Privacy Policy

Welling PLLC is a Washington professional limited liability company operating a metabolic health platform that combines a free wellness app with access to optional licensed clinical care. Our principal place of business is 539 Broadway, Tacoma, WA 98402. Welling operates both as a wellness technology platform and, with respect to users who opt into clinical care, as a healthcare provider subject to applicable state and federal law. Prescription visits in the app are provided by an independent medical practice that Welling works with (the “partner practice”), through that practice's own licensed Clinicians, as described in Section 7. The nature of our obligations with respect to your information depends on which services you use, as described below.

Account and identity information

• Name and email address
• Password, if you sign up with email (stored in hashed form; we never store your plaintext password)
• Your Apple ID identity when you use Sign in with Apple, or your Google account identity (name, email address, and Google account identifier) when you use Sign in with Google. Sign-in is by Apple, Google, or email. Welling never sees your Apple or Google password.

Health and wellness profile

• Date of birth, sex assigned at birth, height, weight, and activity level
• Health goals, dietary restrictions, and program preferences
• Facts you attest to in onboarding or later in the app, such as current medications, health conditions, and pregnancy. The agent reads what you attested, and a Clinician can review and correct it.
• Felt check-ins: the one word you choose for how the day feels
• Lab results you choose to bring in (a PDF or a photo of a report from any lab, for example bloodwork from Quest, Labcorp, or a Function Health membership), which we read marker by marker into your record with the lab's own ranges and flags
• Clinical intake information if you opt into clinical care (health history, medications, allergies, and related information)

Daily activity and logs

• Food entries, photos of meals, labels, and your fridge, and the nutritional data derived from them
• Weight check-ins and water intake logs
• Movement sessions and the sets you log
• Meal weeks and grocery lists the app builds for you
• Day counts of your logging activity
• Weekly summaries
• Your conversation with the in-app agent (the messages you send and its replies)
• Board layouts and design requests you make in the app
• Feedback you send through the Settings feedback form
• Food and weight entries an AI assistant you connected logs for you, marked as coming from your assistant (Section 10)

Clinical data (if you opt into clinical care)

• Health history, current medications, and allergies
• Lab results and monitoring data you share with your Clinician
• When lab work is ordered through Welling: the order, the legal name, date of birth, sex, contact details, and address it needs, and the results
• Prescription and treatment records
• Clinician notes and care plan information
• For a prescription visit with the partner practice (Section 7): your legal name, date of birth, sex, phone number, email address, and shipping address; your answers to the practice's questions (some are filled in from what you have already told the app, and you can change any of them before you send); the medication you choose and the pharmacy that fills it; a photo of your ID for your first visit, and a photo of a medication label when a question asks for one; your messages with the practice's Clinicians; the progress of your visit and prescription; and your agreement to the practice's telehealth consent and privacy policy

Billing (if you buy a membership, or are charged for a prescription or a visit)

• Your name and email address, and the card you enter on Stripe's own payment page. Welling never receives your full card number.
• A record of each checkout, charge, and refund: what it was for, the amount, and when

Prospective members (website enquiry form)

• Your first name, email address, and phone number if you choose to give it
• The membership tracks you said you were interested in, and the price and any code shown to you when you asked
• Which page and button you asked from, the page you arrived on, the site that referred you, any campaign tags in the link you followed, and your browser type
• We keep an enquiry for up to 12 months after our last contact with you, or until you ask us to delete it at privacy@wellinghealth.com

Device and usage data

• App activity, feature usage, and session information, kept in Welling's own event records. The app uses no third-party analytics vendor and no advertising identifier.
• On the public web pages our servers show, this policy among them, Google Analytics records visits with its own cookies (the page, your browser and device type, and an approximate location) and a scheduling script from SimplePractice loads. Neither loads in the app, or on a sign-in, join, account, care, or clinical page.
• Device type, operating system, and app version
• A push notification token and an install identifier the app creates for itself, only if you allow notifications. Neither is a hardware or advertising identifier.
• Apple Health (iOS) or Health Connect (Android) data if you grant permission. The types, and what each is used for, are listed in Section 9.
• Crash and error reports (via Sentry, described in Section 7)
• If you connect an AI assistant: its name and web address, the permissions you gave, and a record of its requests (Section 10)

• Provide and personalize the Service
• Give the in-app AI agent the context it needs to reply to you
• Show your Board, your trends, and your weekly summaries
• Provide clinical care, including sharing relevant health information with your licensed Clinician at Welling PLLC or at the partner practice
• Send a prescription visit you choose to send to the partner practice, and show you its Clinicians' replies and your prescription's progress
• Take payments and make refunds through Stripe, including charging the card you saved for a prescription or a visit as our Terms describe
• Generate aggregate de-identified participation reports for employer partners
• Communicate with you about your account, care, and program, including the notifications you turn on
• Contact you about membership when you ask us to on our website, and only about that
• Improve the Service and the quality of the agent's replies
• Comply with legal, regulatory, and professional obligations
• Answer an AI assistant you connected, within the permissions you approved (Section 10)

