Privacy Policy

Last updated: April 28, 2026

Related documents: Terms of Use · Cookie Policy · Data Processing Amendment · Subprocessors · Trust Center

Wellness360 Technologies, Inc. ("Wellness360", "we", "us") respects your privacy. This Privacy Policy explains what personal data we collect, why, how we use it, who we share it with, and the choices you have.

At a glance

• We collect personal data in two roles: as a controller (for our website, marketing, and business contacts) and as a processor (for personal data we handle on behalf of employers who offer Wellness360 to their employees).
• We don't sell your personal data, and we don't share it for cross-context behavioral advertising.
• We host your data in the United States (AWS US-East-2).
• We support your rights under GDPR, UK GDPR, CCPA, PIPL, LGPD, and similar laws.
• Questions: privacy@wellness360.co.

1. Who this Privacy Policy applies to

This policy applies to:

• Website visitors — people who browse wellness360.co and related marketing sites.
• Business contacts — prospects, customers, partners, and people we correspond with in the course of running our business.
• Program participants — employees (and, where the program permits, spouses and dependents) who use the Wellness360 platform as part of a wellness program offered by their employer or program sponsor.

For program participants, the employer or program sponsor (the "Program Sponsor") is the data controller (or equivalent role under your local law), and Wellness360 is the data processor acting on the Program Sponsor's instructions. That means the Program Sponsor decides what data is collected, for what purpose, and for how long — and your rights under this policy should be exercised first with the Program Sponsor. We help them respond.

For website visitors and business contacts, Wellness360 is the controller.

2. What we collect

2.1 As a data processor (when you participate in a wellness program)

The Program Sponsor determines which modules of the platform are enabled, and that determines what we process. Typical categories:

• Identifiers — first name, last name, corporate email, employee ID.
• Profile — profile photo, gender, date of birth, age (where you provide them).
• Activity data — steps, distance, active minutes, workouts, challenge participation, points and rewards balances.
• Device data — data synced from activity trackers you choose to connect (Apple Health, Google Fit, Fitbit, Garmin, etc.).
• Engagement — comments, community posts, peer recognition, survey responses.
• Technical data — IP address, browser and device information, session and usage logs, cookies.

If your Program Sponsor has enabled the relevant modules, we may also process:

• Health and wellness data — height, weight, BMI, blood pressure, blood glucose, biometric screening results, Health Risk Assessment responses.
• Claims data — aggregated or de-identified claims information from your health plan, where the integration is enabled.
• Coaching and support interactions — content you share with coaches or our support team.

Health and claims data are treated as sensitive personal data under most applicable laws (GDPR "special category data," CCPA "sensitive personal information," PIPL "sensitive personal information"). We process them only where the Program Sponsor has enabled the relevant module and you have provided any required consent.

2.2 As a data controller (website and business)

• Contact information — name, email, phone, company, role — when you fill out a form, request a demo, subscribe to our content, or correspond with us.
• Website usage — pages visited, referring site, IP address, browser and device information, through cookies and similar technologies.
• Event and community interactions — if you attend our webinars, register for events, or participate in our communities.

3. How we use personal data

3.1 As a processor

We use program participants' data only to provide the services the Program Sponsor has purchased: enrolling you, tracking your participation, administering challenges and rewards, producing program reports for the Program Sponsor, responding to your support requests, and keeping the platform secure. We don't use this data for our own marketing, don't sell it, and don't combine it with data from other sources except as the Program Sponsor directs.

3.2 As a controller

We use website and business contact data to:

• Respond to inquiries, demos, and sales conversations.
• Operate and improve our website and services.
• Send marketing communications you've opted into (you can unsubscribe at any time).
• Comply with legal obligations and defend our rights.
• Measure and improve our marketing.

3.3 Legal bases (GDPR and similar)

We rely on one or more of the following legal bases:

• Contract — to provide services you or your Program Sponsor have engaged us for.
• Legitimate interests — to operate our business, secure our platform, and market to business contacts, balanced against your interests and rights.
• Consent — for marketing emails to individuals, for cookies that aren't strictly necessary, and for processing sensitive personal data through opt-in modules.
• Legal obligation — where processing is required by law.

4. Who we share personal data with

We share personal data only as follows:

• With your Program Sponsor — when you participate in a wellness program, your participation data is shared with your Program Sponsor as part of the program. Aggregated and de-identified reports are also produced for them. In group settings (community spaces, leaderboards, peer recognition), other participants in your program may see your profile and activity.
• With our sub-processors — service providers who help us run the platform (cloud hosting, email delivery, analytics, customer support tooling). They process personal data only on our instructions. Our current sub-processors are listed at wellness360.co/list-of-sub-processors.
• With program partners — if your program includes biometric screening, coaching, or other partner services, we exchange data with those partners as the program design requires.
• When required by law — in response to valid legal process, or to protect our rights and the safety of users. We challenge overbroad or unlawful requests and notify the Program Sponsor where permitted.
• In a corporate transaction — if Wellness360 is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to standard confidentiality protections.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising.

5. Where we process personal data

Our primary processing is in the United States (AWS US-East-2, Ohio). Some of our sub-processors may process data in other locations; the current list indicates where each processes data.

