What we collect,in plain words.

WellPal operates this website, the waitlist, and Ai4RD. For data-protection purposes we are the controller of the personal data described here.

• WellPal Incorporated
• Ithaca, New York 14853
• United States
• Privacy contact: privacy@wellpal.io

Our full identity, and the parts of it we have not yet published, are set out honestly on the Legal Notice page — including that we have not yet appointed a representative in the European Union or the United Kingdom. We would rather tell you that than leave you to discover it.

Two different things, and it matters which one you are reading about.

This website, today

Everything in §§III to XII describes what actually happens now when you visit www.wellpal.io, join the waitlist, or use Ai4RD. All of it is live.

The WellPal iPhone app, when it ships

The app is not released. Nothing about it is running and no one has an account. §XIII describes how it is designed to handle your Apple Health data, and it is a statement of intent about unreleased software, not a description of something you can use today. The app will carry its own privacy disclosure at launch.

Three things, and that is the whole list. Each with the reason we process it and the legal basis we rely on.

There is no account, no sign-in, no password, and no profile on this website. We do not buy data about you, we do not enrich what you give us, and we do not sell or share it with anyone for their own purposes.

A full inventory of what is stored in your browser — and a switch to turn the page count off — is on the Cookie & Tracking Policy page.

Information about your health is special-category data. It gets stricter treatment in law and it gets stricter treatment here.

The only place on this website where health information can arise is Ai4RD, and only because you type it. We do not ask for it, we do not require it, and nothing else on the site collects it. Joining the waitlist tells us your email address and nothing about your health.

Where you do provide health information to Ai4RD, we rely on your explicit consent under Art. 9(2)(a). We ask for that consent on the Ai4RD page before your first message, and we tell you there what leaves your browser and who receives it. Withdrawing is straightforward, because there is almost nothing to withdraw from: we hold no copy of your conversations. Deleting a session, or clearing this site’s data in your browser, erases it outright and also clears the consent record — you will be asked again before your next message. You can also write to us and we will confirm in writing that we hold nothing of yours.

If you are in the United States, some state laws use a broader definition of health data than you might expect — broad enough that joining a habit-app waitlist could fall inside it. We have written a separate Consumer Health Data Notice covering that, as Washington law requires.

Ai4RD is a research preview. Here is the exact path your words take.

1. You type a message. It goes to our server, which adds the system instructions and forwards the conversation to OpenRouter, our inference provider, which routes it to a language model.
2. If the model decides a search would help, it produces a search query and our server sends that query — not your whole conversation — to Perplexity, our search provider. The system instructions tell the model to search with clinical keywords rather than your narrative. That is an instruction to a model, not a guarantee, and we would rather you knew the difference.
3. The reply streams back to your browser and is saved in your browser, in local storage. We keep no copy.

What we do not do

• We do not log the content of your messages. Our server records error codes, status numbers and counts — never your message text, and never an upstream error body, which can quote it back.
• We instruct OpenRouter to route only to providers that do not use submitted content to train models.
• We do not have, and cannot get, a list of what you asked. There is no transcript on our side to hand over, sell, or lose.

Please do not enter another person’s identifiable information, including a patient’s. Ai4RD is not a HIPAA-covered service and we have no business associate agreement with you. The Terms of Service set this out in full.

We use a small number of service providers. They process data on our instructions under written terms, and none of them may use it for their own purposes.

That is the complete list. There is no advertising network, no data broker, no analytics beyond the page count, no customer-messaging tool, and no third party embedded in these pages.

We will disclose personal data if the law requires it — a valid court order, for example. If that ever happens and we are permitted to tell you, we will.

We are established in the United States, and all three of our providers are too. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred to a country outside your own.

We rely on the European Commission’s Standard Contractual Clauses under Art. 46(2)(c), together with the UK Addendum where UK data is involved, as offered by each provider in its own data-processing terms; and on the EU–US Data Privacy Framework where a provider is certified under it. We are completing that paperwork provider by provider, and we would rather tell you it is in progress than imply it is finished.

If you want to know exactly which safeguard applies to a particular transfer, write to privacy@wellpal.io and we will tell you where each provider publishes its terms, and send you whatever we hold. We would rather say that than promise a countersigned document we may not yet be able to put in your hands.

