Legal
Privacy Policy
What Wellex collects, where it lives, and how to delete it.
Last updated: 2026-06-25
Plain language: Your raw sensor data stays on your phone. Daily summaries go to our EU servers only if you opt in. The Yield wallet is yours — we never hold your keys. We never sell anything to anyone.
1. Who we are
The Wellex product, the Wellex bracelet, the Wellex iOS and watchOS apps, the WVI score, the Wellex Yield layer and the Partner Network are operated by:
Calon Wealth Management Ltd Company Number 14813653 (registered in England and Wales) The Mansion House, Digital Mansion, Pickwick Road, Corsham, England, SN13 9BL
For all data-protection matters, contact our Data Protection Officer at [email protected]. References to "we", "us", "our" or "Wellex" in this policy mean Calon Wealth Management Ltd.
2. Data we collect
| Category | Examples | Where it lives |
|---|---|---|
| Account | email, name (if you provide it), Privy user ID | EU servers |
| Billing | last 4 digits, country, billing email | Stripe (PCI-DSS) |
| Daily summaries | WVI, sleep summary, average HRV | EU servers (opt-in) |
| Raw biometrics | PPG, GSR, skin-temp, accelerometer streams | Your phone only |
| Wallet & on-chain | wallet address, USDT deposit/payout transactions | Public blockchain + EU servers |
| Identity (KYC) | ID document, proof of address, selfie match | Independent KYC provider only |
| Partner Network | referral links, referred-account IDs, payout records | EU servers (if you opt in) |
| Diagnostics | crash logs, anonymised | EU servers, 30-day TTL |
3. How we use data
- To deliver the WVI and your daily direction.
- To sync your account across devices (only with cloud backup enabled).
- To operate the Yield layer and the Partner Network, and to make USDT payouts where you opt in.
- To verify identity and meet legal obligations before payouts (see the KYC / AML Policy).
- To improve sensor accuracy via aggregated, anonymised statistics (k-anonymity ≥ 50).
- To respond to support requests.
We do not use your data for advertising. We do not profile you for third parties.
4. Legal basis (GDPR Art. 6)
- Consent for cloud backup, marketing emails, optional features.
- Contract necessity for delivering the service you paid for, including Yield payouts.
- Legal obligation for KYC/AML identity verification, sanctions screening and record-keeping.
- Legitimate interest for security, fraud prevention and aggregated analytics.
5. Retention periods
| Data | Retention |
|---|---|
| Account | While the account exists |
| Daily summaries | While the account exists, deleted on request |
| Raw streams (phone) | Until you uninstall the app |
| Diagnostics | 30 days, then auto-deleted |
| KYC records | The minimum required by law (typically 5–7 years after account closure), then deleted |
| Billing records | 7 years (legal requirement) |
| On-chain transactions | Permanent and public by nature of the blockchain — outside our control |
6. Third-party processors
| Processor | Purpose | Location |
|---|---|---|
| Stripe | Card payments | EU/US (DPA in place) |
| Hetzner | Hosting | EU (Frankfurt) |
| Postmark | Transactional email | EU |
| Sentry (self-hosted) | Crash diagnostics | EU |
| Privy | Authentication & embedded non-custodial wallet | US (DPA + SCC) |
| Independent KYC provider | Identity verification & sanctions screening | EU/global (DPA in place) |
| Wellex AI Gateway | On-demand AI guidance, opt-in | EU (self-hosted) |
We do not use Google Analytics, Facebook Pixel, TikTok Pixel or any third-party advertising SDK.
6a. No tracking or advertising
The Wellex iOS app does not track you across other companies' apps or websites and does not present the iOS App Tracking Transparency prompt. The app contains no advertising SDKs and no data-broker SDKs. Any usage analytics are first-party, aggregated and anonymised. We never share identifiable health data with advertisers.
Wellex does not use Apple HealthKit and neither reads from nor writes to Apple Health. Every biometric reading comes from the Wellex bracelet over Bluetooth and is stored under the categories listed in section 2. This matches our App Store privacy labels: data is linked to your account only when you enable cloud sync, and none of it is used for tracking.
6b. Your Yield wallet & on-chain data
Your Yield funds sit in an embedded, non-custodial wallet: only you control the keys. Wellex cannot move, freeze or recover your funds. Blockchain transactions — your wallet address and every USDT deposit and payout — are recorded on public ledgers that anyone can read and that we cannot edit or delete. Treat your wallet address as public information. We never publish your name alongside it; KYC documents are held only by our independent verification provider and are never written on-chain.
7. International transfers
Personal data is stored exclusively in the EU. Necessary transfers to processors outside the EU (e.g. Stripe, Privy) rely on Standard Contractual Clauses.
8. Your GDPR rights
- Access — request a copy of your data.
- Rectification — correct inaccurate data.
- Erasure — delete your account and all associated data (KYC and billing records are kept only as long as the law requires).
- Portability — export your data in JSON.
- Restriction — pause processing.
- Objection — object to processing based on legitimate interest.
Request any of the above from Settings → Privacy → My data or by emailing [email protected]. We respond within 14 days.
9. CCPA rights (California)
California residents have the additional rights to opt out of sale (we do not sell), to non-discrimination, and to know which categories of personal information we collect. We honour all CCPA requests via [email protected].
10. Cookies
See Cookie Policy.
11. Children
Wellex is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you believe we have, contact [email protected] for immediate deletion.
12. Changes
We will notify members at least 30 days before any material change to this policy.
13. Contact
DPO: [email protected]. Postal address: provided on request.