PRIVACY POLICY – WELLSI

§1. Data Controller

The controller of personal data is Wellsi sp. z o.o., with its registered office in Kraków, Poland (Praska 34b/68), registered in the National Court Register (KRS) under number 0001056762, NIP: 6762650863, REGON: 526321122 (hereinafter: “Wellsi” or “Controller”).
For any privacy-related matters, you may contact us at: dpo@wellsi.app
The Controller has not appointed a Data Protection Officer.

§2. Scope of processed data

The Controller processes the following categories of data:

identification data (e.g. name, email address)
data related to the use of the Platform
communication data (chat)
health-related data provided by the User
data related to the execution of movement programs
technical data and system logs

Data may originate from:

the User directly
a Specialist within the Platform
User activity within the system

§3. Purposes and legal bases of processing

Personal data is processed for the following purposes:

provision of electronic services (Art. 6(1)(b) GDPR)
account and subscription management
enabling communication with a Specialist
ensuring Platform security (Art. 6(1)(f) GDPR)
handling complaints
compliance with legal obligations (Art. 6(1)(c) GDPR)

Individual processing purposes may be based on different legal grounds depending on how the Platform is used.

Health data is processed solely on the basis of the User’s explicit consent (Art. 9(2)(a) GDPR).

Consent:

is given explicitly and separately
may be withdrawn at any time

Withdrawal of consent:

does not affect the lawfulness of prior processing
may limit access to certain functionalities

Data may continue to be processed where necessary for:

compliance with legal obligations
ensuring Platform security
prevention of abuse
establishment, exercise or defense of legal claims

Providing data is voluntary, but necessary to use the Platform.
Failure to provide data may prevent access to services.

The Controller conducts a balancing test between its legitimate interests and the rights and freedoms of the User.

§4. “My Team” functionality and Specialist access

Within the “My Team” functionality, the User may connect their account with a selected Specialist.

Once connected, the Specialist is granted access to the User’s data strictly on a view-only basis within the Platform environment and only to the extent necessary to use the Platform’s functionalities.

This access includes in particular:

health-related data
information about program execution
communication within the Platform

The Controller does not enable:

data export
data downloading
permanent storage of data outside the Platform

If a Specialist intends to use User data outside the Platform (e.g. in their own practice system, for research, publications, or educational materials), they are required to obtain separate consent from the User or rely on another valid legal basis.
The User has the right to refuse such use of their data.

§5. Communication and documents

The Platform enables communication with a Specialist.

Within the chat functionality, the User may share documents such as:

test results
images
other materials related to their health condition

These documents are shared solely for:

assessment of the User’s situation
qualification to appropriate movement program levels

Documents are made available strictly on a view-only basis within the Platform.

They are not intended for:

copying
downloading
further processing outside the Platform

unless the User provides separate consent.

§6. Consent to communicate with a Specialist

Starting communication with a Specialist requires prior explicit consent from the User for sharing their data.

Consent:

is given explicitly within the Platform
may be withdrawn at any time

Withdrawal of consent results in the inability to continue communication within the Platform.

§7. Role of the Specialist

The Controller of personal data within the Platform is Wellsi.
The Specialist has access to data only within the Platform and only to Users assigned to their team.
If a relationship is established outside the Platform, the Specialist may become an independent data controller under applicable laws.

§8. “View-only” principle and violations

The Specialist is required to process User data strictly within the Platform.

In particular, it is prohibited to:

copy data
create screenshots for external use
export data
share data with third parties
use data outside the Platform

Violation of these rules may result in:

restriction of access
account suspension
termination of cooperation
legal action

§9. Data recipients

Personal data may be shared with:

IT infrastructure providers (hosting, cloud services)
payment service providers (e.g. Stripe)
communication providers (email, SMS)
analytics tools providers

All recipients process data under data processing agreements.

§10. Transfers outside the EEA

Data transfers outside the European Economic Area may occur when using third-party technology providers.

In such cases, appropriate safeguards are applied, including Standard Contractual Clauses approved by the European Commission.

§11. Data retention

account data: until deletion + 12 months
health data: until account deletion or withdrawal of consent
communication (chat): up to 24 months
system logs: up to 12 months
billing data: 5 years
data for legal claims: until limitation periods expire
backups: up to 90 days

§12. User rights

The User has the right to:

access their data
rectify data
erase data
restrict processing
data portability
object to processing
withdraw consent
lodge a complaint with a supervisory authority

Requests may be sent to: dpo@wellsi.app
The Controller may verify the User’s identity.
A response will be provided within one month.

§13. Profiling

User data is not used for automated decision-making producing legal effects.

Data may be used to a limited extent for personalization of Platform functionalities, which does not significantly affect the User.

§14. Security

The Controller applies appropriate technical and organizational measures, including:

access control
logging of operations
pseudonymization of selected data
encryption of data transmission
least-privilege access principles

In the event of a data breach, the Controller acts in accordance with applicable law.

§15. Nature of the Platform

The Platform is of a technological and educational nature.

Wellsi:

does not provide healthcare services
does not make therapeutic decisions

The Specialist acts independently and bears professional responsibility outside the Platform.

§16. Cookies

Detailed information about cookies and tracking technologies is available in the Cookie Policy.
Certain functionalities may require consent to cookies.

§17. Changes to this Policy

This Privacy Policy may be updated.

§18. Contact

The Controller has not appointed a Data Protection Officer.
For privacy matters, contact: dpo@wellsi.app

Prepared by: Legal Department of Wellsi sp. z o.o., 2026

Cookies in Brief

At Wellsi, we use cookies to ensure the proper operation of the platform, enhance security, improve features, and enhance user experience.

What cookies do we use?

Necessary – They enable the platform to function (login, security, privacy settings). Always active.

Analytical – They help us understand how the platform is used to improve it. Enabled only with your consent.

Marketing – They are used to tailor marketing content. Requires consent. They are not used in the patient dashboard.

You can adjust your preferences:

All

Only necessary

Refuse

Health Privacy

Since the platform is health-related, we limit cookies to essential and privacy-related analytics in the patient dashboard.

For details, see the FULL COOKIE POLICY