Trust & Security

1. Non-clinical product boundary

WellOps is operational and booking software for wellness services — not a medical, clinical, or health-records system. It is not designed for diagnoses, medical histories, treatment records, clinical notes, or other clinical-record content.

• WellOps handles business logistics: corporate requests, quotes, event schedules, booking slots, invoices, and provider account data.
• We do not ask for, and we ask employees not to submit, medical histories, diagnoses, medications, or treatment records. Free-text fields on our booking pages are limited to general session preferences (for example, pressure preference or mobility notes).
• Where a provider offers a licensed-healthcare service (such as acupuncture or IV hydration), that provider — not WellOps — owns any patient health information directly, in their own systems. Our request and booking pages for those services deliberately skip health and medical questions.

WellOps does not claim HIPAA compliance and does not determine whether a customer is a covered entity or business associate. If an organization believes its use case involves PHI or another regulated clinical record, that data must not be entered into WellOps; use the organization’s approved clinical system and seek appropriate legal guidance.

2. What data we collect

We collect only the business data needed to operate the platform. This is summarized here and covered in full in our Privacy Policy.

• Providers: business and contact details, brand preferences, insurance certificates and other uploaded documents, account credentials, and a payment method (stored by Stripe, not by us).
• Corporate clients: company and contact details and event preferences submitted with a wellness request.
• Employees: name, work email, and chosen appointment time, plus optional non-medical session preferences, an optional phone number for opted-in SMS reminders, and — where the provider enables them — intake responses and signed waivers. No account is required.
• Usage & analytics: aggregate product-usage data (pages and features used) and general device/location signals, used to improve the product — not for advertising.

We do not sell, rent, or trade personal data for marketing purposes.

3. Encryption in transit and at rest

• In transit: all connections to WellOps are encrypted with TLS (HTTPS). Traffic is served only over HTTPS.
• At rest: the database and uploaded files are encrypted at rest by our infrastructure providers (Supabase, hosted on AWS). Payment card data is encrypted and stored by Stripe — WellOps never stores full card numbers.

4. Tenant isolation & access control

Each provider is a separate tenant, and one tenant can never read or change another tenant’s data. We enforce this in multiple layers:

• Row-Level Security (RLS): our database enforces per-tenant row-level security policies, so data access is scoped to the owning account at the database layer — not just in application code. Public (unauthenticated) reads of sensitive tables return no rows.
• Role-based access control (RBAC): within a provider account, teammates have roles (Owner, Admin, User, Viewer). Sensitive areas such as Documents, revenue totals, and billing are restricted to Owners and Admins.
• Token-scoped public flows: corporate quote review, quote approval, employee booking, and invoice payment happen through opaque, unguessable capability tokens tied to a single record. These tokens are generated with cryptographically secure randomness, are never exposed in our public API responses, and grant access only to the one record they belong to.
• Least privilege: privileged operations run only in server-side code, never in the browser.

5. Sub-processors

We rely on a small set of established sub-processors to run the platform. Each processes only the data needed for its function:

• Supabase (hosted on AWS, US region) — database, authentication, and encrypted file storage.
• Stripe — payment processing and payouts. Stores provider payment methods; WellOps does not store card numbers.
• Resend — transactional email delivery (quotes, confirmations, notifications).
• Twilio — SMS (text message) delivery for opted-in reminders and notifications. Processes phone numbers and message content solely for delivery; SMS consent data is never sold or shared with third parties for their marketing purposes.
• PostHog — product analytics.
• Google Analytics 4 — web analytics.
• Replit — application hosting and deployment infrastructure; optional in-app AI assistance runs through Replit’s AI gateway (backed by OpenAI).
• Gelato — print fulfillment for providers who order printed marketing materials; receives order contents and shipping details only.
• Coverdash — optional insurance partner. WellOps does not transmit personal data to Coverdash; a provider only reaches Coverdash by clicking through to Coverdash’s own site.

6. Data retention

We keep data only as long as needed to operate the platform and meet legal obligations:

• Corporate contacts: eligible inactive personal fields are anonymized after the provider’s configured window (730 days by default; 365-day minimum).
• Bookings, intake responses, and terminal waitlist entries: eligible personal fields are anonymized after the configured participant window (730 days by default; 365-day minimum).
• Operational free text: eligible notes are redacted after the configured window (365 days by default; 180-day minimum); active, accepted, charged, and signed records are preserved.
• First-party analytics metadata: eligible metadata is removed after the configured window (365 days by default; 90-day minimum).
• Accounts, uploads, practitioners, communications, signed and financial records: handled through documented account/privacy review; signed, financial, consent, and deletion evidence is preserved for its applicable purpose.

Legal holds stop automated processing for the affected tenant and category. See the Privacy Policy (§5). These controls do not determine the regulatory obligations applicable to a particular organization.

7. Backups & disaster recovery

• Documented database backup, restore, and incident-recovery procedures.
• Private uploaded files use a soft-delete trash workflow before final removal.
• Recovery settings and restore evidence are verified operationally before a recovery window is represented as active.

WellOps does not claim a specific backup-retention or recovery window unless the current infrastructure configuration and a restore test support that claim.

8. Breach notification

If we become aware of a security breach affecting your data, we will notify affected users without undue delay and in accordance with applicable law. Our notice will describe, to the extent known, what happened, what data was involved, and the steps we and you can take in response.

9. Your data rights (access, export & deletion)

Providers can export all of their account data at any time from Settings (a downloadable archive of their records). You can also request access to, correction of, or deletion of your data by emailing us; we respond within 30 days, subject to legal retention requirements. Employees may request deletion of their booking data the same way. Full details are in our Privacy Policy.

10. Reporting a vulnerability & security contact

We welcome reports from security researchers and customers. If you believe you’ve found a vulnerability or have a security question, email hello@wellopsapp.com. Please give us reasonable time to investigate and remediate before any public disclosure. Our machine-readable security contact is published at /.well-known/security.txt.

11. What we do not claim

In the interest of honesty for due-diligence reviews: WellOps has not completed a SOC 2, ISO 27001, or comparable third-party audit, and does not claim one. We do not perform routine external penetration testing at this time. This page describes the real, currently-implemented controls above — nothing more. We will update it as our program matures.