How we collect, use, and protect your personal health information
Last updated: December 27, 2025 | Effective: January 1, 2025
Wellness Projection Lab (WPL) is built to be HIPAA-aligned and is committed to protecting your personal health information. We never sell your data and only use it to provide you with the best health tracking experience.
We use your information for the following purposes:
🔒 We NEVER sell your personal health information
Your health data is yours. We only share it in the limited circumstances described below.
We share your information when you explicitly authorize us to do so (e.g., sharing with family members, healthcare providers).
We work with trusted third-party service providers who help us operate our platform:
All service providers sign Business Associate Agreements (BAAs) as required by HIPAA.
We may disclose information when required by law, court order, or to protect rights and safety.
In the event of a merger, acquisition, or sale, your information may be transferred. We will notify you and ensure continued protection.
We may share aggregated, de-identified data that cannot be linked back to you for research and analytics.
We implement industry-leading security measures to protect your information:
AES-256 encryption at rest, HTTPS (TLS) in transit. All PHI is encrypted.
Role-based access, biometric sign-in (WebAuthn), principle of least privilege.
Continuous monitoring and intrusion detection on Google Cloud infrastructure, with regular internal security review.
Automated encrypted backups and disaster recovery on Google Cloud's high-availability infrastructure.
Audit trail of changes to health records.
Security posture: HIPAA-aligned controls, AES-256 encryption at rest, HTTPS (TLS) in transit, data stored on SOC 2-certified Google Cloud infrastructure, app hosted on Vercel. WPL does not currently hold its own SOC 2 or ISO 27001 certification.
You have the following rights regarding your personal information:
Request a copy of all personal data we hold about you. Available through your account settings or by contacting us.
Correct inaccurate or incomplete information through your account settings.
Request deletion of your account and associated data. Some data may be retained for legal compliance (7 years for HIPAA).
Download your data in a machine-readable format (JSON) from account settings.
Request limitations on how we process your data while maintaining your account.
Opt out of marketing communications or analytics.
Withdraw consent for optional features (e.g., biometric authentication, AI analysis) at any time.
Exercise Your Rights
To exercise any of these rights, contact us at contact our privacy team or use the privacy controls in your account settings.
We retain your information for different periods based on type and legal requirements:
| Data Type | Retention Period |
|---|---|
| Account Information | While account is active + 7 years after closure (HIPAA) |
| Health Data (PHI) | While account is active + 7 years after closure (HIPAA) |
| Biometric Data | While feature is enabled + 30 days after opt-out |
| Usage Logs | 90 days |
| Marketing Preferences | Until you opt out or close account |
| De-identified Data | Indefinitely (cannot be linked to you) |
WPL is not intended for children under 13. We do not knowingly collect information from children under 13.
For users aged 13-17, we require parental consent before creating an account. If you believe we have collected information from a child under 13, please contact our privacy team immediately.
Your information may be transferred to and processed in the United States and other countries where our service providers operate.
We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission for EU/EEA users.
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Your continued use after changes become effective constitutes acceptance. If you do not agree, you may close your account.
If you have questions about this Privacy Policy or our privacy practices:
This Privacy Policy serves as our Notice of Privacy Practices as required by HIPAA. For more detailed information about how we protect your Protected Health Information (PHI), please visit our HIPAA Alignment page.
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a complaint.
User