Privacy Policy (privacy-prospective-1)

Current processing information and existing commitments: This notice describes current data handling for all visitors and users, including existing providers. Reading or acknowledging it is not acceptance of new contractual Terms. Publication does not extinguish earlier privacy commitments applicable to an existing provider or amend a separately signed provider agreement; where earlier commitments remain applicable they continue to be honored, subject to their own amendment requirements. A prior privacy version is not assigned to an account without evidence of that version. The drafting date above is not a publication or contractual effective date.

WellOps is owned and operated by WellOps, LLC, an Arizona limited liability company (“we,” “us,” or “our”). This notice explains our handling of information about provider account users, practitioners, employer contacts, participants, prospects, research respondents, and people contacting support. We determine purposes for our own account, billing, security, research, and outreach activities. For provider-created client, practitioner, and participant records, the provider determines the service relationship and its purposes; WellOps processes information to operate the provider’s platform workflows. The precise controller/processor roles and applicable rights depend on the processing and governing law. Corporate clients do not enter a separate WellOps service contract merely by accepting a provider’s quote.

1. Data We Collect

Providers

Business name, legal name, contact email, phone, website, and service area.
Brand preferences (color, tagline, public URL slug).
Insurance documentation (Certificate of Insurance), stored in Supabase Storage (AWS-backed).
Service agreements and other documents generated or uploaded through the Platform, stored in Supabase Storage (AWS-backed).
Payment method (processed and stored by Stripe — WellOps does not store card numbers).
Account credentials (managed by Supabase Auth), and team member accounts the Provider invites (name, email, role).
Practitioner/staff roster information the Provider manages (name, contact details, service info, and — where the Provider uses these features — contractor applications, résumés, license and insurance details, and background-check tracking dates).
Where a Provider enables native practitioner onboarding, W-9 tax identifiers and direct-deposit bank details entered by practitioners. Form answers are encrypted before database storage; complete values are also included in generated PDFs kept in private file storage for the Provider. Routine form views show masked sensitive values. An optional external payment-setup link instead directs practitioners to the Provider’s separate service and does not itself send bank or tax credentials to WellOps.
Client, contact, quote, event, invoice, and communication records the Provider creates while running their business on the Platform.
Referral information (referral codes and referred-account credits) where the Provider participates in referral programs.
Private provider-created assessments and revisions about practitioners, including evaluation notes and history where the provider uses these tools.

Corporate Clients

Company name, contact name, email, and phone number provided when submitting a wellness request.
Event preferences including preferred date, employee count, and event type.
Provider-managed quotes, agreements, signatures, invoices, card-on-file authorizations, and related transaction records when these workflows are used.

Employees

Name and work email address collected at the time of booking a wellness appointment.
Selected appointment date and time.
Optional mobile phone number, if the employee opts in to SMS reminders for their booking.
Where the Provider has configured them for an event: intake form responses and electronically signed waivers (waiver signatures are stored with the waiver text version signed, the typed signature, and a timestamp).
Optional session preferences provided to help the wellness provider prepare — such as focus areas, pressure preference, and an optional free-text field for general considerations (for example, mobility or comfort notes).
Waitlist details, payment status for employee-paid bookings, and optional post-event feedback, where those features are used. Individual answers may be visible to authorized provider users.
No account creation is required. WellOps is not a medical or healthcare records system. We ask employees not to submit, and we do not request, medical histories, diagnoses, or treatment records.

Usage and Analytics Data

Allowlisted analytics metadata on approved public marketing and safe authenticated-provider routes, collected through PostHog and Google Analytics 4. Analytics excludes secure-link or capability-token context, query-string context, referrer context, free text, and uploaded content.
IP addresses and request/device metadata may be processed for security, abuse prevention, rate limits, signature evidence, and diagnostics. Analytics vendors may receive network metadata with browser requests; we do not claim WellOps calculates your geographic location.
This data is used to understand platform usage, improve features, and diagnose errors. It is not used to identify individual users for advertising purposes.

Other interactions

Support inquiries and related correspondence, feedback, and service communications.
Prospect business and contact details, publicly available website information and research notes used for founder-reviewed outreach, plus opt-out and suppression records.
Research survey answers, optional email, session/browser identifiers and submission metadata. Individual responses may be reviewed internally; reported findings may be aggregated. Providing an email does not promise a report.
Browser-local preferences or draft/session state used by certain workflows; clearing browser storage may remove these from that device.

