Privacy Policy

Thank you for choosing to be part of our community at Wellnecity ("company", "we", "us", or "our"). We are committed to protecting your Personal Information and your right to privacy. If you have any questions or concerns about our policy or our practices with regards to your Personal Information, please contact us at legal@wellnecity.com. For purposes of this Privacy Policy, "Personal Information" means information that can be used to identify, locate or contact you.

When you visit our Website, www.wellnecity.com (together with any other websites we control, the "Website") and use our services, you trust us with your Personal Information. We take your privacy very seriously and as such, we have put certain safeguards in place to keep the information you share with us secure.

We encourage you to carefully review this privacy policy (this "Policy") as it details what information we collect, how we use it and what rights you have in relation to it. If there are any terms in this Policy that you do not agree with, please discontinue use of our Website and our services.

By accessing the Website and/or using our services, you acknowledge that you are legally authorized to enter into a contractual agreement for yourself, or on the behalf of another individual or entity, and you hereby accept the terms of this Policy and our Terms of Use. If you cannot accept these terms, then you may not use the Website or associated services. If you use the Website or the Services outside of the United States you do so at your own risk, without any representations, warranties or conditions from us.

This Policy applies to all information, if any, collected through our websites (such as www.wellnecity.com, our mobile Website, and our social media pages).

Please read this privacy policy carefully as it will help you make informed decisions about sharing your personal information with us.

For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), the data controller for Personal Information collected through this Website is:

A "data controller" is the party that decides why and how your Personal Information is processed. Where we process health plan data on behalf of an employer client, that client is the controller and we act as a processor under our contract with them; this Policy covers the Website, not that engagement.

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Rights requests should be sent to the privacy address above and are handled within one month, as required by Article 12(3).

We collect Personal Information that you voluntarily provide to us when registering at the Website to express your interest in obtaining information about us or our Services, when participating in activities on the Website responding to an open job posting, or otherwise contacting us.

The Personal Information that we collect depends on the context of your interactions with us and the Website, the choices you make, and the products and features you use. The Personal Information we collect may include the following:

• Name and Contact Data. We collect your first and last name, email address, postal address, phone number, and other similar contact data.
• Credentials (if applicable). We collect passwords, password hints, and similar security information used for authentication and account access.

All Personal Information that you provide to us must be true, complete and accurate, and you must notify us of any changes to such Personal Information.

We automatically collect certain information when you visit, use or navigate the Website. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Website and other technical information. This information is primarily needed to maintain the security and operation of our Website, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this — including a full table of what we set, why, and for how long — in our Cookie Policy.

We use Personal Information collected via our Website for a variety of business purposes described below. We process your Personal Information to improve your experience with our Website, to communicate with you, and at times to satisfy certain legal requirements.

• To send you marketing and promotional communications: We and/or our third-party marketing partners, when applicable, may use the Personal Information you send to us for our marketing purposes. You can opt-out of our marketing emails at any time using the Unsubscribe link in the email; provided that we may still use your Personal Information to contact you in certain situations including if your Personal Information may have been compromised.
• To send administrative information to you. We may use your Personal Information to send you product, service and new feature information and/or information about changes to our terms, conditions, and policies.
• Request feedback: We may use your information to request feedback and to contact you about your use of our Website.
• To improve our Website: We may use your information to improve our Website and user experience.
• To protect our Website for business purposes and/or legal reasons. We may use your information as part of our efforts to keep our Website safe and secure (for example, for fraud monitoring and prevention).
• To enforce our terms, conditions and policies for business purposes, legal reasons and/or possibly contractual rights under certain company agreements.
• To respond to legal requests and prevent harm. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
• For other business purposes. We may use your information for other business purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Website, products, services, marketing and your experience.
• Vital Interests and Legal Rights. We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved.
• Vendors, Consultants and Other Third-Party Service Providers. We may share your data with third party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. Examples include: data analysis, email delivery, hosting services, customer service and marketing efforts. We may allow selected third parties to use tracking technology on the Website, which will enable them to collect data about how you interact with the Website over time. Unless described in this Policy, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes.
• Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honor this Policy. Affiliates include our parent company and any subsidiaries, joint venture partners or other companies that we control or that are under common control with us.
• Business Partners. We may share your information with our business partners to offer you certain products, services or promotions.
• With your Consent. We may disclose your Personal Information for any other purpose with your consent.
• Other Users. When you share Personal Information (for example, by posting comments, contributions or other content to the Website) or otherwise interact with public areas of the Website, such Personal Information may be viewed by all users and may be publicly distributed outside the Website in perpetuity.
• Consider Your Job: If you apply for a job, to consider you for employment.

