Privacy Policy

1. Introduction

Wellthrive Inc. ("Wellthrive," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, and safeguard information when you visit our website and, in the future, use our applications and related services.

2. Information We Collect

We may collect the following categories of information:

• Account information you provide, such as name and email address.
• Meals and nutrition entries you choose to log.
• Supplement logs you choose to record.
• Wellness profile information you choose to provide.
• Values, units, dates, and source reference ranges from any health or lab report you choose to upload, shown back to you on a pass-through basis.
• Optional health connections that you authorize from supported third-party health data sources.
• Technical information needed to deliver and secure the service, such as device and session metadata.

Contact, waitlist, and request information. When you join the waitlist, submit a contact or partnership inquiry, or use our account-deletion request form, we collect the information you provide, such as name, email address, company or organization if provided, inquiry type, message content, source page, and limited technical metadata such as user-agent and submission timestamp. These forms are not intended for medical, lab, supplement, skin, genetic, or other health details; please do not include those details in free-text messages.

3. How We Use Information

We use the information you provide to deliver personalized nutrition insights and to operate, maintain, and improve our services. We do not use your information for advertising, and we do not sell your personal information.

4. Health Data Sources

If you choose to connect a supported health data source, we request permission only for selected data types needed for user-facing wellness features. Launch health connections are read-only unless we explicitly disclose write access for a specific feature.

5. Consumer Health Data

Some information you provide or authorize may be consumer health data under Washington, Nevada, Connecticut, or other state laws. Our Consumer Health Data Privacy Policy is available at /consumer-health-data and is linked separately from our website footer/homepage. We collect and use consumer health data only to provide the wellness and education features you request, with consent where required by law, or to the extent necessary to provide a product or service you requested. We do not sell consumer health data. We do not use consumer health data for advertising, sponsored-campaign measurement, affiliate matching, or partner analytics. We do not use geofencing around healthcare facilities to identify, track, collect data from, or send health-related messages to consumers.

6. Sharing and Disclosure

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes. We may disclose information where required by law or to protect the rights, safety, and security of our users, the public, or Wellthrive. How service providers process information on our behalf is described in the next section.

7. Service Providers and Processors

Service providers and processors process personal information only under written instructions and confidentiality, security, deletion, and assistance obligations. Raw health values and notes are not provided to advertising networks, sponsored-campaign measurement tools, affiliate partners, or partner analytics. Current processors include: Supabase, for backend database, authentication, form storage, and Edge Function infrastructure; Vercel, for website hosting and related platform services; Google LLC, for cookieless, aggregate website analytics (Google Analytics running under Google Consent Mode with storage denied by default, so it does not set _ga/_gid analytics cookies and is not used for advertising); and Resend (Plus Five Five, Inc.), for transactional and administrative email notifications related to waitlist submissions, contact inquiries, and account-deletion requests. These providers may process only the information needed to provide their services to Wellthrive and may not use the information for their own advertising or cross-context behavioral advertising. Any additional provider, such as an OCR, AI/API, analytics, crash-reporting, support, payment, or affiliate network that receives personal data, will be added here before it is activated.

8. Cross-Border Transfers

Wellthrive Inc. is organized in the Republic of Korea. We and our service providers may process information in Korea, the United States, and other regions where our providers operate. For website forms, waitlist, contact, and account-deletion requests, the relevant overseas recipients and processors include Supabase (United States / cloud infrastructure), Vercel (United States / hosting infrastructure), Google LLC (United States / cookieless, aggregate website analytics), and Resend / Plus Five Five, Inc. (United States / transactional email delivery). The categories include contact and request information such as name, email address, company if provided, inquiry type, message content, source page, user-agent, and timestamps. The purposes are website operation, request routing, account-deletion request handling, transactional notification, security, and compliance recordkeeping. We maintain a transfer and processor record, use contractual safeguards (including data processing agreements and, where applicable, standard contractual clauses), restrict access to personnel and processors with a need to know, and apply technical and organizational safeguards appropriate to the sensitivity of the data. We retain this information according to the retention schedule in this Policy and our internal deletion controls. Genetic/DNA and neurotechnology features are disabled; if such a feature is activated, separate consent, transfer, retention, processor, and deletion terms will be presented before collection or transfer.

9. Your Rights

Subject to applicable law, you may:

• Request access to, correction of, export of, or deletion of your personal information.
• Confirm whether we are processing your consumer health data and access that data, including a list of third parties and affiliates with whom it has been shared.
• Request deletion of consumer health data; where required, we will propagate the deletion request to processors, affiliates, contractors, and third parties to whom the data was disclosed, subject to lawful retention and backup-restoration limits.
• Withdraw consent for any optional health-source connection or upload.
• Appeal a decision we make about a request.

We aim to respond to verified requests within 45 days, with one extension where permitted by law. Where legally required and operationally relevant, we honor Global Privacy Control (GPC) and opt-out-preference signals. Where provided by law, you may also contact the relevant regulator. To exercise any of these rights, contact us at the email below.

10. Data Retention

We retain personal information only as long as necessary to provide the service or as required by law. Retention is based on the period your account is active, the handling of deletion requests, backup-window and backup-restoration criteria, and legal or security retention obligations. Where we retain data beyond active use, we apply de-identification or aggregation where appropriate. For details on how to delete your account and associated data, see Account Deletion.

For website form submissions specifically, we apply the following retention guidance: waitlist submissions are retained until launch and invitation administration is complete and for up to 24 months after the last meaningful interaction, or until you withdraw, unsubscribe, or request deletion, after which they are deleted or anonymized; general and press inquiries are retained for 24 months after the inquiry is closed; partnership inquiries may be retained for up to 3 years after the last substantive interaction where useful for business-development records; account-deletion request records are kept as a minimal compliance log for 24 months after closure to evidence privacy-rights compliance, after which free-text content is removed and the record is deleted or anonymized; technical metadata is retained with the related request, and security logs target 12 months; and platform backups containing form records are purged through the normal backup cycle, targeting 90 days or less where technically feasible.

11. Contact

Questions about this Privacy Policy can be sent to admin@wellthrive-inc.com.