Privacy Policy

1. Introduction

Wellthrive Inc. ("Wellthrive," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, and safeguard information when you visit our website and, in the future, use our applications and related services. If we make material changes to this Policy, we will update the date shown above and, where required by law, give you additional notice before the change takes effect.

2. Information We Collect

We may collect the following categories of information:

• Account information you provide, such as your email address and the country or region and state or province you select for your account (we pre-fill the country or region from your device settings). The name you enter in the app is kept only on your device and is not saved to your account.
• If you sign in with Apple, we receive a unique account identifier and your email address or a relay address created with Apple's Hide My Email. If you choose to share your name through Sign in with Apple, it is used only to pre-fill the name field on your device and is not saved to your account.
• If you sign in with Google, we request only your email address and a unique account identifier. Google may also return a basic profile (name, photo); we do not store it.
• Health and wellness information you choose to provide, including health goals, health conditions, allergies, medication classes, body and lifestyle information, and meal and supplement entries. Additional categories such as reproductive-health information, lab results, blood-glucose data or genetic information are collected only if you choose to activate the relevant feature.
• Meals and nutrition entries you choose to log.
• Supplement logs you choose to record.
• Skin wellness inputs you choose to provide where you enable skin features: your skin goals and notes, irritation notes, sensitivity and ingredient-avoidance inputs, routine preferences, and how you use the skin features.
• Values, units, dates, and source reference ranges from any health or lab report you choose to upload, shown back to you on a pass-through basis.
• Optional health connections that you authorize from supported third-party health data sources.
• Your messages to the Plus AI Coach and the Coach's replies, including scheduled check-in messages if you turn them on.
• Usage analytics about how you use the app's general features, linked to your account, excluding events about the skin features and the separately activated health features (such as blood glucose, lab results, medication tracking, and reproductive health). You can turn this on or off at any time in the app's privacy settings. For accounts in Canada, it is off by default.
• Technical information needed to deliver and secure the service, such as device and session metadata, and account activity information: your device platform (iOS or Android), the time zone and app language set on your device, when you last opened the app and, if you turn on notifications, the device push token used to deliver them.

Contact, waitlist, and request information. When you join the waitlist, submit a contact or partnership inquiry, or use our account-deletion request form, we collect the information you provide, such as name, email address, company or organization if provided, inquiry type, message content, source page, and limited technical metadata such as user-agent and submission timestamp. These forms are not intended for medical, lab, supplement, skin, genetic, or other health details; please do not include those details in free-text messages.

3. How We Use Information

We use this information to provide the personalized Wellthrive wellness service you request, including tailored general wellness guidance, analysis of meal and supplement entries, and possible food or supplement cautions based on the health conditions, allergies, and medication classes you provide. These features are informational only and do not diagnose, treat, prescribe, or tell you to start, stop or change a medication or supplement.

If you choose to use the Plus AI Coach, we also use the information and results you have entered or enabled to generate personalized wellness explanations and, if you turn on Coach check-ins, to prepare the scheduled check-in you asked for, sending only the information needed for your question or check-in to an AI service provider acting on Wellthrive's behalf (see Section 7).

With your separate consent, we also use the corrections you make to AI food capture results to create de-identified statistics that help us improve the accuracy of food capture; see Section 2 of our Consumer Health Data Privacy Policy.

If you join our waitlist, we use the name and email address you give us to send the updates you asked for (Health Library digests, progress updates, and launch news) until you unsubscribe or withdraw your consent, which you can do at any time using the link in each email or by contacting us.

If you have a Wellthrive account, we use your email address, the language and time zone set on your device, the country or region and state or province you set, your account and subscription status, and when you last opened the app to email you wellness tips, app news, and information about Wellthrive Plus. We do not use your health and wellness information, or data from health connections, to decide who receives these emails. Where the law requires your consent, we send them only if you opt in. In the United States, they are on by default. Wherever you are, you can turn them off at any time in the app's email settings or with the unsubscribe link in each email.