2. How We Use Your Data

Providers

To operate and display your branded booking page.
To send you new corporate request notifications, quote updates, and booking confirmations.
To process WellOps platform fees via Stripe — your monthly subscription (Professional, Growth, Scale, or Enterprise) or, on Pay As You Go, the $49–$99 per-event fee charged when a client accepts an event and you confirm it.
To review submitted business information during onboarding; a directory listing is not a certification of practitioner credentials.

Corporate Clients

To relay your wellness request to your chosen Provider.
To send you the Provider’s quote for review and acceptance.
To distribute the employee self-booking link after quote acceptance.

Employees

To reserve your selected time slot and prevent double-booking.
To send a booking confirmation email to your work email address.
To share your name and appointment time with the Provider to facilitate your session.
To manage optional intake, waivers, waitlists, payments, and provider-enabled feedback or event communications where applicable.

Electronic signatures in supported provider agreements, practitioner onboarding and event waivers can be recorded with the applicable document text or version, signer-entered details and timing evidence. The precise record varies by workflow; recording a signature does not establish the enforceability of every document or replace jurisdiction-specific consent or paper-copy requirements.

3. Data Sharing

We share data only as necessary to operate the Platform:

Supabase — database, authentication, and file storage infrastructure. Data is stored on Supabase’s servers (AWS-backed). This includes uploaded documents such as Certificates of Insurance and service agreements. See Supabase’s Privacy Policy.
Stripe — provider subscriptions and platform fees; provider-connected invoice and employee booking payments, optional saved corporate payer cards/holds, and print-order payments when used. Card credentials are processed by Stripe, not stored as full card numbers by WellOps. Eligible bank-payment details entered through Stripe are handled by Stripe; this is distinct from native practitioner direct-deposit forms collected and stored by WellOps as described above. We retain transaction references, status and authorization evidence. See Stripe’s Privacy Policy.
Resend — transactional email delivery (booking confirmations, quote notifications).
Twilio — SMS (text message) delivery for reminders and notifications to recipients who have opted in. Twilio processes phone numbers and message content solely to deliver those messages. See Twilio’s Privacy Policy.
Replit — application hosting and runtime infrastructure; processes application requests and responses. OpenAI via Replit AI Integrations processes submitted help-chat text and chat history, and founder-selected prospect details, public-source web-search results and research notes for founder-reviewed outreach drafts. No automatic participant-record feed is intended. If a user deliberately connects an external AI tool such as Claude to their account, the data they authorize that tool to access may also be processed by that tool’s provider; this is distinct from the direct OpenAI integration.
PostHog and Google Analytics 4 — minimized analytics on approved public marketing and safe authenticated-provider route categories when configured. Route context is sanitized to exclude secure-link/token, query-string and referrer context; confidential content, health data, credentials and free text are not intentionally sent as analytics events. Network request metadata may still reach these vendors.
Gelato — optional print fulfillment. A print order shares the print-artwork URL, recipient name and delivery address, and provider account email with Gelato for fulfillment. Print-ready PDFs uploaded for this purpose receive publicly addressable URLs; do not include confidential information in print artwork. See Gelato’s Privacy Policy.
AWS S3 — an owner-controlled private destination used for a documented manual snapshot of uploaded-file bytes. A daily independent file-backup schedule is not established; retention of snapshots depends on separately configured lifecycle and deletion procedures.
Coverdash — if a Provider clicks through to Coverdash’s site, Coverdash’s own privacy policy governs any data they collect. WellOps does not transmit personal data to Coverdash. See our Insurance Disclaimer.

We do not sell, rent, or trade personal data to any third party for marketing purposes.

SMS (Text Message) Consent

Where WellOps sends SMS text messages (for example, booking confirmations, appointment reminders, and event or schedule notifications), we do so only to recipients who have expressly opted in — for example, by checking the SMS opt-in box when booking. Consent to receive SMS is optional and is not a condition of booking or purchasing any service. Message frequency varies with your bookings and events. Message and data rates may apply, and delivery is subject to your mobile carrier; carriers are not liable for delayed or undelivered messages.

You can withdraw consent at any time by replying STOP to any message; we stop sending to the opted-in messages after processing your request and confirm the opt-out. Reply HELP for help or START to re-subscribe.

SMS consent data — including phone numbers and opt-in information — is not sold or shared with third parties for their marketing purposes. Phone numbers and message content are shared only with our SMS delivery provider (Twilio) as necessary to deliver the messages you have consented to receive.

4. Employee Data — Special Notice

Participants book services offered by their provider, sometimes through an employer event. Booking information can include the optional and provider-configured fields described in section 1.

Participant information is available to the provider to manage the event, and may be used for confirmations, optional reminders, feedback and payment processing where applicable. Employer access, if any, depends on the event workflow and permissions; this notice does not promise that every response is inaccessible to the employer.