The Welling app uses Anthropic's Claude AI to power your health coach. When you send a message, log a meal, or submit a photo, relevant context from your profile and recent logs is sent to Claude to generate a personalized response. This context includes your daily macro totals, goals, recent food logs, and relevant profile information. We do not share your full health history or clinical records with Anthropic. Data sent to Anthropic is subject to Anthropic's privacy policy and terms of service. We use Anthropic's API under data processing terms consistent with our privacy obligations.

Welling holds a Business Associate Agreement with Anthropic, and this processing runs under it. The same AI processing also reads the meal, label, and fridge photos you submit, extracts the markers from lab reports you bring in, and writes your weekly summary.

Nothing from a prescription visit (your answers, your photos, or your messages with the partner practice's Clinicians) is ever sent to Anthropic or to any other AI model.

The agent is a wellness tool, not a Clinician. It does not diagnose, prescribe, or answer clinical questions; when you ask one, it declines and points you to your Clinician.

Pictures of the dishes in your meal plans

When the app builds a meal plan, it asks an image model for a picture of each dish. Only the dish's name and its ingredient names are sent, through OpenRouter to Google's image model; never your name, your goals, or anything else about you. The picture comes back to Welling and is shown with the meal.

Bringing your own model (optional)

In Settings, under Coach model, you can point the agent at your own OpenRouter account instead of Welling's AI. If you do, each agent turn is sent to OpenRouter under your account, and OpenRouter and the model provider you choose there process it under their own terms, not under our agreement with Anthropic. What leaves Welling on that rail is what the agent needs for the turn: your message and recent conversation, your profile and recent logs, data from a connected device or from Apple Health or Health Connect, the facts you have attested, and your felt check-ins. Lab results and anything from your Clinician are withheld on that rail; they stay on Welling's own AI. The connection is made with one tap in OpenRouter's own sign-in; no key is typed on your phone, and the key OpenRouter issues is held sealed on our servers, used only to make your turns, and removed when you disconnect or delete your account. You can switch back to Welling's AI at any time in the same setting, and you can revoke the key yourself at openrouter.ai/keys.

If you opt into clinical care through Welling, a licensed Clinician reviews your intake and, if appropriate, enters into a treatment relationship with you. In that context, information you share for clinical purposes is protected health information (“PHI”) subject to HIPAA and applicable state law. We use and disclose your PHI only as permitted or required by HIPAA, primarily for treatment, payment, and healthcare operations, and with your authorization for other purposes. Prescription visits are provided by the partner practice through its own licensed Clinicians (Section 7), and what you share for a visit is also governed by the practice's own privacy policy and telehealth consent, which the app shows you in full, and asks you to agree to, before your first visit is sent. The vendors that help us run the Service are named in the Service providers section below, which says which of them work under a Business Associate Agreement, and we update that list when they change.

Patient rights

• Right to access and receive a copy of your health records
• Right to request correction of inaccurate records
• Right to request restrictions on certain uses and disclosures
• Right to an accounting of disclosures
• Right to receive a copy of our Notice of Privacy Practices, which sets out these rights in full, at wellinghealth.com/notice-of-privacy-practices

To exercise any of these rights, contact privacy@wellinghealth.com. For the records of a prescription visit, we answer for our own copy, and we pass your request to the partner practice promptly for its chart, which the practice keeps and answers for. If you believe your privacy rights have been violated, you may file a complaint with the U.S. Department of Health and Human Services at www.hhs.gov/ocr. For users who use only the App's wellness features without opting into clinical care, HIPAA does not apply. Your wellness data is treated as consumer health information as described in Section 6.

Welling is subject to the Washington My Health My Data Act (“MHMD Act”) with respect to Washington residents' consumer health data. Under the MHMD Act, you have the right to:

• Know what consumer health data we collect about you and why
• Access the consumer health data we hold about you
• Withdraw consent to our collection or sharing of your consumer health data
• Request deletion of your consumer health data

We do not sell consumer health data. We do not share consumer health data for advertising purposes. To exercise your rights under the MHMD Act, contact privacy@wellinghealth.com. We will respond within the timeframes required by law. Other states may have similar consumer health data laws. We apply comparable protections to residents of states with applicable legislation.

