Privacy Policy

Welling PLLC is a Washington professional limited liability company operating a metabolic health platform that combines a free wellness app with access to optional licensed clinical care. Our principal place of business is 539 Broadway, Tacoma, WA 98402. Welling operates both as a wellness technology platform and, with respect to users who opt into clinical care, as a healthcare provider subject to applicable state and federal law. The nature of our obligations with respect to your information depends on which services you use, as described below.

Account and identity information

• Name and email address
• Password, if you sign up with email (stored in hashed form; we never store your plaintext password)
• Your Apple ID identity when you use Sign in with Apple, or your Google account identity (name, email address, and Google account identifier) when you use Sign in with Google. Sign-in is by Apple, Google, or email. Welling never sees your Apple or Google password.

Health and wellness profile

• Date of birth, sex assigned at birth, height, weight, and activity level
• Health goals, dietary restrictions, and program preferences
• Facts you attest to in onboarding or later in the app, such as current medications, health conditions, and pregnancy. The agent reads what you attested, and a Clinician can review and correct it.
• Felt check-ins: the one word you choose for how the day feels
• Lab results you choose to bring in (a PDF or a photo of a report from any lab, for example bloodwork from Quest, Labcorp, or a Function Health membership), which we read marker by marker into your record with the lab's own ranges and flags
• Clinical intake information if you opt into clinical care (health history, medications, allergies, and related information)

Daily activity and logs

• Food entries, photos of meals, labels, and your fridge, and the nutritional data derived from them
• Weight check-ins and water intake logs
• Movement sessions and the sets you log
• Meal weeks and grocery lists the app builds for you
• Day counts of your logging activity
• Weekly summaries
• Your conversation with the in-app agent (the messages you send and its replies)
• Board layouts and design requests you make in the app
• Feedback you send through the Settings feedback form

Clinical data (if you opt into clinical care)

• Health history, current medications, and allergies
• Lab results and monitoring data you share with your Clinician
• Prescription and treatment records
• Clinician notes and care plan information

Device and usage data

• App activity, feature usage, and session information, kept in Welling's own event records. We use no third-party analytics vendor and no advertising identifier.
• Device type, operating system, and app version
• A push notification token and an install identifier the app creates for itself, only if you allow notifications. Neither is a hardware or advertising identifier.
• Apple Health (iOS) or Health Connect (Android) data if you grant permission. The types, and what each is used for, are listed in Section 9.
• Crash and performance reports (via Sentry, described in Section 7)

• Provide and personalize the Service
• Give the in-app AI agent the context it needs to reply to you
• Show your Board, your trends, and your weekly summaries
• Provide clinical care, including sharing relevant health information with your licensed Clinician
• Coordinate pharmacy fulfillment when a prescription is issued
• Generate aggregate de-identified participation reports for employer partners
• Communicate with you about your account, care, and program, including the notifications you turn on
• Improve the Service and the quality of the agent's replies
• Comply with legal, regulatory, and professional obligations

The Welling app uses Anthropic's Claude AI to power your health coach. When you send a message, log a meal, or submit a photo, relevant context from your profile and recent logs is sent to Claude to generate a personalized response. This context includes your daily macro totals, goals, recent food logs, and relevant profile information. We do not share your full health history or clinical records with Anthropic. Data sent to Anthropic is subject to Anthropic's privacy policy and terms of service. We use Anthropic's API under data processing terms consistent with our privacy obligations.

Welling holds a Business Associate Agreement with Anthropic, and this processing runs under it. The same AI processing also reads the meal, label, and fridge photos you submit, extracts the markers from lab reports you bring in, and writes your weekly summary.

The agent is a wellness tool, not a Clinician. It does not diagnose, prescribe, or answer clinical questions; when you ask one, it declines and points you to your Clinician.

Bringing your own model (optional)

In Settings, under Coach model, you can point the agent at your own OpenRouter account instead of Welling's AI. If you do, each agent turn is sent to OpenRouter under your account, and OpenRouter and the model provider you choose there process it under their own terms, not under our agreement with Anthropic. What leaves Welling on that rail is what the agent needs for the turn: your message and recent conversation, your profile and recent logs, data from a connected device or from Apple Health or Health Connect, the facts you have attested, and your felt check-ins. Lab results and anything from your Clinician are withheld on that rail; they stay on Welling's own AI. The connection is made with one tap in OpenRouter's own sign-in; no key is typed on your phone, and the key OpenRouter issues is held sealed on our servers, used only to make your turns, and removed when you disconnect or delete your account. You can switch back to Welling's AI at any time in the same setting, and you can revoke the key yourself at openrouter.ai/keys.

