health Risk Assessment includes optional questions about family health history:

  • These questions are completely optional
  • They are used only to assess your health risks and provide personalized recommendations
  • NEVER shared with your employer in identifiable form
  • Protected under GINA

9.3 GINA Protections

The Genetic Information Nondiscrimination Act (GINA) prohibits:

  • Employers from using genetic information (including family health history) in employment decisions
  • Health insurers from using genetic information to deny coverage or set premiums
  • Retaliation against individuals who assert their rights under GINA

For more detailed information about our GINA and PHI practices, see our GINA / PHI Notice.

10. International Data Transfers

10.1 Data Storage Location

Your information is stored on servers located in the United States (AWS data centers, US East region).

10.2 International Users

If you access the wellness program from outside the United States:

  • Your information will be transferred to, stored, and processed in the U.S.
  • Data protection laws in the U.S. may differ from your country
  • By using the program, you consent to such transfer

10.3 EU/UK Users

For users in the European Economic Area (EEA) or United Kingdom:

  • Data transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission
  • See our GDPR Notice for additional information

10.4 China (PIPL) Users

For users whose personal information is subject to China's Personal Information Protection Law (PIPL):

  • Wellness360 is an overseas recipient of personal information transferred from China by your Program Sponsor
  • Your Program Sponsor is the PIPL-regulated data exporter and is responsible for obtaining any required separate consent and completing any applicable cross-border transfer mechanism (standard contract filing, security assessment, or certification) before providing your information to Wellness360
  • For detailed obligations applicable to Wellness360 as an overseas recipient, see Schedule 6 of our Data Processing Agreement

10.5 Translations

This Notice is provided in English. Your Program Sponsor may provide translated versions, or you may request one by contacting support@wellness360.co. In the event of a conflict, the English version of this Notice controls.

11. Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or new program features.

If we make material changes:

  • We will notify you via email or Platform notification
  • We will update the "Last Updated" date at the top of this Notice
  • We may require you to review and accept the updated Notice before continuing to use the program

Your continued participation after changes become effective constitutes acceptance of the updated Notice.

12. Contact Us

12.1 Questions

If you have questions about this Privacy Notice or our privacy practices, contact:

Privacy Officer
Wellness360 Technologies, Inc.
548 Market St # 517464
San Francisco, California 94104-5401 US

  • Email: privacy@wellness360.co
  • Phone: +1 415 463 1515
  • Hours: Monday – Friday, 9:00 AM – 7:00 PM Central Time

12.2 Data Rights Requests

To exercise your privacy rights (access, correct, delete, port, restrict, object):

  • Use the Data Requests tool in your account settings
  • Email privacy@wellness360.co
  • Call Member Services: +1 415 463 1515

12.3 File a Complaint

If you believe your privacy rights have been violated:

Wellness360 Privacy Officer:

  • Email: privacy@wellness360.co
  • Mail: 548 Market St # 517464, San Francisco, California 94104-5401 US, Attn: Privacy Officer

HIPAA Complaints: You also have the right to file a complaint with the U.S. Department of Health & Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints or 1-800-368-1019.

13. Acknowledgment

By accepting this Wellness Program Member Privacy Notice, you acknowledge that:

  • You have read and understand how your information will be collected, used, shared, and protected
  • You understand that participation in wellness program activities (HRAs, biometrics, coaching) is voluntary
  • You understand that your employer receives only aggregate, de-identified reports and cannot identify you
  • You understand your privacy rights (access, correct, delete, port, restrict, object)
  • You understand that you may withdraw from the program and delete your information at any time
  • You consent to the collection, use, and sharing of your information as described in this Notice

END OF WELLNESS PROGRAM MEMBER PRIVACY NOTICE

Last Updated: April 28, 2026

© 2026 Wellness360 Technologies, Inc. All rights reserved.

×