Employees may request deletion of their booking data by emailing hello@wellopsapp.com.

5. Data Retention

Provider accounts, uploaded documents, and practitioner records: Retained while the account or working relationship is active and then reviewed through the documented workspace-deletion or privacy-request process.
Corporate contacts: A configured retention process can anonymize selected personal fields of eligible inactive contacts after a configured window (default 730 days; minimum 365); it does not delete every contact row.
Bookings, intake responses, and terminal waitlist entries: The process can anonymize selected fields of eligible records after a configured participant window (default 730 days; minimum 365). Booking eligibility is measured from booking creation, not necessarily event date.
Operational free text: Selected request messages, terminal event notes, and non-accepted/non-charged quote notes can be redacted after a configured window (default 365 days; minimum 180). Other fields and records may remain.
First-party analytics: Eligible event metadata (not necessarily the event row) can be removed after a configured window (default 365 days; minimum 90). PostHog and Google Analytics have separate vendor retention settings.
Signed, consent, financial, tax, and deletion evidence: Preserved for their applicable evidence, accounting, dispute, or legal purpose and reviewed separately rather than removed by an automated personal-data sweep.

These are configured eligibility windows, not a guarantee that production purges are currently scheduled or enabled. When enabled, the tenant-scoped process runs in bounded batches, records actions and respects applicable category legal holds. Other records, including waivers, assessments, tax/bank PDFs, support, survey, messages, uploaded artwork, vendor copies and backups require separate review or lifecycle processes. We do not claim that all records expire with this sweep.

6. Security

We use HTTPS, infrastructure encryption at rest, tenant-scoped and role-based access controls, and token-scoped public workflows. Private practitioner and insurance files are distinct from publicly addressable print artwork uploaded for fulfillment. We maintain recovery procedures; a documented manual independent file snapshot is not an assurance of active daily backups. We ask users not to submit clinical records. Pattern-based screening and validation can reduce some sensitive submissions but cannot detect or prevent every health disclosure. No system is perfectly secure, so we encourage you to use strong passwords and report any suspected unauthorized access or vulnerability to hello@wellopsapp.com (also published at /.well-known/security.txt). If a breach affects your data, we will assess notification obligations and notify as required by applicable law. For an overview, see our Trust & Security page.

7. Your Rights

Depending on your location, our role and the circumstances, you may be able to request:

Access the personal data we hold about you.
Correct inaccurate information in your account.
Delete your account and associated data (subject to legal retention requirements).
Export available account data. Provider Owners and Admins can request a downloadable export in Settings; it covers selected supported records, not every database row, uploaded file, vendor copy or third-party record. Others may request assistance by email.
Object to certain processing activities.

To exercise any of these rights, email hello@wellopsapp.com. We will verify and review the request, including whether the provider should handle a provider-controlled record, and respond according to applicable requirements. Please state any jurisdiction or legal basis relevant to your request. We cannot promise a universal response deadline, deletion of all copies or entitlement to every listed action.

Note on deletion: An approved deletion request may anonymize, redact, or remove eligible live records. Financial, signed, consent, security, or other evidence may be preserved when needed for its documented purpose. WellOps records the action taken and any exception; it does not promise a specific backup-expiry date unless that recovery configuration has been separately verified.

8. Cookies and Tracking Technologies

WellOps uses cookies and similar tracking technologies for the following purposes:

Essential session cookies — required to maintain authentication and core platform functionality. Cannot be disabled.
Analytics requests: When configured, PostHog runs with persistence disabled and no person profiles, autocapture or session recording; GA4 uses direct browser requests with credentials omitted and a fixed client identifier rather than the usual GA cookie script. Sanitized route context is sent on approved routes; network metadata may accompany requests.
Referral attribution: A referral code may be stored in a browser cookie to attribute a provider signup and eligible referral credit.

We do not use advertising cookies or retargeting pixels, and we do not track users across unaffiliated third-party websites for marketing purposes.

9. Children

WellOps is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, contact hello@wellopsapp.com.

10. Changes to This Policy

We may update this notice from time to time and will present updates as appropriate to the change and applicable requirements. A revised publication date does not establish that a particular user received notice or accepted a new version.

11. Contact

For privacy questions, contact us at hello@wellopsapp.com.

Also see: Terms of Service · Insurance Disclaimer

1. Data We Collect

Providers

Business name, legal name, contact email, phone, website, and service area.
Brand preferences (color, tagline, public URL slug).
Insurance documentation (Certificate of Insurance), stored in Supabase Storage (AWS-backed).
Service agreements and other documents generated or uploaded through the Platform, stored in Supabase Storage (AWS-backed).
Payment method (processed and stored by Stripe — WellOps does not store card numbers).
Account credentials (managed by Supabase Auth), and team member accounts the Provider invites (name, email, role).
Practitioner/staff roster information the Provider manages (name, contact details, service info, and — where the Provider uses these features — contractor applications, résumés, license and insurance details, and background-check tracking dates).
Where a Provider enables native practitioner onboarding, W-9 tax identifiers and direct-deposit bank details entered by practitioners. Form answers are encrypted before database storage; complete values are also included in generated PDFs kept in private file storage for the Provider. Routine form views show masked sensitive values. An optional external payment-setup link instead directs practitioners to the Provider’s separate service and does not itself send bank or tax credentials to WellOps.
Client, contact, quote, event, invoice, and communication records the Provider creates while running their business on the Platform.
Referral information (referral codes and referred-account credits) where the Provider participates in referral programs.
Private provider-created assessments and revisions about practitioners, including evaluation notes and history where the provider uses these tools.

Corporate Clients

Company name, contact name, email, and phone number provided when submitting a wellness request.
Event preferences including preferred date, employee count, and event type.
Provider-managed quotes, agreements, signatures, invoices, card-on-file authorizations, and related transaction records when these workflows are used.

Employees

Name and work email address collected at the time of booking a wellness appointment.
Selected appointment date and time.
Optional mobile phone number, if the employee opts in to SMS reminders for their booking.
Where the Provider has configured them for an event: intake form responses and electronically signed waivers (waiver signatures are stored with the waiver text version signed, the typed signature, and a timestamp).
Optional session preferences provided to help the wellness provider prepare — such as focus areas, pressure preference, and an optional free-text field for general considerations (for example, mobility or comfort notes).
Waitlist details, payment status for employee-paid bookings, and optional post-event feedback, where those features are used. Individual answers may be visible to authorized provider users.
No account creation is required. WellOps is not a medical or healthcare records system. We ask employees not to submit, and we do not request, medical histories, diagnoses, or treatment records.

Usage and Analytics Data

Allowlisted analytics metadata on approved public marketing and safe authenticated-provider routes, collected through PostHog and Google Analytics 4. Analytics excludes secure-link or capability-token context, query-string context, referrer context, free text, and uploaded content.
IP addresses and request/device metadata may be processed for security, abuse prevention, rate limits, signature evidence, and diagnostics. Analytics vendors may receive network metadata with browser requests; we do not claim WellOps calculates your geographic location.
This data is used to understand platform usage, improve features, and diagnose errors. It is not used to identify individual users for advertising purposes.

Other interactions

Support inquiries and related correspondence, feedback, and service communications.
Prospect business and contact details, publicly available website information and research notes used for founder-reviewed outreach, plus opt-out and suppression records.
Research survey answers, optional email, session/browser identifiers and submission metadata. Individual responses may be reviewed internally; reported findings may be aggregated. Providing an email does not promise a report.
Browser-local preferences or draft/session state used by certain workflows; clearing browser storage may remove these from that device.

2. How We Use Your Data

Providers

To operate and display your branded booking page.
To send you new corporate request notifications, quote updates, and booking confirmations.
To process WellOps platform fees via Stripe — your monthly subscription (Professional, Growth, Scale, or Enterprise) or, on Pay As You Go, the $49–$99 per-event fee charged when a client accepts an event and you confirm it.
To review submitted business information during onboarding; a directory listing is not a certification of practitioner credentials.

Corporate Clients

To relay your wellness request to your chosen Provider.
To send you the Provider’s quote for review and acceptance.
To distribute the employee self-booking link after quote acceptance.

Employees

To reserve your selected time slot and prevent double-booking.
To send a booking confirmation email to your work email address.
To share your name and appointment time with the Provider to facilitate your session.
To manage optional intake, waivers, waitlists, payments, and provider-enabled feedback or event communications where applicable.