When personal data moves from one country to another, we use lawful transfer mechanisms:

• From the EEA, UK, or Switzerland — European Commission Standard Contractual Clauses (SCCs), UK International Data Transfer Addendum, and Swiss-compliant mechanisms, as applicable.
• From mainland China — where Wellness360 receives personal data of individuals in mainland China as an overseas recipient, the Program Sponsor (as the personal information handler under PIPL) implements the applicable transfer mechanism — typically the CAC Standard Contract, a Security Assessment, Certification, or an exemption under the 2024 Provisions — and Wellness360 cooperates with that mechanism. Details are set out in our China PIPL Addendum, available as part of enterprise contracts.
• From other jurisdictions — we comply with the applicable local law and use the transfer mechanism the relevant law requires.

Enterprise customers can request copies of the executed transfer mechanisms via their account team.

6. How long we keep personal data

• Program participant data — for the duration of your Program Sponsor's contract with us, plus any additional period the Program Sponsor directs or that is required by law. If the Program Sponsor's contract ends, we delete or return participant data within 60 days (backups cycle out within 180 days).
• Website and marketing data — for as long as you remain a business contact or until you unsubscribe, generally not more than 5 years after our last substantive interaction, unless longer retention is required by law.
• Support and legal records — for the period required to resolve the matter, defend legal claims, and comply with our legal obligations.

7. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — get a copy of the personal data we hold about you.
• Correction — have inaccurate or incomplete personal data corrected.
• Deletion — have your personal data deleted, subject to legal exceptions.
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive your data in a portable format and have it transmitted to another controller.
• Objection — object to processing based on our legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time (without affecting prior processing).
• Opt out of sale or sharing — we do not sell or share personal data for behavioral advertising, but you have a right to direct us not to if that ever changed.
• Limit use of sensitive personal information (California and similar laws).
• Not be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions).

How to exercise your rights:

• If you're a program participant, contact your Program Sponsor first — they control the program data. If you're not sure who that is, you can contact us and we'll route your request.
• Otherwise, email privacy@wellness360.co.

We'll respond within the timeframes required by the law that applies to you — typically 30 days (GDPR), 45 days (CCPA), or shorter where required.

You can also authorize an agent to submit a request on your behalf, subject to our verification procedures. You won't be discriminated against for exercising your rights.

If you're in the EEA, UK, or Switzerland, you have the right to complain to your local supervisory authority. In the EU, you can find yours at edpb.europa.eu.

8. Security

We protect personal data using technical and organizational measures that include encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access and multi-factor authentication for our systems, continuous monitoring, annual third-party penetration testing, and a documented incident response program. Wellness360 maintains HITRUST r2 certification, SOC 2 Type II attestation, ISO/IEC 27001 certification, and US TX-RAMP Level 2 authorization. Current certifications, audit reports, and control documentation are available on our Trust Center.

No system is perfectly secure. If we become aware of a personal data breach affecting your data, we will notify the affected Program Sponsor (for program data) or affected individuals (for directly collected data) in accordance with applicable law.

9. Children

The Wellness360 platform is intended for adults (18 and over). We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we'll delete it.

10. Cookies and similar technologies

We use cookies and similar technologies on our website for essential functionality, analytics, and (with your consent) marketing. You can manage your preferences through our cookie banner and your browser settings. For details, see our Cookie Policy.

11. Region-specific disclosures

California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and similar US states

We disclose the categories of personal information we collect, the purposes for which we use them, and the categories of recipients in Sections 2, 3, and 4 above. In the preceding 12 months, we have:

• Collected the categories listed in Section 2.
• Disclosed for business purposes the categories listed in Section 4.
• Not sold personal information.
• Not shared personal information for cross-context behavioral advertising.
• Processed sensitive personal information only as described in Section 2.1 (opt-in modules enabled by the Program Sponsor).

California residents, and residents of states with similar laws, have the rights listed in Section 7. You can submit a request at privacy@wellness360.co. Authorized agents can submit requests with verifiable authorization.

EEA, UK, and Switzerland (GDPR, UK GDPR, FADP)

• Legal bases for processing are set out in Section 3.3.
• International transfers are handled as set out in Section 5.
• Your rights are listed in Section 7.
• Data protection contact: privacy@wellness360.co.
• EU and UK representatives: if we are required to appoint representatives under Article 27 GDPR or UK GDPR, their details will appear here.

Mainland China (PIPL)

If you're an individual in mainland China whose personal information is processed through a wellness program offered by your employer, your employer (as personal information handler) is primarily responsible for compliance under PIPL. Wellness360 cooperates with the transfer mechanism your employer has selected (see Section 5). You can exercise your PIPL rights — including access, correction, deletion, and withdrawal of consent — by contacting your Program Sponsor, or by emailing privacy@wellness360.co and we will route your request.

Brazil (LGPD), Singapore (PDPA), Australia

We process personal data in accordance with the Brazilian LGPD, Singapore PDPA, and Australian Privacy Principles where they apply. Requests and questions can be directed to privacy@wellness360.co.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If the changes are material, we'll provide prominent notice (for example, by updating the "Last updated" date and, where appropriate, by notifying Program Sponsors or affected individuals). Continued use of the platform after the effective date of the updated policy constitutes acceptance of the changes, subject to any consent required by applicable law.

13. Contact us

• Privacy inquiries and requests: privacy@wellness360.co
• Mailing address: Wellness360 Technologies, Inc., 548 Market St # 517464, San Francisco, California 94104-5401 US

For program participants, please contact your Program Sponsor first for matters relating to your wellness program data.