Privacy Policy
1. Identity of the data controller
This Privacy Policy regulates the processing of personal data carried out by:
- Company name: Wellbeinn Performance, S.L. (hereinafter, "Wellbeinn"). Operates under the trade name Wellbeinn.
- Tax ID: B-16407355
- Registered office: Calle Reyes Católicos 37B, 03630 Sax (Alicante), Spain
- Registry entry: Registered in the Alicante Mercantile Registry, Sheet A-199979, IRUS 1000444260360, Electronic Folio Registration 3
- Contact email for privacy matters: privacy@wellbeinn.com
- Data Protection Officer (DPO): Miguel Ortín Gómez, 20051933G
Wellbeinn complies with the provisions of Regulation (EU) 2016/679 ("GDPR") and Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights ("LOPDGDD").
2. Scope and informative nature
This Privacy Policy is informative in nature and describes how Wellbeinn processes personal data within the framework of:
- The Wellbeinn mobile application for iOS and Android (hereinafter, the "App").
- The use of the Wellbeinn V8 wearable as a complementary device that connects to the App via Bluetooth Low Energy (BLE).
- The website wellbeinn.com regarding registration, support, and account communications.
Reading this Policy does not replace or integrate, by itself, the explicit consent required for the processing of health data. Such consent is obtained through a separate, specific, and unequivocal affirmative action within the App. Wellbeinn will retain verifiable evidence of the consent given and its withdrawal, including user identifier, date and time, version of the accepted text, language, and authorized purposes (Art. 7.1 GDPR).
3. Personal data we process
We process the following categories of data:
3.1 Identity and account data
Basic data to create and maintain your personal account: first and last name, email address, password (stored with a one-way hash managed by our identity provider; Wellbeinn does not access the plaintext), optional profile photo, federated login identifiers when choosing to register with Google, and a unique internal identifier assigned by our system.
We also process the status of customization options that the user may activate (commercial communications and product customization, see §4 bis), which can be enabled or disabled at any time from My Account.
3.2 Health-related data — special category (Art. 9 GDPR)
Through the Wellbeinn V8 wearable and the data the user provides to calibrate the service, Wellbeinn processes biophysiological and activity information: in particular, cardiovascular metrics (heart rate and variability, HRV/RMSSD), sleep and rest data, oxygenation and skin temperature indicators, physical activity parameters, as well as a basic health profile (date of birth, biological sex, weight, and height). This list is indicative: the App may process these and other similar wellness and health data within the purposes described in this Policy, maintaining the same legal classification and level of protection.
The derived indicators that the App calculates from this raw data — in particular sleep quality, recovery, vitality, activation, stress, sleep efficiency, and other aggregated physiological state indicators — are also considered health-related data (special category under Art. 9 GDPR) and receive the same enhanced level of protection, legal basis of explicit consent, and retention periods as the raw data.
This data is retained with high temporal resolution because it is necessary for calculating the indicators the App provides. Retention is carried out exclusively in your personal account, is not shared with third parties, and is deleted according to section 6.
Wellbeinn does not process biometric data within the meaning of Art. 4.14 GDPR (personal data obtained from specific technical processing relating to the physical characteristics of a natural person that allow or confirm unique identification).
3.3 Wearable device data
Identifier, model, and firmware version of the wearable, Bluetooth identifier (on Android this may be a persistent public MAC address; on iOS it is usually a rotating UUID issued by the operating system and linked to the App installation), battery status, and connection/disconnection events.
3.4 Technical and usage data
App installation identifier, operating system and version, phone model and device language, technical error and event logs managed through the infrastructure provider's Cloud Logging service (see §7), and timestamps of actions performed within the App.
Note on advertising tracking: the App does not include third-party analytics SDKs. We do not perform advertising profiling, do not share data with advertising networks, and do not use third-party cookies.
4. Legal bases for processing
| Data category | Legal basis | Reference |
|---|---|---|
| Identity, account, device, technical | Contract execution | Art. 6.1.b GDPR |
| Health data (Art. 9), including derived indicators — use to provide the main service | Explicit consent of the data subject | Arts. 6.1.a and 9.2.a GDPR |
| Commercial communications (optional) | Separate and revocable consent | Art. 6.1.a GDPR + Art. 21 LSSI |
| Product customization and analytical improvement (optional) | Separate and revocable consent | Arts. 6.1.a and 9.2.a GDPR |
| Support and legal obligations | Compliance with legal obligation / legitimate interest | Arts. 6.1.c and 6.1.f GDPR |
Explicit consent for the processing of health data is requested in a separate and unambiguous manner within the App, distinct from the general acceptance of Terms and Conditions. You can withdraw it at any time, without this implying account closure and without affecting the lawfulness of processing prior to withdrawal (Art. 7.3 GDPR). Withdrawal of consent will result in the immediate suspension of new health data capture and, at your choice, the retention or deletion of previously stored data.
