Privacy Policy — WellUp

Data controller: STOCKLER X-SOLUCOES LTDA — Brazilian company registry (CNPJ) 47.221.442/0001-21

1. Scope

This Policy explains how we process personal data in the WellUp app and related services (backend, AI processing, and integrations). WellUp is a health, nutrition, and training tracking app — as such, it processes sensitive health data, with the safeguards described below, in compliance with the Brazilian General Data Protection Law (LGPD — Law 13,709/2018) and other applicable data protection laws.

2. Data we collect

2.1 Account and profile data

• Name, e-mail, and profile picture, obtained from your sign-in provider (Google or Apple).
• Technical account identifiers (provider ID, authentication ID, subscription ID).
• Date of birth, biological sex, weight, height, activity level, sleep duration, and goal — used for calculations such as BMR, TDEE, and calorie targets.
• Device platform (iOS/Android), app version, and language.

2.2 Health data (sensitive) — provided by you or by an authorized professional

• Body composition and measurements: weight, body fat percentage, lean/muscle mass, BMI, body circumferences.
• Lab exams: uploaded documents (PDF/image), extracted markers and values, laboratory and requesting physician, calculated indices.
• Posture assessment: body photos (front, back, sides), notes, and generated analyses.
• Protocols: supplements, medications, and other logged substances, with doses, schedules, and adherence.
• Health questionnaires: health history provided in nutrition and training questionnaires (conditions, allergies, injuries, surgeries, habits, sleep, menstrual cycle, among others) and PAR-Q screening.
• Daily metrics: self-reports such as water intake and anxiety level.
• Vaccination: vaccines, doses, dates, batch, location, and proof of vaccination.

2.3 Nutrition and training data

• Logged meals, recipes, meal plans, and macros.
• Workout routines, sessions, sets, loads, and perceived exertion.
• Meal photos uploaded for analysis (optional).

2.4 Apple Health / Health Connect data (optional)

• With your explicit system authorization, we may read from Apple Health (iOS) or Health Connect (Android): steps, distance, active calories, basal metabolic rate, exercise minutes, sleep, weight, height, body fat percentage, heart rate, and resting heart rate — you authorize each data type individually.
• If you enable it, the app can also write exercise sessions performed in WellUp back to Apple Health / Health Connect.
• On the watch (Apple Watch and Wear OS), during a workout started on it, the app reads heart rate and calories from the watch's sensors to display them on the watch itself; these numbers are not sent to our servers. On Wear OS, the completed exercise session is written to Health Connect on your phone if you authorized writing exercises.
• With the background read permission (Android), the app periodically syncs the day's steps and calories to keep your goals up to date even when the app is closed.

2.5 Approximate location (optional)

• When you tap the incentive card in the partner carousel on the home screen, the app may request your explicit permission for location from the operating system ("While Using the App"). This collection is always optional — without this permission, the app keeps working normally and shows only partners and offers without geographic restriction.
• For this purpose we use only approximate (coarse) precision — never your device's exact location. On-site check-in in group challenges uses precise location, under its own rules described in section 2.10.
• The purpose is single-use: showing you partners and offers near you within the app.

2.6 Subscription data

• Plan status (free/paid), subscribed product, purchase origin, and identifiers needed to manage the subscription through the Apple/Google stores and RevenueCat.
• We do not store full payment card data; payments are processed by the stores.

2.7 Technical and usage data

• Usage and navigation events (analytics) and crash logs.
• Push notification token (when enabled).
• Technical security and integrity data (e.g., app integrity attestation) for API protection and fraud prevention.

2.8 Messages

• Messages exchanged in the chat between you and your connected professional (content, sender, date), stored for delivery and conversation history.

2.9 Feedback on app content

• Feedback about app content that you voluntarily submit (for example, when reporting a problem with an exercise): problem category, optional comment, language and app version, linked to your account. This content is read only by the WellUp team to fix the catalog, is not shown to other users or to professionals, and is deleted along with your account.

2.10 Group challenges

• Participation: when you join a challenge, your name and profile photo, your points, complete days and ranking position are visible to the other participants and to the person who created the challenge (the "owner").
• Daily requirements: points are calculated from what you already log in the app (workouts, meals, water, steps, active calories, weight, body fat percentage, measurements) and, for self-reported requirements created by the owner (for example, "Reading"), from what you mark as done. The owner sees who marked each self-reported requirement and when, and may invalidate a mark; if so, you are notified and the requirement stops counting for that day. The owner sees whether you met each requirement, never the values (for example, they see that you logged your weight, not how much you weigh).
• Photo of the day (when the challenge requires it): it is seen by you and the owner. When sending it, you can optionally allow the owner to post that photo in the group chat, where all participants can see it; this does not affect your points. If it is posted, you are notified and can remove it from the chat at any time, which also withdraws the permission. Photos of the day, including those posted in the chat, are deleted 90 days after the challenge ends, with a notice 7 days before.
• On-site check-in (when the challenge requires it): the app asks for your precise location, only while you use the check-in screen. The place you register for check-in is stored and the owner can see it, to confirm it is the agreed location. The position of each check-in never leaves your device: the app measures the distance to the registered place and only sends whether you were inside or outside the radius.
• Challenge chat: messages you send in the group chat (content, author and date) are visible to all participants. The owner and the WellUp team may moderate the chat based on reports.
• Screenshot protection: on screens with photos of the day, the photos do not appear in screenshots or screen recordings. When the app detects a screenshot attempt on these screens, the challenge participants receive a notice in the chat with your name.

3. Sensitive data and consent

Health data is sensitive personal data. We only process it:

• when you actively provide it (records, uploads, questionnaires) to use the app's features — with your specific consent, expressed through the act of use itself;
• when you authorize a professional to view or edit it (see section 7);
• for health-related purposes limited to operating the service, protecting rights, and complying with legal obligations.