If you opt into clinical care through Welling, a licensed Clinician reviews your intake and, if appropriate, enters into a treatment relationship with you. In that context, information you share for clinical purposes is protected health information (“PHI”) subject to HIPAA and applicable state law. We use and disclose your PHI only as permitted or required by HIPAA, primarily for treatment, payment, and healthcare operations, and with your authorization for other purposes. Clinical services are facilitated through Bask Health, Inc., our technology and care coordination partner, which operates as our subcontractor business associate under a HIPAA-compliant Business Associate Agreement.

Patient rights

• Right to access and receive a copy of your health records
• Right to request correction of inaccurate records
• Right to request restrictions on certain uses and disclosures
• Right to an accounting of disclosures
• Right to receive a copy of this Notice of Privacy Practices

To exercise any of these rights, contact privacy@wellinghealth.com. If you believe your privacy rights have been violated, you may file a complaint with the U.S. Department of Health and Human Services at www.hhs.gov/ocr. For users who use only the App's wellness features without opting into clinical care, HIPAA does not apply. Your wellness data is treated as consumer health information as described in Section 6.

Welling is subject to the Washington My Health My Data Act (“MHMD Act”) with respect to Washington residents' consumer health data. Under the MHMD Act, you have the right to:

• Know what consumer health data we collect about you and why
• Access the consumer health data we hold about you
• Withdraw consent to our collection or sharing of your consumer health data
• Request deletion of your consumer health data

We do not sell consumer health data. We do not share consumer health data for advertising purposes. To exercise your rights under the MHMD Act, contact privacy@wellinghealth.com. We will respond within the timeframes required by law. Other states may have similar consumer health data laws. We apply comparable protections to residents of states with applicable legislation.

We do not sell your personal data. We do not share your health data with advertisers. We may share your information in the following circumstances:

Service providers

We use third-party vendors to operate the Service, including Supabase (database, sign-in, and file storage, hosted in the United States), Anthropic (AI processing under a Business Associate Agreement, Section 4), Bask Health (care coordination and pharmacy fulfillment for clinical members), Junction (wearable and health device data processing, Section 9), Vercel (web and API hosting), Expo (mobile app infrastructure, push notification delivery, and app updates), Resend (delivers the feedback you send from Settings to us by email), and Sentry (crash and performance reports). These vendors access your data only as necessary to provide their services and are bound by confidentiality obligations.

Crash reporting

The production app sends crash reports and a sample of performance traces to Sentry so we can find and fix bugs. These reports are not tied to your account identity, and they do not contain your health values, your logs, or your messages.

Sign-in providers

When you sign in with Apple or with Google, that provider confirms your identity to Welling and gives us your name, email address, and an account identifier. We do not receive your Apple or Google password. Apple or Google learns that you used their sign-in with Welling.

Kroger (only if you connect it)

If you connect your Kroger account in Settings, you sign in on Kroger's own site and grant Welling permission to add items to your cart. When you tap send, the items on your grocery list, matched to Kroger products by product code and quantity, are added to the cart in your own Kroger account at the store you chose. Welling keeps the connection tokens, the store you chose, and a short-lived receipt of each send so a repeated tap does not add the same items twice. Nothing else in your Welling record goes to Kroger. Your cart and any purchase are handled by Kroger under Kroger's own privacy policy. You can disconnect in Settings at any time and can also revoke Welling's access from your Kroger account.

Your own AI model (only if you connect it)

If you connect your own OpenRouter account, agent turns go to OpenRouter under your account as described in Section 4.

Services your phone contacts directly

If you scan a barcode in the older logging screen, the barcode is looked up directly from your phone at Open Food Facts; the lookup is not tied to your account and Welling does not keep it. If you use voice logging, the audio is processed by your phone's own speech recognition service (Apple's on iOS, Google's on Android). Welling never receives the audio, only the text.

Licensed Clinicians

When you receive clinical care through Welling, we share relevant health information with the licensed Clinicians who provide your treatment, consistent with your care relationship and applicable law.

Pharmacy partners

If you receive a prescription through Welling, we may share information necessary for dispensing, verification, fulfillment, and refill coordination with pharmacies and related vendors as permitted by law.

Employer partners

If you access Welling through an employer benefit program, we may provide your employer with aggregate, de-identified participation reports. We never share your individual health information, food logs, weight data, prescriptions, or clinical communications with your employer.

