Your health information is private. Welluma Health Inc. does not sell, share, or monetize your personal or health data. Ever.
1. Who We Are
Welluma Health Inc. ("Welluma," "we," "us," or "our") is a Canadian health technology company incorporated in Ontario, Canada. We operate the Welluma mobile application ("App") and the website at wellumahealth.com ("Site"). Our contact email is wellumahealth@gmail.com.
2. Information We Collect
Information you provide directly
- Account information: name and email address when you create an account
- Audio recordings of medical appointments you choose to record using the App
- Text transcripts automatically generated from your audio recordings using speech recognition
- Messages you send us through the contact form or by email
Information collected automatically
- Device type, operating system version, and app version
- Anonymous usage data such as features used and session duration
- Crash reports to help us fix technical issues
Information we do not collect
- We do not collect payment information directly — all payments are processed securely by Apple (App Store), Google (Google Play), or RevenueCat Inc. on our behalf
- We do not collect your location
- We do not collect data from your contacts, camera, or other apps
3. How We Use Your Information
We use the information we collect solely to:
- Provide, operate, and improve the Welluma App and its features
- Generate AI-powered plain-language summaries from your appointment recordings
- Send you service-related communications (such as account or billing notices)
- Respond to your support requests and inquiries
- Diagnose technical problems and improve app performance
We do not use your health data to train AI models. We do not use your data for advertising purposes.
4. How We Store and Protect Your Data
Your data is stored on secure servers hosted by Supabase Inc., a SOC 2 Type II certified cloud infrastructure provider. Supabase servers are located in Canada (Central, ca-central-1), hosted on AWS Canadian infrastructure. Your data is stored on Canadian soil in accordance with PIPEDA and Ontario's PHIPA. Supabase is SOC 2 Type II certified and contractually bound to protect your information. All data is encrypted in transit using TLS and encrypted at rest.
Access to user data is strictly limited to authorized personnel required to maintain and operate the service. We regularly review our security practices and update them as needed.
5. Sharing Your Information
We do not sell your personal information. We do not share your health data with third parties for marketing or advertising. We may share information only in the following limited circumstances:
- Anthropic (AI Processing): When you request a visit summary, the text transcript of your appointment is transmitted securely to Anthropic, PBC (anthropic.com), a third-party AI service provider, solely for the purpose of generating your plain-language summary. Transcripts are not retained by Anthropic after processing. You will be asked for explicit consent before any transcript is sent.
- Supabase (Cloud Storage): Your account information and visit history are stored on servers operated by Supabase Inc., a SOC 2 Type II certified provider. Data is stored in Canada (ca-central-1 region) and is subject to strict confidentiality agreements.
- RevenueCat (Subscription Management): Subscription status and purchase history are managed by RevenueCat Inc. RevenueCat receives your app user ID and subscription transaction data to verify and manage your subscription.
- Apple / Google (Payment Processing): In-app purchases are processed by Apple Inc. (App Store) or Google LLC (Google Play). We do not receive or store your payment card details.
- Legal requirements: If required by law, court order, or government authority.
- With your consent: When you explicitly choose to share a summary with another person or provider through the App's share feature.
6. Your Rights and Choices
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete your account and all associated data at any time from within the App or by emailing us
- Export your data in a portable format upon request
- Withdraw consent for data processing at any time
To exercise any of these rights, contact us at wellumahealth@gmail.com. We will respond within 30 days.
7. Data Retention
We retain your data for as long as your account is active. If you delete your account, we will permanently delete your personal data and recordings within 30 days, except where retention is required by law.
8. Children's Privacy
Welluma is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
9. Third-Party Links
Welluma provides links to trusted third-party health resources. We are not responsible for the privacy practices of those external websites. We encourage you to review their privacy policies before providing any personal information.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated date, and where appropriate, by email. Your continued use of the App after changes are posted constitutes acceptance of the updated policy.
11. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: