WOLIBA, INC.
PRIVACY POLICY
Effective Date: October 26, 2026
Version: 2
Woliba, Inc. (“Woliba,” “we,” “us,” or “our”) respects your privacy. Some information processed through Woliba – including health, wellness, biometric, screening, wearable, and voluntarily uploaded medical information – may be particularly sensitive. This Privacy Policy explains how Woliba collects, uses, discloses, retains, and otherwise processes personal information when you use Woliba websites, applications, software, engagement and recognition features, wellness programs, nonclinical screening services, and other Woliba, Inc. products or services that link to this Privacy Policy (collectively, the “Services”).
This Privacy Policy governs Woliba, Inc. Services. It does not govern the independent collection or processing of personal information by an independent healthcare provider, Connected Service, Screening provider, or other third party merely because that service is linked to, integrated with, marketed alongside, or accessible through the Woliba Platform.
This Privacy Policy also explains important distinctions among information supplied by an employer or sponsor, information you provide directly to Woliba, User-controlled information, employer-visible program information, Restricted Health Data, and information that may or may not constitute Protected Health Information under HIPAA.
Please read this Privacy Policy together with any additional notice, consent, authorization, or service-specific disclosure presented for a feature you choose to use.
DEFINITIONS
For purposes of this Privacy Policy:
“Aggregate Data” means information combined across individuals, accounts, organizations, events, or other records so that it does not identify a particular individual in the form used or disclosed.
“Connected Service” means a wearable, mobile application, health-data service, fitness platform, device provider, or other third-party service that you authorize to exchange information with the Woliba Platform.
“Consumer Health Data” means personal information that is defined as consumer health data, health data, or a substantially similar category under an applicable state consumer-health-data law.
“De-identified Data” means information processed so that it cannot reasonably be linked to an identified or identifiable individual under the applicable legal standard and that is maintained subject to applicable restrictions against re-identification.
“Sensitive Data” means personal information subject to heightened protection under Applicable Law because of its nature, which may include Restricted Health Data, Consumer Health Data, PHI, biometric information, precise geolocation, government identifiers, financial-account information, authentication credentials, and other legally designated sensitive or special-category data.
“Clinical Services” means medical diagnosis or treatment, prescribing, psychotherapy, pharmacy, laboratory, clinical telehealth, or other professional healthcare services.
1. WHO THIS PRIVACY POLICY COVERS
This Privacy Policy applies to individuals who interact with Woliba, including:
employees and other individuals receiving Woliba through an employer or sponsoring organization;
individual consumers who purchase or use Woliba Services directly;
adult dependents eligible for Woliba Services;
individuals participating in Woliba-performed nonclinical Screening Services;
individuals using wellness, activity, wearable, challenge, assessment, engagement, recognition, rewards, survey, event, or similar Woliba functionality;
visitors to Woliba websites;
administrators, managers, and representatives of Woliba business customers; and
other users of Services that link to this Privacy Policy.
We refer to these individuals as “Users” or “you.”
This Privacy Policy does not, by itself, govern medical diagnosis or treatment, prescribing, psychotherapy, pharmacy services, laboratory services, clinical telehealth, or other professional healthcare services (collectively, “Clinical Services”) provided independently by a healthcare provider or other third party. Those services are governed by the privacy documentation applicable to the responsible entity.
2. WOLIBA’S ROLE AND INDEPENDENT SERVICES
2.1 Woliba, Inc.
Woliba provides software-as-a-service, engagement, recognition, rewards, surveys, challenges, general wellness functionality, wellness content, assessments, wearable integrations, analytics, nonclinical wellness support, certain Woliba-performed nonclinical Screening Services, and related technology and administrative services.
Woliba is not a physician, medical practice, pharmacy, laboratory, health plan, insurer, or clinical healthcare provider merely because a Service permits you to enter, upload, store, receive, or interact with health-related information.
2.2 Independent Clinical and Third-Party Services
Independent healthcare providers and other third parties may provide Clinical Services or other services accessible through or in connection with the Woliba Platform. Those entities independently determine their privacy practices to the extent they act in their own legal capacity.
A link, integration, shared sign-on, coordinated program, or other connection with Woliba does not by itself make an independent third party part of Woliba or make its independent data practices subject to this Privacy Policy.
2.3 No Automatic Affiliate or Third-Party Health-Data Access
Restricted Health Data maintained by Woliba for you does not automatically become available to an Affiliate, healthcare provider, or other third party. Where a transfer requires your consent, authorization, or another legal basis, Woliba may present a separate contextual authorization identifying or making reasonably clear the information to be transferred and the purpose of the transfer.
If Woliba processes information on behalf of another entity as a service provider, processor, Business Associate, or subcontractor Business Associate, Woliba will process that information according to the applicable privacy, HIPAA, security, contractual, and other legal requirements. That processing does not give Woliba independent rights to use the information outside the applicable role.
3. INFORMATION WE COLLECT
The information Woliba collects depends on the Services you use, how you receive them, the features you activate, and the choices you make.
3.1 Account and Identity Information
name;
email address;
telephone number;
mailing or residential address where needed;
date of birth or age where needed;
sex or other demographic information where relevant to a selected feature;
username and account identifiers;
password, authentication, and security information;
profile photograph;
language and time zone;
employer or sponsoring organization;
employee, member, or participant identifier;
dependent eligibility information; and
account and eligibility status.
3.2 Information Provided by Your Employer or Sponsor
If an employer or another organization sponsors your access, Woliba may receive information reasonably necessary to establish and administer that access, such as:
name and contact information;
employee or member identifier;
employment or membership status;
organizational unit or work location;
manager or administrator status;
eligibility information;
benefit or program effective and termination dates;
dependent eligibility; and
other administrative information reasonably necessary for the Woliba Services purchased by the sponsor.
An employer’s provision of account or eligibility information does not give the employer ownership of all information you later provide directly to Woliba and does not give the employer unrestricted access to User-controlled Restricted Health Data.
3.3 Platform, Engagement, and Program Information
logins and account activity;
features accessed;
challenge participation and completion;
steps or activity used in a challenge;
exercise or wellness-program activity;
points and rewards;
recognition activity;
event participation;
survey activity;
content viewed;
program participation;
communications;
administrator or manager activity;
account settings; and
other interaction information.
3.4 Health and Wellness Information
Depending on the Woliba Services you choose to use, you may voluntarily provide or generate identifiable information concerning health, wellness, physical condition, biometrics, screenings, fitness, activity, or related matters. We refer to this category as “Restricted Health Data.” It may include:
weight, height, body mass index, body-fat percentage, blood pressure, VO2 max, resting heart rate, and similar body or fitness measurements;
activity, exercise, steps, sleep, nutrition, hydration, and similar wellness information;
health or wellness goals and questionnaire responses;
wellness-assessment information;
Screening information and results;
wearable or Connected Device information;
medical documents, physician notes, laboratory results, medication information, or other records that you voluntarily upload to a Woliba feature that supports such uploads;
general stress or emotional-wellness information submitted to nonclinical Woliba functionality; and
other health or wellness information you voluntarily provide.
Restricted Health Data is a Woliba privacy classification. It is broader than information legally defined as PHI under HIPAA and may include Consumer Health Data, biometric information, Sensitive Data, or another specially regulated category under Applicable Law.
3.5 Wellness Questionnaires and Personalization Information
Woliba may ask you to complete voluntary questionnaires concerning wellness interests, goals, physical activity, nutrition, stress, sleep, financial or social wellness, preventive-wellness objectives, or other wellness priorities. Woliba may use your responses to personalize nonclinical wellness content, challenges, educational materials, preventive-wellness suggestions, and your Woliba experience.
3.6 Wearable and Connected Device Data
If you choose to connect a wearable, fitness service, mobile health application, or other Connected Service, Woliba may receive information within the permissions you authorize, such as steps, distance, exercise, activity time, calories, sleep, heart-rate-related information, fitness metrics, body measurements, device identifiers, synchronization information, and other supported information.
A separate Wearable & Connected Device Data Authorization or equivalent connection workflow may apply. Connecting a device to Woliba does not automatically authorize your employer, an Affiliate, a healthcare provider, or another third party to access your entire Woliba health profile.
3.7 Screening Information
If you participate in a Screening Service directly performed by Woliba, Woliba may collect registration and eligibility information, nonclinical Screening measurements, information reasonably necessary to conduct the Screening safely, results, consent records, and related administrative information.
A Participant Screening Consent & Release may apply. Participation in a Screening and saving Screening results into your persistent Woliba account are separate activities. Woliba may require a separate Screening Result Import Authorization before results are stored or used for broader individualized Platform purposes.
If an independent third party performs a Screening, that provider may independently collect and maintain information under its own privacy documentation.
3.8 User-Uploaded Medical Information
A Woliba feature may permit you to voluntarily upload a medical document, physician note, laboratory result, medication record, or similar health information. Woliba does not become the healthcare provider that created the record, does not adopt or verify the clinical content merely by storing it, and does not become a general medical-record custodian or system of record merely because you upload the information.
You should not transmit Restricted Health Data through an ordinary support ticket, general email address, or other channel Woliba has not designated for that information. If Woliba receives sensitive information through an unintended channel, it may restrict, relocate, quarantine, preserve, or delete the information as appropriate.
3.9 Payment Information
If you make a payment to Woliba for a Woliba Service, Woliba or its payment providers may process billing information, transaction amount and date, payment status, refunds, chargebacks, product or service purchased, and payment tokens or processor identifiers. Complete payment-card credentials may be maintained by the payment processor rather than Woliba.
3.10 Communications and Support
contact information;
the content of communications;
support requests;
complaints and feedback;
transaction or account inquiries;
technical issues; and
records of Woliba’s response.
3.11 Device, Technical, and Usage Information
IP address;
device identifiers;
browser and operating system;
device type;
application version;
approximate location derived from IP address;
log and error information;
security information;
access times;
referring pages; and
technical interaction information.
3.12 Cookies and Similar Technologies
Woliba websites and Services may use cookies, pixels, SDKs, local storage, analytics technologies, and similar technologies for authentication, security, preferences, analytics, website performance, Service usage, and communications management. Where Applicable Law requires consent or an opt-out for a particular technology or purpose, Woliba will provide the applicable choice mechanism.
4. SOURCES OF INFORMATION
Woliba may collect information:
directly from you;
from your employer or sponsoring organization;
from administrators acting for your organization;
from a wearable, device, application, or integration at your direction;
from a Woliba Screening activity;
from an independent Screening provider where the applicable data flow permits;
from payment processors and service providers;
automatically through the Services;
from an Affiliate or independent third party when a documented legal basis permits Woliba to receive information in a defined role; and
from other sources permitted by Applicable Law.
The source and purpose of information matter because different privacy, contractual, HIPAA, employment, consumer-health-data, and other legal rules may apply to different data flows.
5. HOW WE USE INFORMATION
5.1 Provide and Operate Woliba Services
create and maintain accounts;
authenticate Users;
provide Platform functionality;
administer eligibility;
provide engagement, recognition, rewards, surveys, events, challenges, and wellness functionality;
administer Woliba-performed Screenings;
maintain authorized wearable and other integrations;
process Woliba transactions;
deliver requested information;
provide support; and
maintain, secure, and troubleshoot the Services.
5.2 Personalize Your Woliba Experience
recommend content and challenges;
identify wellness areas of interest;
organize information you choose to provide;
provide general preventive-wellness education and suggestions;
support wellness goals; and
tailor nonclinical Woliba functionality.
Woliba personalization does not constitute medical diagnosis, prescribing, dosage decisions, medical-necessity determinations, psychotherapy, or other Clinical Services.
5.3 Administer Employer or Sponsor Programs
verify eligibility;
administer challenges, rewards, incentives, and wellness programs;
provide sponsor-visible participation and administrative information;
support program administration;
provide employer dashboards; and
generate permitted Aggregate Data, De-identified Data, and cohort-based reporting.
5.4 Administer Screening Services
register participants;
conduct Screenings Woliba directly performs;
generate and deliver results;
maintain appropriate consent, operational, safety, and compliance records;
provide permitted aggregate reporting; and
save results to a persistent Woliba account where the User separately authorizes that use when required.
5.5 Analytics, Security, and Service Improvement
understand use of the Services;
troubleshoot and improve functionality;
maintain security;
evaluate engagement and program effectiveness;
develop new Woliba functionality;
conduct benchmarking;
improve usability;
prevent fraud and misuse; and
support business planning.
Where reasonably appropriate for the purpose, Woliba may use Aggregate Data or De-identified Data instead of identifiable Restricted Health Data.
5.6 Legal and Compliance Purposes
comply with law and lawful process;
enforce agreements and policies;
investigate complaints or suspected misuse;
protect Woliba, Users, customers, and others;
respond to privacy or security incidents; and
establish, exercise, or defend legal claims.
5.7 Communications
Woliba may use contact information for account notices, security alerts, program communications, reminders, transaction notices, support communications, and other service-related messages. Subject to Applicable Law and your preferences, Woliba may also send marketing communications concerning Woliba products and services.
6. ARTIFICIAL INTELLIGENCE AND AUTOMATED FUNCTIONALITY
Woliba may use artificial intelligence, algorithms, machine learning, or similar automated tools to support nonclinical functions such as wellness-content recommendations, challenge recommendations, Platform navigation, engagement recommendations, preventive-wellness suggestions, organization of information, analytics, administrative functionality, and other Woliba features.
Woliba AI does not diagnose disease, prescribe medication, determine dosage, establish medical necessity, provide psychotherapy, or replace professional clinical judgment.
6.1 Restricted Health Data and AI
Where an AI-supported Woliba feature processes identifiable Restricted Health Data, the processing is subject to this Privacy Policy, the applicable Health & Wellness Data Consent and Authorization, service-specific disclosures, Woliba’s internal access and AI governance controls, and Applicable Law.
6.2 Model and Product Improvement
Woliba may use Aggregate Data or appropriately De-identified Data for analytics, product development, service improvement, and model improvement. Woliba does not authorize an external AI provider to use identifiable Restricted Health Data received from Woliba to train that provider’s generalized models unless the use is separately disclosed, lawfully authorized, and approved under Woliba’s applicable privacy and AI governance requirements.
7. HOW WE DISCLOSE INFORMATION
7.1 Employers and Sponsoring Organizations
If an employer or another organization sponsors your Woliba access, Woliba may provide information appropriate to the applicable Woliba program. Depending on the program and what is identified as sponsor-visible, this may include account eligibility, challenge participation, activity information used for an employer-sponsored challenge, completion status, points and rewards, event participation, administrative activity, Platform engagement, and similar program information.
Woliba may also provide Aggregate Data, De-identified Data, or appropriately limited cohort reporting concerning wellness, Screenings, engagement, and program activity.
7.2 Information Woliba Does Not Ordinarily Disclose to Employers by Name
Unless you separately authorize disclosure or Applicable Law otherwise permits or requires it, Woliba does not ordinarily provide an employer by name with:
diagnoses or clinical treatment information;
prescriptions or medication information maintained in a private Woliba account;
laboratory results or physician notes;
medical records or documents you voluntarily upload;
individual Screening measurements or results;
detailed wearable or Connected Device health information maintained for your individual use;
behavioral-health or other specially protected health information;
information concerning services you obtain from an independent healthcare provider or other third-party Clinical Service; or
other User-controlled Restricted Health Data designated as private or individual-facing.
An employer’s payment for Woliba does not itself create a right to this information.
7.3 Minimum Cohorts and Suppression
Woliba may use minimum cohort thresholds, suppression, aggregation, filter restrictions, category consolidation, withholding of reports, or similar safeguards where reporting about a small group could reasonably increase re-identification risk.
7.4 Affiliates and Independent Third Parties
Woliba does not disclose Restricted Health Data to an Affiliate or independent third party merely because of affiliation, integration, branding, or a commercial relationship. A transfer may occur when you affirmatively authorize it, when the transfer is necessary for a service you have elected and another lawful basis applies, when Woliba acts in a legally recognized service-provider, processor, Business Associate, or subcontractor role, or as otherwise permitted or required by Applicable Law.
Where a separate contextual authorization is required, that authorization controls the particular transfer.
7.5 Independent Screening Providers
Where an independent third party conducts a Screening, Woliba may share information reasonably necessary to register you, schedule the Screening, establish eligibility, or administer the event. The provider’s own privacy documentation governs information it independently collects or maintains.
7.6 Payment Providers
Woliba may disclose transaction information to payment processors, banks, fraud-prevention providers, and other entities reasonably necessary to process or administer payments.
7.7 Service Providers and Subprocessors
Woliba may use service providers to support cloud hosting, infrastructure, communications, analytics, authentication, security, customer support, payment processing, software operations, and other business functions. Such providers may process personal information only as appropriate to their functions and subject to contractual or legal restrictions appropriate to their role.
Where a service provider creates, receives, maintains, or transmits PHI on behalf of Woliba in a HIPAA-regulated data flow, Woliba applies the subcontractor requirements required by HIPAA.
7.8 Professional Advisers
Woliba may disclose information where reasonably necessary to attorneys, accountants, auditors, insurers, consultants, and other professional advisers subject to appropriate confidentiality duties.
7.9 Legal, Security, and Safety Disclosures
Woliba may disclose information when reasonably necessary to comply with law or lawful process, investigate fraud or misuse, protect Woliba or others, respond to a privacy or security incident, or establish, exercise, or defend legal rights.
7.10 Corporate Transactions
Information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, change of control, or similar corporate transaction, subject to Applicable Law and appropriate protections.
8. RESTRICTED HEALTH DATA: SALE, SHARING, AND ADVERTISING
Woliba does not sell Restricted Health Data to data brokers or other third parties for their independent use. Woliba does not permit employers to purchase unrestricted access to individually identifiable Restricted Health Data merely because they sponsor Woliba Services.
Woliba does not use identifiable diagnoses, prescriptions, laboratory results, uploaded medical records, individual Screening results, or comparable Restricted Health Data to create third-party advertising audiences based on your medical condition or treatment.
Privacy statutes may define terms such as “sale,” “sharing,” or “targeted advertising” more broadly than ordinary commercial usage. Where an applicable law uses a broader definition, Woliba will apply the statutory definition and provide any legally required notice, consent, authorization, or opt-out.
9. AGGREGATE AND DE-IDENTIFIED DATA
Woliba may create Aggregate Data and De-identified Data from information processed through the Services and use such information for analytics, benchmarking, reporting, research, security, service improvement, product development, AI and model improvement, business planning, and industry insights, subject to Applicable Law.
Where information is treated as De-identified under Applicable Law, Woliba will maintain it in De-identified form and will not knowingly use it to identify you except where legally permitted, including to test the effectiveness of de-identification safeguards.
10. HEALTH INFORMATION AND HIPAA
Health information is not automatically regulated by HIPAA merely because it concerns health. HIPAA status depends on the information, the entity and legal role in which it is held, the source and purpose of the information, the function being performed, and the applicable relationship.
10.1 Non-PHI Health and Wellness Information
Some health and wellness information you provide directly to Woliba through individual-facing or employer-sponsored non-plan wellness functionality may not constitute PHI. Woliba nevertheless treats identifiable health and wellness information within its Restricted Health Data framework and applies protections appropriate to the information and Applicable Law.
10.2 When Woliba Acts as a Business Associate
In some group-health-plan, healthcare-provider, or other HIPAA-regulated arrangements, Woliba may create, receive, maintain, or transmit PHI on behalf of a Covered Entity or Business Associate. In that circumstance, Woliba’s Business Associate Agreement and the HIPAA Rules govern the applicable Scoped PHI and function.
The existence or absence of a BAA does not itself determine statutory status. A BAA documents and governs the applicable relationship where HIPAA makes Woliba a Business Associate or subcontractor Business Associate.
10.3 BAA Scope Does Not Expand Employer Access
A BAA does not convert all information in the Woliba Platform into PHI and does not give an employer, plan sponsor, administrator, or manager access to information that person is not otherwise lawfully authorized to receive.
10.4 Independent Providers
Independent healthcare providers may separately be Covered Entities and may provide their own HIPAA Notice of Privacy Practices. This Privacy Policy does not replace an independent provider’s HIPAA notice.
11. SCREENING PRIVACY
For Woliba-performed Screenings, your individual result is intended primarily for you. Your employer ordinarily receives permitted administrative information, such as participation or completion status, and Aggregate or De-identified reporting rather than individual Screening values.
A separate Participant Screening Consent & Release may apply. If Woliba offers you the option to save Screening results to your persistent Woliba account for broader individualized use, Woliba may require a separate Screening Result Import Authorization.
Screening participation does not automatically authorize disclosure of your results to an Affiliate, healthcare provider, or other third party.
12. WEARABLES AND THIRD-PARTY CONNECTIONS
If you choose to connect Woliba to another service, you direct the applicable connection. The third party may independently collect and maintain information under its own privacy terms. Data previously transferred may remain in the recipient’s systems after you disconnect, and disconnecting generally stops future exchange rather than retroactively deleting prior lawful transfers.
A Wearable & Connected Device Data Authorization or other integration-specific workflow may describe the particular categories and purposes. Review the privacy terms of any third-party service you choose to connect.
13. USER-CONTROLLED HEALTH INFORMATION
Certain information may be provided by you directly to Woliba in your own capacity and governed by Woliba’s User-facing terms, notices, consents, and authorizations. That information is not necessarily Customer Data merely because you first obtained access through an employer or sponsor.
Woliba may restrict employer or administrator access to such information even where the employer sponsors your account. Woliba may also provide you with account controls or privacy choices concerning eligible information.
14. DATA RETENTION
Woliba applies retention periods or retention criteria by category, taking into account the purpose for which the information was collected, the duration of the applicable account or customer relationship, the sensitivity of the information, legal and contractual requirements, security and fraud-prevention needs, dispute and records-preservation requirements, and whether continued retention is reasonably necessary for the disclosed purpose.
The principal category-level retention criteria are: (a) account, identity, eligibility, and customer-administration information – for the account or sponsorship relationship and a limited period afterward needed for account transition, administration, security, legal compliance, and dispute handling; (b) engagement, challenge, rewards, recognition, event, and program records – for program administration, reporting, accounting, audit, and applicable legal periods; (c) User-controlled wellness, wearable, Screening, questionnaire, and voluntarily uploaded health information – for the period reasonably necessary to provide the User-selected feature, generally subject to shorter retention and deletion rules for detailed health information where feasible, plus any period required by law, consent records, legal hold, or an applicable HIPAA-regulated workflow; (d) payment and transaction records – for financial, tax, chargeback, fraud-prevention, and accounting periods; (e) support and communications records – for service administration, quality, security, and dispute handling, with unintended Restricted Health Data subject to shorter handling where feasible; (f) device, technical, security, and log information – for operational security, troubleshooting, fraud prevention, and system-integrity periods; and (g) consent, authorization, privacy-request, compliance, and legal records – for the period needed to demonstrate compliance and satisfy applicable limitation, audit, or preservation requirements.
Specific retention periods may vary by feature, legal role, and jurisdiction. Woliba maintains internal retention schedules for operational implementation. When identifiable information is no longer reasonably necessary for a lawful purpose, Woliba may delete or appropriately De-identify it, subject to applicable exceptions.
Where available and legally permitted, you may request deletion of eligible information. Woliba may retain limited information when permitted or required for legal compliance, security, fraud prevention, payment or accounting records, claims and disputes, Legal Holds, proof of consent or authorization, backups, HIPAA or other regulated documentation, or another lawful purpose.
Information retained in protected backups may remain until overwritten through ordinary backup cycles and may be subject to deletion controls if restored.
15. SPONSORSHIP ENDS OR YOU LEAVE AN EMPLOYER
The end of employer sponsorship does not necessarily require immediate deletion of all information associated with your Woliba account. Depending on the Service, your choices, Applicable Law, and available account options, Woliba may restrict access, provide a transition period, permit continuation through a direct individual relationship, allow export or deletion, or retain limited information for lawful purposes.
Employer termination does not give the former employer new rights to User-controlled Restricted Health Data, and it does not automatically authorize transfer of that information to an Affiliate, healthcare provider, or other third party.
16. YOUR ACCESS, EXPORT, CORRECTION, AND DELETION OPTIONS
Depending on the Service and Applicable Law, you may be able to:
access information in your account;
correct or edit eligible information;
delete eligible health or wellness entries;
export eligible health or wellness information;
disconnect devices or integrations;
withdraw certain future permissions;
change communication preferences; or
request account deletion.
Woliba may verify your identity or authority before acting on a request. Some information cannot be deleted immediately or may be retained as described above.
Deleting information from Woliba does not necessarily delete records independently maintained by an employer, Connected Service provider, Screening provider, healthcare provider, payment processor, Affiliate, or other third party.
17. U.S. STATE PRIVACY RIGHTS
Residents of certain U.S. states may have additional rights under applicable privacy laws. Depending on your jurisdiction, the information involved, and applicable exemptions, rights may include the ability to confirm processing; know, access, or obtain a copy of personal information; correct inaccuracies; delete eligible information; obtain data portability; opt out of a sale, sharing, targeted advertising, or certain profiling; limit certain uses or disclosures of sensitive personal information where the applicable law provides that right; withdraw consent for processing that depends on consent; and appeal certain privacy-request decisions.
You may submit an applicable privacy request using the methods listed in Section 28. Woliba will verify and respond to requests as required by Applicable Law. Woliba may provide a state-specific privacy notice, Consumer Health Data Privacy Notice, or other supplemental disclosure where required. Rights are subject to statutory exceptions and limitations.
Woliba will not unlawfully discriminate against you for exercising an applicable privacy right. Where Applicable Law requires Woliba to recognize an opt-out preference signal, such as Global Privacy Control, Woliba will treat a qualifying signal as a request to opt out for the browser or device and, where the law and available information permit, the associated User. If Woliba engages in a practice that constitutes a “sale” or “sharing” of personal information under Applicable Law, Woliba will provide the legally required “Do Not Sell or Share My Personal Information” mechanism. Woliba does not use Sensitive Data for purposes that require a separate right-to-limit mechanism unless Woliba provides that mechanism or another legally permitted method before engaging in the applicable use.
18. CONSUMER HEALTH DATA
Some state laws regulate “consumer health data” or similar categories more broadly than HIPAA. To the extent such laws apply to Woliba, Woliba may provide a separate Consumer Health Data Privacy Notice describing applicable categories, sources, purposes, disclosures, rights, consent or authorization requirements, deletion rights, appeal rights, and contact methods.
The absence of HIPAA coverage does not mean Woliba may process health information without regard to other applicable privacy laws.
Where a consumer-health-data law requires separate consent for collection or sharing, or a separate authorization for a specified disclosure, Woliba will use the legally required mechanism rather than relying solely on this general Privacy Policy.
19. MARKETING
Woliba may use ordinary contact and account information to inform you about Woliba products, services, features, or programs, subject to Applicable Law and available preferences.
Woliba does not use identifiable diagnoses, prescription information, laboratory results, uploaded medical records, individual Screening results, or comparable Restricted Health Data to create third-party advertising audiences based on medical condition or treatment.
You may opt out of nonessential marketing communications using the method provided in the communication. You may continue to receive transactional, security, or operational messages necessary for the Services.
20. SECURITY
Woliba uses administrative, technical, and physical safeguards designed to protect personal information appropriate to the nature of the information and Woliba’s legal role. These safeguards may include role-based access controls, authentication, logging, security monitoring, incident-response processes, and contractual controls for service providers.
Woliba may use third-party cloud infrastructure, hosting providers, subprocessors, and other technology vendors subject to controls appropriate to their role.
No method of storage or transmission can be guaranteed completely secure. You can help protect your information by protecting your credentials and devices, using available multifactor authentication, logging out of shared devices, and promptly reporting suspected unauthorized access.
21. INTERNATIONAL DATA TRANSFERS
Woliba is based in the United States. If you access the Services from another country, information may be processed in the United States or other jurisdictions in which Woliba or its service providers operate. Where Applicable Law requires a transfer mechanism or other safeguards, Woliba will use an appropriate lawful mechanism.
21A. EEA, UNITED KINGDOM, AND SWITZERLAND PRIVACY RIGHTS
This Section applies only to the extent the GDPR, UK GDPR, Swiss data-protection law, or substantially similar law applies to Woliba’s processing of your personal information.
Controller and Legal Bases. Where Woliba acts as Controller, Woliba processes personal information as necessary to perform a contract with you or provide requested Services; for Woliba’s legitimate interests in operating, securing, improving, administering, and protecting the Services where those interests are not overridden by your rights; to comply with legal obligations; and on the basis of consent where consent is the appropriate or required legal basis. Where Woliba processes special-category health data subject to Article 9 of the GDPR, Woliba will rely on explicit consent or another Article 9 condition that is available for the particular processing.
Your Rights. Subject to applicable conditions and exceptions, you may have rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent at any time for future processing that relies on consent. You may submit these requests using the methods in Section 28.
Complaints. You may lodge a complaint with the data-protection supervisory authority in the country where you live or work or where you believe an infringement occurred. We encourage you to contact Woliba first so that we can address your concern.
International Transfers. Woliba is based in the United States. Where Applicable Law restricts a transfer of personal information to the United States or another country, Woliba uses an available lawful transfer mechanism, which may include the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum or other approved UK mechanism, an applicable adequacy decision, or another lawful safeguard. Information about the applicable safeguard may be requested through Section 28.
Representative and Data Protection Officer. If Applicable Law requires Woliba to designate an EEA or UK representative or a Data Protection Officer for the applicable processing, Woliba will publish or otherwise provide the required contact information. The contact methods in Section 28 may be used for data-protection inquiries in the meantime.
22. CHILDREN, MINORS, AND DEPENDENTS
Woliba’s standard adult Services are not intended for children under 13. Woliba does not knowingly collect personal information directly from a child under 13 through an ordinary adult account without an appropriate legal basis.
If Woliba later offers a Service to a minor, Woliba may require parent or guardian consent, age-specific privacy disclosures, separate account controls, restrictions on functionality, or other protections required by Applicable Law.
An employee or primary subscriber does not automatically have unrestricted access to an adult dependent’s Restricted Health Data merely because the employee or employer sponsors access. Minor confidentiality and parental-access rules may vary by age, information, Service, and Applicable Law.
23. BUSINESS CUSTOMERS AND ADMINISTRATORS
If you use Woliba as an administrator, manager, representative, or employee of a Woliba business customer, Woliba may process business contact and administrative activity information to administer the customer relationship, provide access, audit administrative activity, communicate about the Services, provide support, maintain security, and administer the subscription.