Consent structure. Wellbeinn distinguishes between mandatory acceptances, without which the App cannot function, and customization options, which the user can freely enable or disable without affecting access to the main functionality. Details are provided in §4 bis.
4 bis. Mandatory acceptances and customization options
Wellbeinn implements the principles of Art. 4.11 and Art. 7.4 GDPR: consent must be free, specific, informed, and unambiguous, and consents for different purposes must be obtained separately.
4 bis.1 Mandatory acceptances
To use the App, it is essential to accept the following three items. Without them, the App cannot be used:
| # | Acceptance | Nature | Legal basis |
|---|---|---|---|
| 1 | Terms and Conditions of Service | Contractual acceptance of the digital service | Art. 6.1.b GDPR (contract execution) |
| 2 | Privacy Policy | Information about processing (not consent by itself, but prior reading is necessary) | Arts. 13 and 14 GDPR |
| 3 | Explicit consent for the processing of health data | Wellbeinn is a companion app for the Wellbeinn V8 wearable; without the consent of Art. 9.2.a, the App lacks a legal basis to process the biophysiological information that constitutes its main functionality | Arts. 6.1.a and 9.2.a GDPR |
Refusal of any of these three acceptances prevents the use of the app. This is not an abusive condition: the nature of the service (companion app for a physiological measurement device) makes its operation materially impossible without processing health data.
4 bis.2 Personalization options
The following options are strictly voluntary and do not condition the use of the app. They are presented to the user as separate checkboxes, in their own block, after mandatory acceptances. They can be activated or deactivated at any time from My Account → Privacy and Data, without penalty or loss of functionality.
Option 1 — Marketing communications
“I want to receive personalized wellness advice and Wellbeinn updates by email.”
- Legal basis: Art. 6.1.a GDPR (specific consent) + Art. 21 LSSI.
- Purpose: sending commercial communications with wellness advice, product updates, and offers related to the Wellbeinn ecosystem.
- Data used: only account identifiers and email address. Health data is not used to segment these communications.
- Withdrawal: revocable at any time from My Account or via the unsubscribe link included in each communication.
- Effect on service: none. The app will continue to function normally if the option is disabled.
Option 2 — Product personalization and improvement
“I want to help Wellbeinn improve my experience by analyzing how I use the app, in an aggregated and anonymous way, without sharing my data with third parties.”
- Legal basis: Arts. 6.1.a and 9.2.a GDPR (specific explicit consent, since the analysis may involve health-derived data).
- Purpose: aggregated and anonymized analysis of app usage and behavior of derived indicators to improve the service, calibrate algorithms, and study internal cohorts.
- Data used: derived indicators (sleep quality, recovery, vitality, activation, stress, and other aggregated physiological state indicators) and app usage patterns. Not shared with third parties. Analyses are conducted exclusively on internal cohorts.
- Withdrawal: revocable at any time from My Account. Withdrawal will stop the inclusion of new data in the analyses; statistical analyses already produced may be retained in anonymous form in accordance with Recital 26 GDPR.
- Effect on service: none. The app will continue to function normally if the option is disabled.
4 bis.3 No active personalization options
If the user does not activate either of the two personalization options, their health data will be processed only to provide the main service: receiving, storing, and displaying their metrics and the derived indicators offered by the App. The legal basis for this minimal processing combines Art. 6.1.b GDPR (performance of the digital service contract) and Art. 9.2.a GDPR (explicit consent for special category data — mandatory acceptance no. 3 of §4 bis.1).
5. Purposes of processing
We process your data to:
- Provide the main service: receive, store, and display your physiological, health, and activity metrics.
- Calculate derived indicators (sleep quality, recovery, vitality, activation, stress, and other aggregated physiological state indicators) from the raw wearable data. These indicators are considered health data (see §5 bis).
- Link and maintain the connection with your Wellbeinn V8 wearable.
- Manage your account: registration, authentication, password recovery.