If you are in the European Economic Area or the United Kingdom, Article 6 GDPR requires us to have a lawful basis for each purpose for which we process your Personal Information. Ours are:

• Consent (Art. 6(1)(a)). Analytics and marketing cookies, and sending you marketing emails such as Wellnecity Insights. You may withdraw consent at any time, and doing so is as easy as giving it — see our Cookie Policy or the Cookie Preferences link in the footer. Withdrawal does not affect processing carried out before you withdrew.
• Steps taken at your request prior to entering a contract (Art. 6(1)(b)). Responding to a demo request, a desk review request, or a book request that you submit through our forms.
• Legitimate interests (Art. 6(1)(f)). Keeping the Website secure and available, preventing fraud and abuse of our forms, and understanding in aggregate how our content performs. We balance these interests against your rights, and you may object at any time on grounds relating to your particular situation.
• Legal obligation (Art. 6(1)(c)). Retaining records where tax, accounting, or other law requires it, and responding to lawful requests from authorities.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects concerning you, within the meaning of Article 22 GDPR. We do not process special categories of data (Article 9) through this Website.

Yes. Wellnecity is based in the United States and our Website and email systems are hosted there. If you access the Website from the European Economic Area, the United Kingdom, or Switzerland, your Personal Information will be transferred to and processed in the United States, which has not received an adequacy decision of general application from the European Commission.

Where we transfer Personal Information out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) with the recipients of that data, together with supplementary technical measures including encryption in transit and at rest and access controls assessed under our HITRUST certification and SOC 2 attestation.

You may request a copy of the safeguards we rely on for a given transfer by writing to privacy@wellnecity.com.

We will only keep your Personal Information for as long as it is necessary to carry out the activities detailed in this Policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements).

When we have no ongoing legitimate business need to process your Personal Information, we will either delete or anonymize it, or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible.

In practice, and unless a longer period is required by law:

• Website enquiries and demo requests. Retained for up to 24 months from our last substantive contact with you, then deleted.
• Marketing subscriptions. Retained until you unsubscribe or withdraw consent, plus a suppression record kept indefinitely so that we do not contact you again.
• Cookie consent records. Held in your browser for 12 months, after which we ask you again.
• Security and server logs. Retained for a short operational period and then rotated out.

If you are in the European Economic Area or the United Kingdom, you have the following rights under Articles 15 to 22 GDPR:

• Access (Art. 15). To be told whether we process Personal Information about you and to receive a copy of it, along with the purposes, recipients, and retention period.
• Rectification (Art. 16). To have inaccurate information corrected and incomplete information completed.
• Erasure (Art. 17). To have your Personal Information deleted where it is no longer necessary, where you withdraw the consent it rested on, or where you successfully object.
• Restriction (Art. 18). To have us pause processing while a dispute about accuracy or our legitimate interests is resolved.
• Portability (Art. 20). To receive the information you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
• Objection (Art. 21). To object at any time to processing based on our legitimate interests on grounds relating to your particular situation, and to object to direct marketing at any time — for direct marketing we will always stop.
• Withdrawal of consent (Art. 7(3)). To withdraw any consent you gave, at any time, as easily as you gave it. This does not affect the lawfulness of processing carried out before you withdrew.

To exercise any of these rights, write to privacy@wellnecity.com. We respond within one month of receiving your request, as required by Article 12(3), and may extend that by two further months for complex requests — we will tell you if we do. Exercising your rights is free of charge. We may ask you for information needed to confirm your identity before we act.

Right to complain (Art. 77). If you believe we have handled your Personal Information unlawfully, you may lodge a complaint with your local data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EEA, the list of national authorities is published by the European Data Protection Board (edpb.europa.eu). We would appreciate the chance to address your concern first.

Marketing communications. You can opt out of our marketing emails at any time using the unsubscribe link in any message, or by emailing us. We will still send you administrative messages about matters such as a security incident affecting your information.

Account Information

You may at any time review or change the information in your account or terminate your account by contacting us at legal@wellnecity.com.

Upon your request to terminate your account, we will delete your information from our active databases. However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or comply with legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Website. You can also change or withdraw your cookie consent at any time using the Cookie Preferences link in the footer of every page. For further information, please see our Cookie Policy.

California consumers have certain rights regarding access to their Personal Information, including (i) the right to receive information about if and how we have collected, used, stored, disclosed and transferred Personal Information about you (ii) the right to have us delete your Personal Information we have about you (iii) the right to opt-out of the sharing of your Personal Information with third parties for direct marketing purposes and (iv) other rights as determined by the California Consumer Privacy Act. In addition, the California Consumer Privacy Act permits users who are California residents to request and obtain from us, twice a year and free of charge, information about categories of Personal Information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared Personal Information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below. If you submit a request, we will use the information you submit and the information we have in our systems to try to verify your identity and to match the Personal Information we have collected about you, if any, to your identity.

If you are under 18 years of age, reside in California, and have provided your personal data to our Website, you have the right to request removal of unwanted data that you shared with us. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Website, but please be aware that the data may not be completely or comprehensively removed from our systems.