Administrator or manager status provides only the access Woliba makes available for the applicable organizational role. It does not provide unrestricted access to User information or Restricted Health Data and does not override User privacy settings, individual rights, applicable consent requirements, or Woliba access controls.
24. DE-IDENTIFICATION AND RE-IDENTIFICATION PROTECTIONS
Where Woliba provides Aggregate Data or De-identified Data to an employer or another third party, the recipient may be contractually prohibited from attempting to identify an individual from that information.
Woliba may suppress low-count reporting, combine reporting periods, limit dimensions, restrict filters, consolidate categories, withhold reports, or apply other controls reasonably appropriate to reduce re-identification risk.
25. THIRD-PARTY PRIVACY PRACTICES
Independent third parties may maintain their own privacy practices. Woliba is not responsible for an independent organization’s privacy practices merely because Woliba links to it, integrates with it, or coordinates access to it. You should review the third party’s privacy documentation before providing information directly to that organization.
This does not limit Woliba’s responsibility for disclosures Woliba itself makes or for selecting and managing service providers to the extent required by Applicable Law.
26. CHANGES TO THIS PRIVACY POLICY
Woliba may update this Privacy Policy to reflect changes in Services, data practices, law, security, technology, or other legitimate business reasons. Woliba will update the “Last Updated” date when this Privacy Policy is revised.
If a change materially affects how Woliba uses previously collected sensitive or health information, Woliba will provide additional notice or obtain consent where required by Applicable Law. Woliba will not rely solely on a general Privacy Policy update where Applicable Law requires affirmative consent or authorization for a new use or disclosure.
27. RELATIONSHIP TO OTHER WOLIBA DOCUMENTS
This Privacy Policy describes Woliba’s general privacy practices. More specific documents may govern particular information or data flows, including:
Woliba Terms of Use;
Woliba Consumer Health Data Privacy Notice;
Woliba Health & Wellness Data Consent and Authorization;
Woliba Wearable & Connected Device Data Authorization;
Participant Screening Consent & Release;
Screening Result Import Authorization;
Woliba Data Processing and Privacy Addendum;
Woliba Business Associate Agreement where applicable; and
other service-specific notices, consents, or authorizations.
A legally required specific authorization, consent, Business Associate Agreement, or other specialized privacy obligation controls for the data flow within its scope.
Independent third-party services may be subject to separate terms, privacy notices, consents, and authorizations. This Privacy Policy does not replace those documents.
28. CONTACT US
For questions concerning this Privacy Policy or Woliba’s privacy practices, contact:
Woliba, Inc.
3280 Peachtree Road NE
Atlanta, Georgia 30305
Privacy and Rights Requests: Support@woliba.io
General Support: Support@woliba.io
You may use the Privacy and Rights Requests email above to submit access, correction, deletion, portability, consent-withdrawal, opt-out, appeal, or other privacy requests. Woliba may provide additional request methods, including an online request form or toll-free number, where required by Applicable Law.
29. SUMMARY OF WOLIBA’S HEALTH-DATA PRIVACY PRINCIPLES
Woliba’s privacy architecture is intended to implement the following principles:
Employer sponsorship does not mean employer ownership of all personal or health information a User provides directly to Woliba.
Employers do not ordinarily receive identifiable diagnoses, prescriptions, laboratory results, uploaded medical records, individual Screening results, detailed private wearable data, or information concerning independent Clinical Services through ordinary Woliba employer access.
Health information may receive heightened protection even when HIPAA does not apply.
HIPAA status is determined by the applicable entity, role, function, relationship, source, purpose, and data flow – not merely by the fact that information concerns health.
Woliba limits Restricted Health Data access and disclosure according to the purpose and legal basis for the applicable Service.
Specific data flows – including wearable connections, persistent Screening-result import, and transfers to Affiliates, healthcare providers, or other third parties – may require additional affirmative authorization.
Affiliation, integration, or a commercial relationship does not create automatic third-party access to Restricted Health Data.
Woliba does not sell Restricted Health Data to data brokers for their independent use.
Woliba does not use comparable identifiable Restricted Health Data for third-party advertising based on medical condition or treatment.
Aggregate health reporting may be subject to minimum-cohort, suppression, and other re-identification safeguards.
Woliba AI-supported health and wellness functionality is nonclinical and does not diagnose, prescribe, determine dosage, or replace professional clinical judgment.
Independent third parties remain responsible for information they independently collect and maintain, subject to Woliba’s own responsibilities for disclosures and service-provider management under Applicable Law.