Legal and regulatory

We may disclose information when required by law, regulation, valid legal process, or professional obligations, or when we believe in good faith that disclosure is necessary to protect health, safety, or rights.

Business transfers

If Welling is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction subject to confidentiality commitments and continued protections consistent with this policy.

Your data is stored in Supabase, a SOC 2 compliant cloud database provider hosted in the United States. All data is encrypted in transit using TLS and encrypted at rest. Meal photos and the lab reports you bring in are stored in private cloud storage buckets with access controls. We implement reasonable technical and organizational safeguards appropriate to the sensitivity of the information we process. However, no system is perfectly secure. You are responsible for maintaining the confidentiality of your login credentials and for keeping your device secure. If you believe your account has been compromised, notify us immediately at privacy@wellinghealth.com.

If you grant permission, the Welling app reads a small set of types from Apple Health (on iOS) or Health Connect (on Android). The permission sheet on your phone lists every type we ask for, and everything in the app works without any of them.

On Android (Health Connect)

Four types: steps, sleep, weight, and heart rate. Steps and sleep are shown to you: today's steps and last night's sleep on the Board and in the fortnight view, the sleep chart in your record's trends, and a shorter movement session offered after poor sleep. Weight and heart rate are not displayed on Android; they feed the agent's context, so it can refer to your latest synced weight and its direction, and to recent resting heart rate and heart rate variability as a recovery signal, when it gives nutrition, training, and habit guidance. Access is read-only. We do not request background reading or the extended-history permission, and we write nothing to Health Connect.

On iOS (Apple Health)

Weight (with body fat percentage, if your device records it), steps, sleep, heart rate, workouts, and active energy. Steps and sleep are shown on the Board and in trends, weight and heart rate feed the agent's context as described above, and workouts and active energy sync into your record with the rest and are not shown as their own tiles in the current app. If you allow it, the app also writes to Apple Health, and only when you log a meal: the calories, protein, carbohydrates, and fat of that meal as nutrition entries.

Synced data flows through the Junction (Vital) SDK inside the app to Junction's platform and on to your Welling account, so it can appear next to what you log and give the agent context. Junction is our contracted health-data processor and receives nothing else. We keep the synced history so the app can show trends over time, and our software may note sustained changes in your own data (for example, in weight trend or sleep) in your record. Any such note is descriptive, produced by software, and is not a medical evaluation. Where your membership includes clinical services, licensed Clinicians may review your record, including these notes, as part of your care. We do not use Apple Health or Health Connect data for advertising, and we never sell it.

You can disconnect at any time in Welling's Settings under Health connections. On iOS you can also turn Welling off in the Health app (Profile, Apps, Welling); on Android, in the Health Connect app's permission screen. When you disconnect, the app stops reading and syncing. Deleting your account (Section 10) removes the wearable data held on your behalf and ends the Junction connection. To request deletion of stored health data without closing your account, contact us at privacy@wellinghealth.com.

• Access the personal data we hold about you
• Correct inaccurate information via Settings in the app
• Delete your account in the app: open Settings and tap Delete my account. If you have never been a patient of the practice, your account and everything in it are deleted at once. If your care created a medical record (for example, lab work ordered through the practice), the app closes your account and holds that record as the law requires, with your access removed: your sign-in stops working, collection stops, and the app data that is not part of the record is deleted. The full list of what is deleted and what is held is on our account deletion page. You can also request deletion by emailing support@wellinghealth.com with the subject line Delete my account.
• Clear your logs without closing your account: Settings, Reset all data removes your food and weight logs and clears your macro targets, then signs you out. Your account, profile, and other data stay.
• Export your data by contacting privacy@wellinghealth.com
• Withdraw consent to certain data processing where consent is the legal basis
• Lodge a complaint with a data protection authority or the Washington Attorney General

For clinical records, additional rights apply under HIPAA as described in Section 5. Welling PLLC is a licensed clinical practice, and Washington law requires it to keep patient records for a set period. Medical records created in your care are retained for that period after you close your account, with your access removed and with no other use, and are then deleted. You keep the right to a copy of your medical record after your account is closed.

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us at privacy@wellinghealth.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will post the updated policy on our website and update the effective date. If we make material changes, we will notify you by email or in-app notification before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

Regulatory contacts:

• Washington Attorney General (privacy): www.atg.wa.gov
• U.S. Department of Health and Human Services (HIPAA complaints): www.hhs.gov/ocr