You may choose not to provide any sensitive data — the corresponding features simply will not be available.

4. Purposes of processing

• Operating the app: recording, computing, and displaying your health, nutrition, and training data.
• Running AI features you request (section 5).
• Enabling sharing with professionals you authorize (section 7).
• Authenticating sessions and protecting the API and infrastructure.
• Processing and managing subscriptions.
• Sending push notifications (reminders and app communications, when enabled).
• Monitoring stability, measuring usage, and fixing failures.
• Complying with legal and regulatory obligations and exercising rights in legal proceedings.

5. Artificial intelligence

• Features such as exam extraction (PDF), body composition report reading, meal photo analysis, posture analysis, and diet/workout suggestions use cloud-hosted AI models (Google Vertex AI / Gemini), plus deterministic image processing on our servers (e.g., pose detection).
• Data sent to these features (documents, photos, relevant profile and questionnaire data) is used exclusively to generate the result you requested.
• We use these providers under enterprise terms, in which submitted data is not used to train general-purpose models.
• AI outputs are suggestions subject to error and are only saved after human confirmation.

6. Google Calendar integration (professionals only)

• Professionals on the Professional plan may, on a fully voluntary basis, connect their Google account in the Integrations tab of WellUp Web PRO to mirror scheduled appointments to Google Calendar.
• Once connected, WellUp creates its own secondary calendar named "WellUp" on the professional's Google account. The integration is one-way: WellUp only creates, updates, and removes appointment events on that "WellUp" calendar — it never reads the professional's other calendars, events, or appointments.
• We use Google's non-sensitive authorization scope calendar.app.created, which restricts WellUp's access exclusively to calendars the app itself creates — Google does not grant, and WellUp does not request, access to the professional's personal calendar.
• The professional can disconnect their Google account at any time from the same Integrations tab, which stops the sync; WellUp does not automatically remove the "WellUp" calendar or the events already created on the professional's Google account.
• The Google account access token is retained while the integration remains connected, until the professional disconnects it or deletes their account.
• This integration does not affect clients: appointments remain visible in WellUp as usual regardless of whether the professional has connected Google Calendar.

7. Sharing with professionals

• Connecting with a professional is always initiated by you and requires their acceptance. You define per-module permissions (training, nutrition, health) at none/view/edit levels.
• While the connection is active, the professional accesses only the modules you authorized and may create records identified as authored by them.
• You may change permissions or revoke the connection at any time, with immediate effect. Connection history is preserved for auditing.
• The professional is also responsible under data protection law for how they use the data you granted access to, within your professional relationship.

8. Sharing with processors and third parties

We share data only with processors necessary to operate the service:

We do not sell personal data and we do not share health data for advertising purposes.

9. International data transfers

Because we use global technology providers, data may be processed outside Brazil (e.g., in the United States), subject to appropriate contractual safeguards and security measures, in accordance with articles 33 et seq. of the LGPD.

10. Retention and deletion

• Data is kept while your account is active and for as long as needed for the purposes in this Policy, legal obligations, and the defense of rights.
• When you request account deletion, the account enters a 30-day grace period during which you can reactivate it. After the grace period, account data is permanently erased from our systems, including uploaded files, and the link to your sign-in provider is revoked.
• Records created by a professional for their clients may be preserved on the professional's side with your identification removed (anonymized).
• Records strictly necessary for legal compliance, fraud prevention, and the defense of rights may be retained for the legally required period.
• Documents you delete within the app (e.g., an exam) are also removed from file storage.
• Chat messages with a linked professional or client are retained for up to 24 months from when they are sent and are then automatically deleted. Group challenge chat messages are kept while the challenge exists and are removed when the owner deletes it or when the author deletes their account.
• Challenge photos of the day are deleted 90 days after the challenge ends; leaving a challenge or being removed immediately deletes your photos and the registered check-in place.

11. Your rights

You may request: confirmation of processing, access, correction, anonymization, portability, deletion where applicable, information about sharing, and withdrawal of consent. For health data shared with a professional, you can also revoke access directly in the app at any time.

Privacy channel: contact@fantoy.link
Account deletion: within the app (Profile → Settings → Delete account) or through the WellUp Account Deletion page.

12. Security

We adopt technical and administrative measures to protect data against unauthorized access, loss, alteration, or improper destruction — including encryption in transit, authentication and authorization-based access control, signed and expiring media URLs, app integrity verification, and credential segregation. No system is 100% secure, but we treat health data with the highest level of protection we employ.

13. Children and teenagers

WellUp is not intended for anyone under 18, and we do not allow account creation by anyone under 18. We do not knowingly collect data from children or adolescents. If we identify an account belonging to someone under 18, it will be deleted along with the associated data.

A professional may record, within their own account, data about a managed patient under 18 — without the minor holding an account or having app access. In that case the professional acts as controller of that data within the professional relationship and is responsible for obtaining from the legal guardian any authorizations required by applicable law, including article 14 of Brazil's LGPD.

If you are a legal guardian and believe a person under 18 has created a WellUp account, write to contact@fantoy.link and we will delete it.

The vaccination record lets you log, within your own account, data about other members of your family (children, spouse, parents) without them holding an account of their own in the app. When you create one of these profiles, you represent that you are the legal guardian of that person or have their authorization to keep this record, and you are the one who decides what goes in and out of that record.

14. Push notifications

The app may send notifications (reminders, messages from your professional, service communications). You can disable them in your device or app settings.

15. Changes to this Policy

This Policy may be updated periodically. The current version will always show the effective date at the top of the document. Material changes may be communicated in the app.

16. Controller contact