Draft, pending counsel review
This is a working draft prepared to brief legal counsel. It is not yet the binding agreement. Bracketed items are decisions still open.
Legal
Privacy Policy
Draft version 2026-09-10
WELLTH holds some of the most personal data a person has: lab results, medications, how you slept, what you wrote in your journal. This policy says exactly what is collected, who receives it, how long it is kept and what you can ask us to do with it.
1. Who we are and how to reach us
WELLTH Mastery [legal entity name, state of formation and registered address] operates the WELLTH coaching program and the portal at portal.wellthmastery.com. Privacy requests go to [privacy contact email].
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone, date of birth, timezone | You, at intake |
| Program and intake | Goals, history, lifestyle answers, personality and archetype instruments | You, through the intake and Clearing |
| Health data | Lab results and biomarkers, medications, supplements, conditions, allergies, weight and body composition | You, the ordering physician, your own doctor |
| Wearable data | Sleep stages, heart rate, HRV, readiness, strain, steps, temperature | Oura, Whoop, Google (Fitbit and Pixel Watch) or Apple, when you connect a device |
| Daily check-ins and journal | Energy, mood, stress, adherence, free-text reflections, journal entries | You, in the portal or by message |
| Coaching calls | Recordings, transcripts, coach notes, session summaries | Zoom and Fathom during calls |
| Messages | Portal messages, Telegram messages to the WELLTH bot when enabled | You and your coach |
| Billing | Program tier, invoices, payment status | You and the payment processor |
| Technical | Sign-in events, device and browser, IP address, audit trail of who viewed what | Automatic |
3. How we use it
- To design, deliver and adjust your protocol and coaching.
- To prepare your coach before calls and keep continuity between sessions.
- To run the portal: sign-in, check-ins, messaging, reminders.
- To keep an audit trail of who accessed your data, for your protection.
- To improve WELLTH protocols across clients, in de-identified form (section 6).
- To meet legal obligations and respond to lawful requests.
WELLTH does not sell personal data and does not use it for advertising.
4. Who receives your data
The following services process client data on WELLTH's behalf. Each receives only what its role requires. Business associate or data processing agreements are [in place or pending, per vendor; confirm before client #2].
| Service | Role | What it receives |
|---|---|---|
| Supabase | Database, authentication, file storage | All portal data, including health data, encrypted at rest |
| Vercel | Hosting and server compute, AI Gateway | Data in transit through the portal, request logs |
| Anthropic | AI models behind Atlas, coaching assistance and agent drafts (called directly, or through the Vercel AI Gateway as a fallback) | The protocol and check-in context a given request needs, with direct identifiers minimised. No training on your data under the API terms |
| Resend | Transactional email | Your email address and the content of invites and reminders |
| Sentry | Error monitoring | Technical error reports, scrubbed of health data and identifiers before they leave the portal |
| Fathom | Call recording and transcription | Audio, video and transcripts of coaching calls |
| Slack | Your private channels with your coach and with Atlas, and internal WELLTH coordination | Messages in your private channels, which only you, your coach and Atlas can see: reminders, your daily brief (today's session, targets and supplement names) and your conversation. Lab values and medical history are never sent to Slack. Internal channels carry de-identified references only |
| Notion | Internal operations and documentation | De-identified working notes |
| Google (Calendar, Gmail, Sheets) | Scheduling and, when connected by WELLTH staff, email and spreadsheet sync | Calendar events, correspondence with you, exported summaries |
| Telegram | Optional messaging channel | Messages you send to the WELLTH bot, when you enable it |
| Oura, Whoop, Google (Fitbit and Pixel Watch), Apple | Wearable data providers | Nothing from WELLTH. WELLTH reads your metrics from them when you connect a device |
5. Coaching call recordings
Coaching calls are recorded and transcribed so your coach can prepare and nothing is lost between sessions. By joining a call you consent to recording. You may ask for any segment to be off the record; that segment is removed before the transcript is stored, and the removal is deterministic, not a judgement call made later.
6. Longitudinal and anonymized use
WELLTH learns what works by studying outcomes across clients over time. Your data may be used in de-identified, aggregated form to shape protocols and coaching for other clients, to evaluate WELLTH's own tools, and for internal research. De-identified means your name, contact details and any other direct identifier are removed first. Private journal entries are excluded from this use.
No testimonial, case study or public reference to you is made without your separate written consent.
7. How long we keep it
| Data | Kept for |
|---|---|
| Identity and contact | Program term plus [years] |
| Health data (labs, biomarkers, medications, conditions) | Program term plus [years], then de-identified |
| Daily check-ins and journal | Program term plus [years]. Private entries are visible only to you and are deleted on request at any time |
| Call recordings | [months] after the call; transcripts for the program term plus [years] |
| Audit events | [years], for compliance and your own access history |
| Technical logs and error reports | [90 days, confirm per vendor] |
| De-identified aggregates | Indefinitely |
8. Your rights: export, deletion, correction
- Export: ask for a machine-readable copy of your data. WELLTH responds within [30 days].
- Deletion: ask for your data to be deleted. WELLTH removes personally identifying information and retains only de-identified records, as described in section 6, unless a legal obligation requires longer retention.
- Correction: ask for inaccurate data to be corrected.
- Withdrawal: withdraw consent to recording or to longitudinal use. Withdrawing consent to recording may limit what the program can deliver.
- Complaint: raise a concern with [privacy contact] or with the regulator for your state.
9. State health privacy laws
Depending on where you live, additional rights apply. WELLTH treats every client under the strictest of these: the Washington My Health My Data Act, the California Confidentiality of Medical Information Act together with the CCPA and CPRA, and Nevada SB 370. These require separate consent before health data is collected or shared, a right to withdraw that consent, a right to have it deleted, and a ban on geofencing health-related locations. [Counsel to confirm applicability based on entity and client residency].
10. Security
- Every database table is protected by row-level security enforced in Postgres, tested by an adversarial test suite that runs on every code change.
- Data is encrypted in transit and at rest. Stored credentials for connected services are encrypted with per-record keys.
- Staff accounts require two-factor authentication.
- Every view of client data by staff is recorded in an append-only audit log.
- Error monitoring strips health data and identifiers before anything leaves the portal.
11. Age
The program and portal are for adults aged 18 and over.
12. Changes
Material changes to this policy are presented in the portal for acceptance before they take effect. The version you accepted is recorded with your account. The Terms of Service incorporate this policy.