Privacy Policy

This Privacy Policy explains how WellOp ("WellOp", "we", "us") collects, uses and protects information when you use wellop.ai (the "Service"). Because the Service works with sensitive health information, we have written this to be as plain as possible.

What we collect

Account information — name, email address, password (stored only as a secure hash by our authentication provider).

Profile information you choose to give us — date of birth, sex, height, weight, activity level, dietary preferences, goals, current supplements, and any notes you add.

Health data you upload — laboratory reports, imaging summaries, wearable exports (sleep, activity, heart-rate variability, VO2max and similar), nutrition logs, body-composition readings and any other files you provide. We treat all of this as sensitive personal information.

Billing information — handled entirely by Stripe. We receive your subscription status and the last four digits of your card, never the full card number.

Technical information — IP address, browser type, device information and basic usage logs, collected by our hosting and infrastructure providers to keep the Service secure and working.

How we use it

• To generate and update your personalized wellness plan. This is the core purpose of the Service and the only reason we process your health data.
• To operate your account, process payments and send transactional email (confirmations, receipts, plan-ready notifications).
• To provide support when you contact us.
• To keep the Service secure and to comply with law.

We do not sell your personal information, and we do not use your health data for advertising or share it with advertisers, data brokers or insurers.

Artificial intelligence

To generate your plan, we transmit your profile and uploaded files to Anthropic, PBC, the provider of the Claude AI model, through its commercial API. Under Anthropic's commercial terms, API inputs and outputs are not used to train their models. We do not send your name or email to the AI provider unless you have placed them inside a file you uploaded.

Who we share data with

We share information only with service providers who need it to run the Service and who are bound by contractual confidentiality obligations:

• Supabase — database, authentication and encrypted file storage
• Vercel — website hosting
• Anthropic — AI plan generation
• Stripe — payment processing
• Email delivery provider — transactional email

We may also disclose information if required by law, to protect the rights or safety of any person, or as part of a merger or acquisition (in which case this policy will continue to apply to your data).

HIPAA

WellOp is a direct-to-consumer wellness service, not a healthcare provider, health plan or clearinghouse, and is therefore generally not a "covered entity" under HIPAA. We nonetheless apply safeguards appropriate for sensitive health information as described below.

Security

Your files are stored in a private, access-controlled bucket, encrypted at rest and in transit. Database access is governed by row-level security so that each member can only read their own records. Administrative access is limited to WellOp staff who need it to provide coaching or support. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.

Retention and deletion

We keep your data for as long as your account is open. You can delete any individual upload from your portal at any time, which permanently removes the file. You can delete your entire account (all profile data, uploads and plans) by emailing hello@wellop.ai; we complete deletion within 30 days, except for billing records we must keep for tax and accounting purposes.

Your rights

Depending on where you live, you may have the right to access, correct, download or delete your personal information, to object to or restrict certain processing, and to not be discriminated against for exercising these rights. Email hello@wellop.ai and we will respond within 30 days. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Washington (including under the My Health My Data Act) and other states with consumer privacy laws may exercise their rights under those laws through the same email.

Children

The Service is not directed to anyone under 18 and we do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

Cookies

We use only strictly necessary cookies to keep you logged in. We do not use advertising or cross-site tracking cookies.

Changes

We will post any changes here with a new "last updated" date and notify you by email of material changes.

Contact

WellOp · hello@wellop.ai