We also use information to operate, maintain, and improve our services. We do not use your information for advertising, other than to send the waitlist updates you asked for and the emails described in this section, and we do not sell your personal information.

4. Health Data Sources

If you choose to connect a supported health data source, we request permission only for selected data types needed for user-facing wellness features. Launch health connections are read-only unless we explicitly disclose write access for a specific feature.

Health data from a connected source is read on your device and uploaded to your account only after you give health-data consent and grant the operating-system permission. You can withdraw that consent at any time in the app under Settings › Privacy & Data. At launch, the health data types we request are steps, active energy, workouts, sleep, weight, hydration, and heart rate; other types, such as blood glucose, are requested only if you activate the relevant feature.

5. Consumer Health Data

Some information you provide or authorize may be consumer health data under Washington, Nevada, Connecticut, or other state laws. Our Consumer Health Data Privacy Policy is available at /consumer-health-data and is linked separately from our website footer/homepage. Except as described in Section 3 for AI food capture corrections, we collect and use consumer health data only to provide the wellness and education features you request, with consent where required by law, or to the extent necessary to provide a product or service you requested. We do not sell consumer health data. We do not use consumer health data for advertising, sponsored-campaign measurement, affiliate matching, or partner analytics. We do not use geofencing around healthcare facilities to identify, track, collect data from, or send health-related messages to consumers.

6. Sharing and Disclosure

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes. We may disclose information where required by law or to protect the rights, safety, and security of our users, the public, or Wellthrive. How service providers process information on our behalf is described in the next section.

7. Service Providers and Processors

Service providers and processors process personal information only under written instructions and confidentiality, security, deletion, and assistance obligations. Raw health values and notes are not provided to advertising networks, sponsored-campaign measurement tools, affiliate partners, or partner analytics. Current processors include: Supabase, for backend database, authentication, form storage, and Edge Function infrastructure; Vercel, for website hosting and related platform services; Google LLC, for cookieless, aggregate website analytics (Google Analytics running under Google Consent Mode with storage denied by default, so it does not set _ga/_gid analytics cookies and is not used for advertising); Resend (Plus Five Five, Inc.), for transactional and administrative email notifications related to waitlist submissions, contact inquiries, and account-deletion requests, for the waitlist updates you ask to receive, for account emails such as sign-in codes, password-reset and email-change links, and security and account-service notices, and for the wellness tips, app news, and Wellthrive Plus information described in Section 3; and OpenAI (OpenAI OpCo, LLC), for AI-based meal, food, and label recognition from the text and images you choose to submit and, if you choose to use the Plus AI Coach, for generating your Coach replies and scheduled check-ins (raw lab values, genetic data, and medical records are not sent to this provider). AI service providers act as processors for the Coach and process what you send to the Coach and the limited health context Wellthrive provides for that conversation or scheduled check-in only under Wellthrive’s instructions to provide the Coach service, and not for advertising or model training, subject to applicable security and legal requirements. Our AI service provider may retain inputs and outputs for up to 30 days for abuse monitoring, or longer where required by law or for safety reasons, and does not use them to train its models. These providers may process only the information needed to provide their services to Wellthrive and may not use the information for their own advertising or cross-context behavioral advertising. Any additional provider, such as an OCR, AI/API, analytics, crash-reporting, support, payment, or affiliate network that receives personal data, will be added here before it is activated. Sign in with Apple and Sign in with Google are operated by Apple Inc. and Google LLC (United States), respectively, as independent services under their own privacy policies, not as Wellthrive processors; we use the sign-in information we keep in the same way as your other account information, and we ask Apple to revoke the sign-in authorization when you delete your account. If you use Apple's Hide My Email, Apple forwards our emails to you.