• Waitlist signups: until you ask us to remove yours, or 24 months after WellPal is released, whichever comes first. If the app is never released we will delete the list and tell you.
• Ai4RD conversations: we never hold them. They live in your browser until you delete them or clear your browser data.
• Rate-limiting records: IP-derived keys count against a rolling 24-hour window in server memory, are cleared shortly after it expires, and are never written to disk.
• Server logs: error codes and status numbers only, retained by our host on its standard schedule. They contain no message content and no email addresses.

If you are in the EEA or the UK, the law gives you all of the following. We will honour every one of them for anyone who asks, wherever you live, because drawing that line by geography seems petty.

• Access. Ask what we hold about you and get a copy.
• Rectification. Have anything wrong corrected.
• Erasure. Have it deleted.
• Restriction. Ask us to hold it but stop using it while something is in dispute.
• Portability. Receive it in a machine-readable form, or have it sent elsewhere.
• Objection. Object to anything we do on the basis of legitimate interests — the page count and the referring page.
• Withdraw consent. At any time, for the waitlist and for Ai4RD. Withdrawing does not affect what we did lawfully before you withdrew.
• Complain to a regulator. You can lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner’s Office (opens in a new tab); in the EEA, your own country’s authority, listed by the European Data Protection Board (opens in a new tab). You do not have to contact us first, though we would like the chance to fix it.

How to exercise them

Email privacy@wellpal.io. For the waitlist, writing from the address you signed up with is enough for us to find and act on your record; we will not ask you for identity documents to delete an email address.

We answer within one month, as the law requires. In practice we answer much faster, but a month is what we promise, because a promise we can keep on a bad week is worth more than one we cannot.

Providing your data is never a statutory or contractual requirement. You can read every page of this site without giving us anything. We do not make any decision about you by automated means, and there is no profiling.

This section is your notice at collection. The categories we collect, why, and how long, are in the table in §III; the recipients are in §VI.

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have. There is therefore nothing for a “Do Not Sell or Share” link to switch off — but if that ever changes, we will add one before it does, not after.
• Sensitive personal information. We do not use or disclose it for any purpose other than providing the service you asked for.
• Your rights. Depending on your state you may have rights to know, access, correct, delete, and obtain a portable copy, and to be free from discrimination for exercising them. We extend all of these to every US resident regardless of state. Use privacy@wellpal.io.
• Opt-out preference signals. We honour Global Privacy Control automatically. If your browser sends it, the page count is switched off for you without you doing anything.
• Consumer health data. Washington, Nevada and Connecticut have specific rules. Our Consumer Health Data Notice covers them.

This website, the waitlist and Ai4RD are for people aged 16 and over. We do not knowingly collect personal data from anyone younger, and we have no service directed at children.

If you believe a child has given us personal data, write to privacy@wellpal.io and we will delete it promptly.

When the WellPal app ships it will state its own minimum age in the App Store listing and enforce it there.

• Everything is served over encrypted connections, with strict transport security and a content-security policy that blocks third-party scripts we have not explicitly allowed.
• Waitlist records live in a private store that is not publicly readable. Each record’s filename is a keyed hash of the email address rather than the address itself, so the storage layout reveals no contact information even to someone who can list it.
• Our own application logs are written to carry codes rather than content: no message bodies, no email addresses, no raw IP addresses. Our hosting provider keeps its own request logs, as every host does, and those record the usual connection details including IP address.
• Access to the waitlist is restricted to the operator and protected by a secret compared in constant time, behind a rate limit that applies before authentication.

No system is perfect. If we ever suffer a breach affecting your data, we will notify the relevant supervisory authority within 72 hours where the law requires it, and tell you directly where the risk to you is high.

The app is not released. This section describes how it is designed; the app will carry its own disclosure at launch, and if the design changes before then, that disclosure will be the accurate one.

• WellPal reads your Apple Health data on your device, read-only, with the permissions you grant in iOS. You can withdraw them at any time in Apple’s own settings.
• Your full Apple Health history stays on your phone. It is not uploaded.
• To explain what your numbers mean, the app can send a short, structured summary of the relevant context to a language model. That feature is switchable, and the app shows you what is included before you turn it on.
• Your health data is never sold, and never used for advertising.

When something material changes we update the revision date at the top of this page and say what changed, rather than editing quietly. This policy was rewritten in full on 6 September 2026: the version before it described an account system that does not exist and omitted the page count, the referring page, IP-based rate limiting, and most of your rights. We would rather record that plainly than let it look like a routine touch-up.

Everything on this page: privacy@wellpal.io. If something here is unclear, or turns out not to match what actually happens, we would much rather hear it directly than have you walk away with a wrong impression.