- Respond to your support and incident requests.
- Improve our products through strictly aggregated and anonymous statistical analysis (this purpose is only executed if the user activates Option 2 "Personalization and product improvement," see §4 bis.2 and §5.6).
- Comply with applicable legal obligations.
5 bis. Derived indicators, profiling, and non-medical nature
The indicators of sleep quality, recovery, vitality, activation, stress, and other aggregated physiological state indicators are calculated through an automated processing of your health data that constitutes profiling of the physiological state (Art. 4.4 GDPR). These derived indicators are also considered health data (Art. 9 GDPR) and are governed by the same legal basis (explicit consent, Arts. 6.1.a and 9.2.a) as the raw wearable data.
These calculations do not make legal decisions that significantly affect you (Art. 22 GDPR): they are personal information displayed on your device, without advertising profiling.
About stopping this processing. The processing of derived data is inseparable from the provision of the service: without it, the App cannot offer its main functionality (see mandatory acceptance no. 3 in §4 bis.1). If you wish to stop this processing, your options are to stop using the App or delete your account from My Account, which will result in the effective deletion of the associated data according to §6.
The Wellbeinn V8 App and wearable are not medical devices within the meaning of Regulation (EU) 2017/745 (MDR). They are not intended to diagnose, prevent, clinically monitor, treat, or alleviate diseases, and do not replace the judgment of a healthcare professional. For any symptoms or health concerns, consult a doctor.
5.6. Anonymization vs pseudonymization
The statistical analysis referred to in purpose 6 of §5 — which is only performed when the user activates Option 2 "Personalization and product improvement" (§4 bis.2) — is carried out strictly aggregated and anonymous, in the sense of Recital 26 GDPR, without reasonable possibility of re-identification. We do not keep pseudonymized copies linked to specific users after exercising the right to erasure.
If in the future Wellbeinn wishes to process pseudonymized data for secondary research or statistical purposes, it will do so only based on a specific additional consent or the safeguards of Art. 89 GDPR, following an Impact Assessment and with a defined retention period, and we will inform you beforehand.
6. Retention periods
| Data | Retention period |
|---|---|
| Active account data | While the account remains open |
| Health data and device associated with the account | While the account remains open |
| After account cancellation request | Deletion within a maximum period of 30 calendar days |
| Technical logs and access records | 12 months based on the legitimate interest in maintaining the security and integrity of the service (Art. 6.1.f GDPR), also in accordance with the retention duty of Law 25/2007 when applicable to electronic communications |
After the retention periods, the data will be deleted or irreversibly anonymized.
Note on the service model. The service is currently free and without in-app purchases. In the future, Wellbeinn may introduce a paid subscription model for part or all of the functionality. The introduction of a paid model does not change the personal data retention periods described here; any accounting or tax obligations that may apply from that moment will be documented and communicated to the user before taking effect (Cco §30 would only apply to specific transactions, not to service data).
7. Data processors, independent controllers, and subprocessors
The following providers process personal data within the framework of the App, according to the role indicated in each case:
| Supplier | Service | Role | Location |
|---|---|---|---|
| Google Ireland Limited (Firebase / Google Cloud) | Authentication, Firestore, Storage, Cloud Functions (onUserDelete) and Cloud Logging |
Data processor (Art. 28 GDPR) | European Economic Area — region europe-west3
|
| Google LLC | “Sign in with Google” | Independent identity service controller | US — Adequacy Decision 2023/1795 (EU-US Data Privacy Framework) |
Note on infrastructure region. The exact region is
europe-west3(European Economic Area), confirmed by the Firebase console. All cloud infrastructure (Firestore, Cloud Functions, Storage, Cloud Logging) operates in this same region to minimize latency and cross-region data transfer costs.Note on Cloud Logging. If verification confirms hosting in a multi-regional
globalregion, we would expressly declare the transfer to the US under the EU-US Data Privacy Framework (Decision 2023/1795) plus technical and contractual supplementary measures.
Alternatively, for transfers to third countries without an adequacy decision, we will apply the Standard Contractual Clauses (Decision 2021/914) along with the necessary supplementary measures according to the Recommendations 01/2020 of the European Data Protection Board.
Data sent by the Wellbeinn V8 wearable travels locally via Bluetooth between the watch and the phone. The OEM manufacturer of the wearable does not receive your health data through cloud servers.
