Last updated: 29 April 2026
This privacy policy explains how EduSys, Lda (Portuguese tax identification number PT518212173), trading as WellHive(“we”, “us”, “our”), collects, uses, stores, and protects your personal data when you use the WellHive mobile application and web platform (together, the “Service”).
We are committed to protecting your privacy and complying with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Portuguese Lei n.º 58/2019 implementing the GDPR, and the EU Artificial Intelligence Act (Regulation (EU) 2024/1689).
The data controller responsible for your personal data is:
EduSys, Lda
NIF: PT518212173
Email: privacy@wellhive.app
We collect and process the following categories of personal data:
| Category | Examples | Legal basis |
|---|---|---|
| Account data | Name, email, password (hashed), role, avatar | Contract (Art. 6(1)(b)) |
| Health and wellbeing data | Mood, energy, sleep, body measurements, progress photos, HRV, stress | Explicit consent (Art. 9(2)(a)) |
| Apple Health / Health Connect data | Weight, body fat, sleep, step count, resting heart rate, workouts (only the data types you authorise) | Explicit consent (Art. 9(2)(a)) |
| Habit and activity data | Habit logs, streaks, workout logs, programme progress | Contract (Art. 6(1)(b)) |
| Nutrition data | Food logs, meal plans, supplements, macros, water intake | Contract (Art. 6(1)(b)) |
| Practitioner notes | Team notes, session notes, check-in narratives, timeline entries | Contract (Art. 6(1)(b)) |
| Messages | Chat messages between clients and practitioners | Contract (Art. 6(1)(b)) |
| Booking data | Session dates, times, locations, practitioner assignments | Contract (Art. 6(1)(b)) |
| Billing data | Subscription status, payment identifiers (card details held by Stripe) | Contract (Art. 6(1)(b)) |
| Device data | Push notification tokens, device platform (iOS/Android) | Legitimate interest (Art. 6(1)(f)) |
| Usage data | App interactions, error logs (anonymised) | Legitimate interest (Art. 6(1)(f)) |
Health and wellbeing data (mood, energy, sleep, body measurements, HRV, stress, and practitioner notes about your physical and mental wellbeing) is classified as special category data under Article 9 of the GDPR. We process this data solely on the basis of your explicit consent, which you provide when you create an account and begin using the tracking features.
You may withdraw this consent at any time by contacting us or deleting your account. Withdrawal of consent will mean we can no longer provide the Service, as health tracking is fundamental to how WellHive works.
We have conducted a Data Protection Impact Assessment (DPIA) in accordance with Article 35 of the GDPR, given the nature and scale of health data processing involved. This assessment is available upon request.
The WellHive mobile app integrates with Apple HealthKit on iOS and Android Health Connect on Android. We only access these data sources after you have granted explicit permission via the operating-system prompt — you choose which data types to share, and you can change your mind at any time.
With your permission, we read the following data types from Apple Health / Health Connect:
With your permission, we write workouts you complete inside WellHive back to Apple Health / Health Connect, so the activity is reflected in your daily activity rings and your wider health history.
Apple Health and Health Connect data is stored on our servers (see Section 7) and used solely to:
We do not use Apple Health or Health Connect data for advertising, marketing, or profiling, and we never share it with data brokers or advertising networks. This data is only ever shared with the practitioners you have explicitly connected to your account, and with the data processors listed in Section 7 (Supabase for storage; Anthropic only when an AI insight is explicitly requested). We do not sell Apple Health or Health Connect data to anyone.
You can revoke WellHive's access to Apple Health or Health Connect at any time, without deleting your WellHive account:
Revoking access stops new data being read, but does not delete data already saved on our servers. To delete that data, please use the “Delete my account” option in the app, or email privacy@wellhive.app. Retention periods are set out in Section 9.
We process your data for the following purposes:
We do not sell your personal data to any third party. We do not use your data for advertising or marketing profiling.
WellHive uses artificial intelligence to assist practitioners in supporting their clients. This section explains how AI is used, in compliance with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) and GDPR Article 22 (automated decision-making).
The AI copilot within WellHive provides practitioners with:
Under the EU AI Act, the WellHive AI features are classified as limited risk. The AI generates advisory outputs for qualified practitioners — it does not autonomously make decisions about your care, treatment, or access to services. All AI outputs are clearly labelled as AI-generated within the platform.
All AI-generated content is presented as suggestions to practitioners, who retain full discretion over whether to act on, modify, or disregard the AI output. No automated decision is made that produces legal effects or similarly significant effects on any individual without human review. This satisfies the requirements of GDPR Article 22.
You have the right to:
Your data is shared only with the following parties, each of which operates under a data processing agreement:
We do not sell your personal data to any third party.
Your data is primarily stored in the EU (AWS eu-west-1 via Supabase). Some sub-processors (Anthropic, Expo, Vercel, Stripe) are based in the United States. These transfers are protected by Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework, as applicable.
We retain your personal data for as long as your account is active. Specific retention periods:
We implement appropriate technical and organisational measures to protect your data, including:
Under the GDPR, you have the following rights:
To exercise any of these rights, email privacy@wellhive.app. We will respond within 30 days. You can also download your data or delete your account directly from the Settings page.
The WellHive web platform uses essential cookies only. These are strictly necessary for the platform to function (e.g. authentication session cookies). We do not use analytics, advertising, or third-party tracking cookies.
The WellHive mobile app does not use cookies. Authentication tokens are stored in encrypted device storage (iOS Keychain / Android Keystore).
WellHive is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Portuguese Data Protection Authority:
If you are based in another EU/EEA member state, you may also contact your local supervisory authority.
We may update this privacy policy from time to time. If we make material changes, we will notify you via the app or by email before the changes take effect. The “last updated” date at the top of this page indicates when the policy was most recently revised.
If you have any questions about this privacy policy or how we handle your data:
EduSys, Lda
NIF: PT518212173
Email: privacy@wellhive.app