We do not sell your personal data. We do not share your health data with advertisers. We may share your information in the following circumstances:

Service providers

We use third-party vendors to operate the Service: Supabase (the app's database, sign-in, and file storage, hosted in the United States); Google Cloud (stores the care information of prescription visits and your consent records, hosted in the United States, under a Business Associate Agreement, Section 8); Anthropic (AI processing under a Business Associate Agreement, Section 4); OpenRouter and Google (draw the pictures of the dishes in your meal plans from each dish's name and ingredients alone, Section 4); Stripe (payments and refunds: your name, email address, and card, and for each charge its amount and a general description that never names a medicine); Junction (lab orders and results when lab work is ordered through Welling, and wearable and health device data, under a Business Associate Agreement, Section 9); Quest Diagnostics (draws and tests the samples of lab work ordered through Welling); Vercel (web and API hosting, under a Business Associate Agreement); Expo (mobile app infrastructure, push notification delivery, and app updates); Resend (delivers to us by email the feedback you send from Settings and the enquiries you send from our website); Google Analytics and SimplePractice (on our public web pages only, Section 2); and Sentry (crash and error reports). These vendors access your data only as necessary to provide their services and are bound by confidentiality obligations.

Resend also delivers the email that tells you an AI assistant was connected to your account, so it receives your email address and the assistant's name (Section 10).

Crash reporting

The app sends crash reports to Sentry so we can find and fix bugs, and our servers report their errors to Sentry the same way (earlier versions of the app also sent a sample of performance traces). These reports are not tied to your account identity, and they do not contain your health values, your logs, your messages, or anything from a care visit.

Sign-in providers

When you sign in with Apple or with Google, that provider confirms your identity to Welling and gives us your name, email address, and an account identifier. We do not receive your Apple or Google password. Apple or Google learns that you used their sign-in with Welling.

Kroger (only if you connect it)

If you connect your Kroger account in Settings, you sign in on Kroger's own site and grant Welling permission to add items to your cart. When you tap send, the items on your grocery list, matched to Kroger products by product code and quantity, are added to the cart in your own Kroger account at the store you chose. Welling keeps the connection tokens, the store you chose, and a short-lived receipt of each send so a repeated tap does not add the same items twice. Nothing else in your Welling record goes to Kroger. Your cart and any purchase are handled by Kroger under Kroger's own privacy policy. You can disconnect in Settings at any time and can also revoke Welling's access from your Kroger account.

Your own AI model (only if you connect it)

If you connect your own OpenRouter account, agent turns go to OpenRouter under your account as described in Section 4.

Your AI assistant (only if you connect it)

If you connect an AI assistant, the parts of your record you allow go to it and to the company that makes it, as described in Section 10.

Services your phone contacts directly

If you scan a barcode in the older logging screen, the barcode is looked up directly from your phone at Open Food Facts; the lookup is not tied to your account and Welling does not keep it. If you use voice logging, the audio is processed by your phone's own speech recognition service (Apple's on iOS, Google's on Android). Welling never receives the audio, only the text.

The partner practice (prescription visits)

Prescription visits in the app are provided by an independent medical practice that Welling works with, through its own licensed Clinicians. When you send a visit, we send the practice what the visit needs (the information listed for a prescription visit in Section 2), and its Clinicians' replies and decisions and your prescription's progress come back to you in the app. The practice's own telehealth consent and privacy policy, which name it, are shown to you in full in the app, and you agree to them before your first visit is sent; that policy governs what the practice does with your information. We keep our copy of your ID and label photos only until the practice confirms it has them (Section 8). A notification Welling sends you about a visit carries the same neutral line every time and says nothing about the visit. The practice may also contact you directly, as its own documents describe.

Licensed Clinicians

When you receive clinical care from Welling PLLC, we share relevant health information with its licensed Clinicians who provide your treatment, consistent with your care relationship and applicable law. For a prescription visit, the partner practice's Clinicians receive what you send for that visit, as described above.

Pharmacy partners

A prescription is filled by a licensed pharmacy that dispenses it to you. For a prescription from the partner practice, the medication you choose and the pharmacy that fills it go to the practice with your visit, and the practice sends the pharmacy what it needs to fill the prescription and get it to you. For a prescription from a Welling PLLC Clinician, we may share information necessary for dispensing, verification, fulfillment, and refill coordination with pharmacies and related vendors as permitted by law.

Employer partners

If you access Welling through an employer benefit program, we may provide your employer with aggregate, de-identified participation reports. We never share your individual health information, food logs, weight data, prescriptions, or clinical communications with your employer.

Legal and regulatory

We may disclose information when required by law, regulation, valid legal process, or professional obligations, or when we believe in good faith that disclosure is necessary to protect health, safety, or rights.

Business transfers

If Welling is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction subject to confidentiality commitments and continued protections consistent with this policy.

