Privacy Policy

1.1 Information You Provide

• Account Information: Name, email address, phone number, password, and account type (personal or facility)
• Resident/Loved One Information: Full name, phone number, room number, emergency contacts, communication preferences, and care notes
• Payment Information: Credit card details and billing address (processed and stored by our PCI DSS-compliant payment processor; we do not store full card numbers)
• Facility Information: Facility name, address, timezone, and organizational details
• Staff Data: Names, phone numbers, roles, and shift schedules
• Support Communications: Messages you send to our support team

1.2 Information Collected Automatically

• Check-in Responses: SMS messages and voice call transcriptions from check-in interactions
• Sentiment and Wellness Data: AI-generated sentiment scores, mood indicators, distress flags, and wellness trends derived from check-in responses
• Usage Data: Log data including IP addresses, browser type, device information, pages viewed, and timestamps
• Device Data: If using the WA-200 companion device: voice interaction logs, battery status, and connectivity telemetry
• Push Notification Tokens: Device identifiers for delivering mobile push notifications

1.3 Information from Third Parties

• Communication Delivery Providers: Delivery receipts and status information for SMS and voice calls
• Authentication Providers: Basic profile information from supported auth methods

We use collected information for the following purposes:

• Service Delivery: To conduct scheduled check-ins, analyze responses, generate wellness reports, and deliver alerts
• Account Management: To create and manage your account, process payments, and provide customer support
• Safety and Alerts: To detect distress signals and notify designated caregivers and emergency contacts
• Service Improvement: To improve our AI models and enhance features using aggregated, de-identified data only
• Communications: To send service-related notifications, billing receipts, and important account updates
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

Given the nature of our service, SMS and voice communication data receives special handling:

We do NOT sell your personal data. Ever.

We share information only in these limited circumstances:

• Service Providers: Trusted third-party providers that help deliver the Service, including cloud infrastructure, communication delivery, payment processing, and AI analysis services. These providers are contractually bound to protect your data and use it only for specified purposes.
• Authorized Caregivers: Wellness data and alerts are shared with caregivers and family members you designate in your account.
• Legal Requirements: When required by law, subpoena, court order, or governmental request.
• Safety: When we believe in good faith that disclosure is necessary to protect the safety of a person or prevent fraud.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, with advance notice before your data becomes subject to a different privacy policy.

We implement comprehensive security measures:

For healthcare facility accounts, WellAI operates as a Business Associate under HIPAA:

• Business Associate Agreements (BAAs) available for qualifying facility accounts
• HIPAA-compliant data handling, storage, and transmission
• Employee training on HIPAA requirements
• Regular risk assessments and security audits
• Breach notification compliant with the HIPAA Breach Notification Rule

Personal (family) accounts are not HIPAA-covered, but receive the same high standard of data protection.

We retain data according to the following schedule:

We use trusted third-party service providers to operate WellAI, including:

• Cloud Database & Authentication Provider: Secure data storage and user authentication (hosted in US)
• Communication Delivery Provider: SMS and voice call delivery for check-ins and alerts
• AI Voice Conversation Provider: AI-powered voice interactions for wellness check-ins
• AI Analysis Provider: Natural language processing for sentiment analysis and conversation generation
• Payment Processing Provider: Secure payment handling and billing (PCI DSS compliant)
• Push Notification Provider: Mobile push notification delivery

Each provider processes data according to their own privacy policies. We share only the minimum data necessary for each service to function. Specific provider names are available upon request.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request your data in a structured, machine-readable format
• Restriction: Request limitation of processing
• Objection: Object to certain types of processing
• Withdraw Consent: Where processing is based on consent, withdraw at any time

To exercise any of these rights, contact support@wellai.live. We respond within 30 days.

Account administrators are responsible for obtaining and maintaining proper consent from residents (or their legal representatives) before enrolling them in the Service. This includes consent for:

• Receiving automated SMS messages and voice calls
• Processing of communication data by AI systems
• Sharing of wellness data with designated caregivers

We use only essential cookies required for the Service to function (authentication tokens, session management). We do not use third-party advertising cookies or tracking pixels. We may use anonymized analytics to improve the product.

The Service is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe we have, contact support@wellai.live and we will promptly delete such information.

Your data may be processed and stored in Canada and the United States. Where transferred internationally, we ensure appropriate safeguards are in place consistent with applicable data protection laws.

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before taking effect. The “Last Updated” date at the top indicates the latest revision. Continued use constitutes acceptance.

For privacy questions or to exercise your data rights: