wello
This Privacy Policy explains how wello ("wello", "we", "us", or "our") collects, uses, stores, shares and protects your information when you use the wello mobile application and the website at welloapp.co (together, the "Service").
wello is a caregiver companion that helps you manage a family member's medications, lab reports and care routine. Because the Service handles health-related information, we treat your data with particular care and process it in accordance with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and other applicable law.
wello is not a medical service. The Service is for informational and organisational purposes only and is not a substitute for professional medical advice, diagnosis or treatment. Always consult a qualified clinician about any health concern.
1. Who is responsible for your data
wello is the Data Fiduciary (controller) for the personal data described here. For any privacy question or to exercise your rights, contact our Grievance Officer:
Grievance Officer, wello
Email: hello@welloapp.co
We respond to verified requests within 30 days, as required by the DPDP Act.
2. Information we collect
2.1 Information you provide
| Category | Examples | Why we collect it |
|---|---|---|
| Account data | Mobile number, name, profile photo (optional) | Create and secure your account; sign you in via one-time password (OTP) |
| Care-circle data | Name, relationship and contact details of the person you care for and other invited caregivers | Let multiple caregivers coordinate around one patient |
| Health data (sensitive) | Medications, schedules, dosage logs, lab reports you upload, biomarker values, notes | Provide reminders, organise records and generate plain-language summaries of lab results |
| Support data | Messages you send us, feedback | Respond to your requests |
2.2 Information collected automatically
- Device & technical data — device type, operating system, app version, and a non-identifying app instance ID, used to keep the app working and diagnose crashes.
- Usage data — anonymised, aggregated product-analytics events (for example, "opened the medication screen") that help us understand which features are used. We do not attach your health content to analytics events.
- Website analytics — our website uses privacy-friendly, cookieless analytics that count page views in aggregate. It sets no cookies, does not track you across other sites, and honours your browser's "Do Not Track" signal.
We do not use advertising trackers, and we do not sell your personal data to anyone.
3. How we use your information
- To provide the core Service: medication reminders, record-keeping, lab-report summaries and care-circle coordination.
- To authenticate you and keep your account secure.
- To generate plain-language interpretations of lab results. This processing is automated and informational only; it does not constitute medical advice.
- To diagnose problems, prevent abuse and improve the Service.
- To communicate with you about the Service (for example, important security notices).
4. Consent and legal basis
Under the DPDP Act we process your personal data on the basis of your free, specific, informed and unambiguous consent. We ask for explicit opt-in consent before collecting or processing health data, and we keep a record of the consent you give. You may withdraw consent at any time (see Section 8); withdrawing consent does not affect processing already carried out, and may mean parts of the Service can no longer function.
5. How we share information
We share data only as needed to run the Service:
- Other caregivers you invite — people you add to a patient's care circle can see that patient's records. You control who is invited.
- Processors acting on our behalf, under contract and bound to confidentiality. We currently use:
- Cloudflare, Inc. — application hosting, file storage for the documents you upload, AI used solely to read and summarise lab values in plain language, and delivery of one-time login codes by email. AI inputs are limited to the minimum text/image needed and are not used to train third-party models.
- Supabase, Inc. — the managed database that stores your records.
- PostHog, Inc. — privacy-respecting product analytics (which features are used). Your health content is never attached to analytics events.
- Legal compliance — where required by law, court order or to protect rights and safety.
We do not share your data with advertisers or data brokers.
6. Where your data is stored and international transfers
Your data is stored on managed cloud infrastructure. Some processors may store or process data outside India. Where data is transferred internationally, we rely on providers that offer appropriate security and contractual safeguards, and only to countries not restricted under the DPDP Act.
7. Data retention
We keep your personal data only as long as your account is active or as needed to provide the Service. When you delete your account, we delete or irreversibly anonymise your personal and health data within 30 days, except where we must retain limited records to comply with law or resolve disputes. See how to delete your account.
8. Your rights
Under the DPDP Act you have the right to:
- Access — request a summary of the personal data we hold about you and how it is processed.
- Correction — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your personal data and close your account.
- Withdraw consent — withdraw consent to processing at any time.
- Nominate — nominate another person to exercise your rights in the event of death or incapacity.
- Grievance redressal — raise a complaint with our Grievance Officer, and escalate to the Data Protection Board of India if unresolved.
You can exercise most of these directly in the app (Settings → Privacy), or by emailing hello@welloapp.co. We verify the identity of anyone making a request before acting on it.
9. Security
We protect your data with encryption in transit (HTTPS/TLS), access controls, and reasonable technical and organisational safeguards. No system is perfectly secure, but we work to protect your information against unauthorised access, alteration and loss.
10. Data-breach notification
If a personal-data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India without undue delay, in the manner and within the timelines required by the DPDP Act, and tell you what happened and what steps you can take.
11. Children
wello is intended for adults (18+) managing care for themselves or a family member. We do not knowingly collect data directly from children. Where you record information about a dependent who is a minor, you confirm you are authorised to do so as their parent or lawful guardian.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, notify you in the app or by email.