3. Data Sharing

We share data only as necessary to operate the Platform:

Supabase — database, authentication, and file storage infrastructure. Data is stored on Supabase’s servers (AWS-backed). This includes uploaded documents such as Certificates of Insurance and service agreements. See Supabase’s Privacy Policy.
Stripe — provider subscriptions and platform fees; provider-connected invoice and employee booking payments, optional saved corporate payer cards/holds, and print-order payments when used. Card credentials are processed by Stripe, not stored as full card numbers by WellOps. Eligible bank-payment details entered through Stripe are handled by Stripe; this is distinct from native practitioner direct-deposit forms collected and stored by WellOps as described above. We retain transaction references, status and authorization evidence. See Stripe’s Privacy Policy.
Resend — transactional email delivery (booking confirmations, quote notifications).
Twilio — SMS (text message) delivery for reminders and notifications to recipients who have opted in. Twilio processes phone numbers and message content solely to deliver those messages. See Twilio’s Privacy Policy.
Replit — application hosting and runtime infrastructure; processes application requests and responses. OpenAI via Replit AI Integrations processes submitted help-chat text and chat history, and founder-selected prospect details, public-source web-search results and research notes for founder-reviewed outreach drafts. No automatic participant-record feed is intended. If a user deliberately connects an external AI tool such as Claude to their account, the data they authorize that tool to access may also be processed by that tool’s provider; this is distinct from the direct OpenAI integration.
PostHog and Google Analytics 4 — minimized analytics on approved public marketing and safe authenticated-provider route categories when configured. Route context is sanitized to exclude secure-link/token, query-string and referrer context; confidential content, health data, credentials and free text are not intentionally sent as analytics events. Network request metadata may still reach these vendors.
Gelato — optional print fulfillment. A print order shares the print-artwork URL, recipient name and delivery address, and provider account email with Gelato for fulfillment. Print-ready PDFs uploaded for this purpose receive publicly addressable URLs; do not include confidential information in print artwork. See Gelato’s Privacy Policy.
AWS S3 — an owner-controlled private destination used for a documented manual snapshot of uploaded-file bytes. A daily independent file-backup schedule is not established; retention of snapshots depends on separately configured lifecycle and deletion procedures.
Coverdash — if a Provider clicks through to Coverdash’s site, Coverdash’s own privacy policy governs any data they collect. WellOps does not transmit personal data to Coverdash. See our Insurance Disclaimer.

We do not sell, rent, or trade personal data to any third party for marketing purposes.

SMS (Text Message) Consent

4. Employee Data — Special Notice

Participants book services offered by their provider, sometimes through an employer event. Booking information can include the optional and provider-configured fields described in section 1.

Employees may request deletion of their booking data by emailing hello@wellopsapp.com.

5. Data Retention

Provider accounts, uploaded documents, and practitioner records: Retained while the account or working relationship is active and then reviewed through the documented workspace-deletion or privacy-request process.
Corporate contacts: A configured retention process can anonymize selected personal fields of eligible inactive contacts after a configured window (default 730 days; minimum 365); it does not delete every contact row.
Bookings, intake responses, and terminal waitlist entries: The process can anonymize selected fields of eligible records after a configured participant window (default 730 days; minimum 365). Booking eligibility is measured from booking creation, not necessarily event date.
Operational free text: Selected request messages, terminal event notes, and non-accepted/non-charged quote notes can be redacted after a configured window (default 365 days; minimum 180). Other fields and records may remain.
First-party analytics: Eligible event metadata (not necessarily the event row) can be removed after a configured window (default 365 days; minimum 90). PostHog and Google Analytics have separate vendor retention settings.
Signed, consent, financial, tax, and deletion evidence: Preserved for their applicable evidence, accounting, dispute, or legal purpose and reviewed separately rather than removed by an automated personal-data sweep.

6. Security

7. Your Rights

Depending on your location, our role and the circumstances, you may be able to request:

Access the personal data we hold about you.
Correct inaccurate information in your account.
Delete your account and associated data (subject to legal retention requirements).
Export available account data. Provider Owners and Admins can request a downloadable export in Settings; it covers selected supported records, not every database row, uploaded file, vendor copy or third-party record. Others may request assistance by email.
Object to certain processing activities.

8. Cookies and Tracking Technologies

WellOps uses cookies and similar tracking technologies for the following purposes:

Essential session cookies — required to maintain authentication and core platform functionality. Cannot be disabled.
Analytics requests: When configured, PostHog runs with persistence disabled and no person profiles, autocapture or session recording; GA4 uses direct browser requests with credentials omitted and a fixed client identifier rather than the usual GA cookie script. Sanitized route context is sent on approved routes; network metadata may accompany requests.
Referral attribution: A referral code may be stored in a browser cookie to attribute a provider signup and eligible referral credit.

We do not use advertising cookies or retargeting pixels, and we do not track users across unaffiliated third-party websites for marketing purposes.

9. Children

WellOps is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, contact hello@wellopsapp.com.

10. Changes to This Policy

11. Contact

For privacy questions, contact us at hello@wellopsapp.com.

Also see: Terms of Service · Insurance Disclaimer