Push notifications and crash diagnostics are handled by the following providers:

• Firebase Cloud Messaging (Google LLC) — delivers push notifications on Android and processes the device push token for that purpose. No health data is sent.
• Apple Push Notification service (Apple Inc.) — delivers push notifications on iOS and processes the device push token for that purpose. No health data is sent.
• Firebase Crashlytics (Google LLC) — crash diagnostics only: crash stack traces, technical information about the app and the device (such as device model) and an app installation identifier, used to keep the app stable. No health data is sent. Android app only.

8. Cross-Border Transfers

Wellthrive Inc. is organized in the Republic of Korea. We and our service providers may process information in Korea, the United States, and other regions where our providers operate. For website forms, waitlist, contact, and account-deletion requests, the relevant overseas recipients and processors include Supabase (United States / cloud infrastructure), Vercel (United States / hosting infrastructure), Google LLC (United States / cookieless, aggregate website analytics), and Resend / Plus Five Five, Inc. (United States / transactional email delivery and delivery of the waitlist updates you requested). The categories include contact and request information such as name, email address, company if provided, inquiry type, message content, source page, user-agent, and timestamps. The purposes are website operation, request routing, account-deletion request handling, transactional notification, sending the waitlist updates you requested, security, and compliance recordkeeping. For app accounts, the overseas recipients and processors are those listed in Section 7 (United States), for the purposes described in Sections 3 and 7. We maintain a transfer and processor record, use contractual safeguards (including data processing agreements and, where applicable, standard contractual clauses), restrict access to personnel and processors with a need to know, and apply technical and organizational safeguards appropriate to the sensitivity of the data. We retain this information according to the retention schedule in this Policy and our internal deletion controls. Genetic/DNA and neurotechnology features are disabled; if such a feature is activated, separate consent, transfer, retention, processor, and deletion terms will be presented before collection or transfer.

9. Your Rights

Subject to applicable law, you may:

• Request access to, correction of, export of, or deletion of your personal information.
• Confirm whether we are processing your consumer health data and access that data, including a list of third parties and affiliates with whom it has been shared.
• Request deletion of consumer health data; where required, we will propagate the deletion request to processors, affiliates, contractors, and third parties to whom the data was disclosed, subject to lawful retention and backup-restoration limits.
• Withdraw consent for any optional health-source connection or upload.
• Appeal a decision we make about a request.

We aim to respond to verified requests within 45 days, with one extension where permitted by law. Where legally required and operationally relevant, we honor Global Privacy Control (GPC) and opt-out-preference signals. Where provided by law, you may also contact the relevant regulator. To exercise any of these rights, contact us at the email below.

10. Data Retention

We retain personal information only as long as necessary to provide the service or as required by law. Retention is based on the period your account is active, the handling of deletion requests, backup-window and backup-restoration criteria, and legal or security retention obligations. Where we retain data beyond active use, we apply de-identification or aggregation where appropriate. When we de-identify information, we take reasonable measures to ensure it cannot be associated with you, your household, or your device; we commit to maintain, use, and otherwise process it only in de-identified form and not to attempt to re-identify it; and we contractually require anyone who receives it to meet these same requirements. If you start email sign-up but never set a password or link an Apple or Google sign-in, the account is deleted automatically 30 days after it was created. For details on how to delete your account and associated data, see Account Deletion.

For website form submissions specifically, we apply the following retention guidance: waitlist submissions are retained until launch and invitation administration is complete and for up to 24 months after the last meaningful interaction, or until you withdraw, unsubscribe, or request deletion, after which they are deleted or anonymized; general and press inquiries are retained for 24 months after the inquiry is closed; partnership inquiries may be retained for up to 3 years after the last substantive interaction where useful for business-development records; account-deletion request records are kept as a minimal compliance log for 24 months after closure to evidence privacy-rights compliance, after which free-text content is removed and the record is deleted or anonymized; technical metadata is retained with the related request, and security logs target 12 months; and platform backups containing form records are purged through the normal backup cycle, targeting 90 days or less where technically feasible.

11. Contact

Questions about this Privacy Policy can be sent to privacy@wellthrive-inc.com.