8. International transfers
Generally, your data is stored on servers located in the European Economic Area.
When a provider (e.g., Google LLC as a federated identity provider or Cloud Logging if your effective region is global) processes data from the US, the transfer basis will be, preferably, the Adequacy Decision 2023/1795 (EU-US Data Privacy Framework), under the terms the provider adheres to the framework. Alternatively, and for third countries without an adequacy decision, the Standard Contractual Clauses (Decision 2021/914) will apply along with the necessary supplementary measures.
9. Your rights
As a data subject, you may exercise the following rights:
- Access to the data we process about you.
- Correction of inaccurate or incomplete data.
- Erasure (“right to be forgotten”), with the exceptions of Art. 17.3 GDPR.
- Objection to processing. For derived indicators (recovery, vitality, sleep quality, etc.), see §5 bis on specific cessation methods.
- Restriction of processing.
- Data portability in a structured and commonly used format.
- Not to be subject to automated individual decisions with significant effects (Art. 22 GDPR).
- Withdraw consent given for the processing of health data, without retroactive effect.
9.1 How to exercise the rights
Exercising the rights is free of charge (Art. 12.5 GDPR).
You may exercise them:
- From the App: screen My Account → Privacy and Data (when available).
- By email to privacy@wellbeinn.com, indicating the right you are exercising. To verify your identity, we will preferably use the email address associated with your account. Only if there are reasonable doubts about the identity of the requester (Art. 12.6 GDPR) may we request additional information provided and limited to the minimum necessary; a copy of an ID is not required by default.
We will respond within a maximum of one month, extendable by two additional months in complex cases (Art. 12.3 GDPR).
9.2 Complaint to the supervisory authority
If you believe that the processing of your data does not comply with regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD), Calle Jorge Juan 6, 28001 Madrid — www.aepd.es.
10. Minors
Wellbeinn requires a minimum age of 16 years to use the App.
Although Art. 7 LOPDGDD (Spain) sets the default legal threshold at 14 years, Wellbeinn applies a more conservative policy of 16 years, consistent with the stricter regulations of other European Union member states (Germany, France, and other states that have set the threshold of Art. 8.1 GDPR at 16) and as a business precaution given the sensitivity of the health data processed.
During the registration process, your date of birth and an explicit age declaration are requested. If the indicated date or declaration does not meet the minimum requirement, registration cannot be completed.
If we detect — either by notice from a third party or by any other means — that a minor below the applicable threshold has registered, we will proceed to:
(i) immediately suspend the account,
(ii) require parental verification through a secure channel,
(iii) delete the account and associated data if verification is not completed within 30 days.
In future versions of the App, we will strengthen verification mechanisms with additional methods (Art. 25 GDPR).
11. Data security
We apply appropriate technical and organizational measures according to the risk level, including:
- Encryption of communications in transit (TLS 1.2+).
- Encryption at rest on storage servers (managed by our infrastructure provider).
- Granular security rules in Firestore and Storage that only allow each user to read/write their own information (access control by UID and, in Storage, size and MIME type restrictions).
- Credential storage with one-way hash functions managed by the identity provider.
- Annual security audits and documented incident response procedures.
In the event of a security incident affecting your data and posing a high risk to your rights, we will notify you without undue delay (Art. 34 GDPR), by email to the address associated with your account and/or via in-app message, indicating the nature of the breach, the categories and approximate volumes of affected data, probable consequences, and measures taken or proposed. We will also report the breach to the AEPD within 72 hours (Art. 33 GDPR).
12. Cookies and identifiers
The App does not use cookies or equivalent advertising tracking technologies. Only strictly necessary technical identifiers are used for the service operation (session token, installation identifier). The website wellbeinn.com may use session and, if applicable, measurement cookies; this is governed by the site's specific cookie policy.
13. Changes to this Policy
We may update this Policy to reflect legal or technical changes. The date and version appear at the end of the document; the full version history (with a summary of substantial changes) is published at wellbeinn.com/legal.
Substantial changes will be understood to include —among others— the addition of new categories of processed data, the introduction of new controllers or subprocessors in third countries, modification of purposes or legal bases, and changes affecting the rights of the data subject. Substantial changes will be notified by email and/or through the App with reasonable advance notice, obtaining new consent when necessary.
14. Version and date
- Version: 1.0.5
- Last update date: April 29, 2026
- Available languages: Spanish, English. In case of discrepancy, the Spanish version prevails.