Your app data is stored in Supabase, a SOC 2 compliant cloud database provider hosted in the United States. The care information of a prescription visit (the information listed for it in Section 2) and your consent records are stored apart from it, in Google Cloud in the United States, under Google's Business Associate Agreement. Your ID and medication label photos are kept there only until the partner practice confirms it has received them, or until they can no longer be sent, and are then deleted; a backup copy is destroyed within 40 days after deletion. All data is encrypted in transit using TLS and encrypted at rest. Meal photos and the lab reports you bring in are stored in private cloud storage buckets with access controls. We implement reasonable technical and organizational safeguards appropriate to the sensitivity of the information we process. However, no system is perfectly secure. You are responsible for maintaining the confidentiality of your login credentials and for keeping your device secure. If you believe your account has been compromised, notify us immediately at privacy@wellinghealth.com.

If you grant permission, the Welling app reads a small set of types from Apple Health (on iOS) or Health Connect (on Android). The permission sheet on your phone lists every type we ask for, and everything in the app works without any of them.

On Android (Health Connect)

Four types: steps, sleep, weight, and heart rate. Steps and sleep are shown to you: today's steps and last night's sleep on the Board and in the fortnight view, the sleep chart in your record's trends, and a shorter movement session offered after poor sleep. Weight and heart rate are not displayed on Android; they feed the agent's context, so it can refer to your latest synced weight and its direction, and to recent resting heart rate and heart rate variability as a recovery signal, when it gives nutrition, training, and habit guidance. Access is read-only. We do not request background reading or the extended-history permission, and we write nothing to Health Connect.

On iOS (Apple Health)

Weight (with body fat percentage, if your device records it), steps, sleep, heart rate, workouts, and active energy. Steps and sleep are shown on the Board and in trends, weight and heart rate feed the agent's context as described above, and workouts and active energy sync into your record with the rest and are not shown as their own tiles in the current app. If you allow it, the app also writes to Apple Health, and only when you log a meal: the calories, protein, carbohydrates, and fat of that meal as nutrition entries.

Synced data flows through the Junction (Vital) SDK inside the app to Junction's platform and on to your Welling account, so it can appear next to what you log and give the agent context. Junction is our contracted health-data processor and, through this sync, receives nothing else. We keep the synced history so the app can show trends over time, and our software may note sustained changes in your own data (for example, in weight trend or sleep) in your record. Any such note is descriptive, produced by software, and is not a medical evaluation. Where your membership includes clinical services, licensed Clinicians may review your record, including these notes, as part of your care. We do not use Apple Health or Health Connect data for advertising, and we never sell it. Apple Health and Health Connect data reaches an AI assistant you connect only as Section 10 describes.

You can disconnect at any time in Welling's Settings under Health connections. On iOS you can also turn Welling off in the Health app (Profile, Apps, Welling); on Android, in the Health Connect app's permission screen. When you disconnect, the app stops reading and syncing. Deleting your account (Section 11) removes the wearable data held on your behalf and ends the Junction connection. To request deletion of stored health data without closing your account, contact us at privacy@wellinghealth.com.

• Access the personal data we hold about you
• Correct inaccurate information via Settings in the app
• Delete your account in the app: open Settings and tap Delete my account. If you have never been a patient of Welling PLLC or of the partner practice, your account and everything in it are deleted at once. If your care created a medical record (for example, lab work ordered through Welling PLLC, or a prescription visit with the partner practice), the app closes your account and holds that record for the period given at the end of this section, with your access removed: your sign-in stops working, collection stops, and the app data that is not part of the record is deleted. The full list of what is deleted and what is held is on our account deletion page. You can also request deletion by emailing support@wellinghealth.com with the subject line Delete my account.
• Clear your logs without closing your account: Settings, Reset all data removes your food and weight logs and clears your macro targets, then signs you out. Your account, profile, and other data stay.
• Export your data by contacting privacy@wellinghealth.com
• Withdraw consent to certain data processing where consent is the legal basis
• Lodge a complaint with a data protection authority or the Washington Attorney General
• Disconnect an AI assistant at any time in Settings, Connected assistants (Section 10)

For clinical records, additional rights apply under HIPAA as described in Section 5. Welling PLLC is a licensed clinical practice. Medical records created in Welling PLLC's care are kept for 10 years after your last contact with a Welling Clinician, or longer if the law requires it. Closing your account does not delete them sooner: after you close it, they are held with your access removed and with no other use, and are then deleted. You keep the right to a copy of your medical record after your account is closed. The records of a prescription visit are the partner practice's: the practice keeps them under its own policy and the law, and Welling keeps its copy for as long as our agreement with the practice and the law require.

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us at privacy@wellinghealth.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will post the updated policy on our website and update the effective date. If we make material changes, we will notify you by email or in-app notification before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

Regulatory contacts:

• Washington Attorney General (privacy): www.atg.wa.gov
• U.S. Department of Health and Human Services (HIPAA complaints): www.hhs.gov/ocr