Privacy policy

For any question about your personal data, write to us at hello@wellfirst.app. We answer within one month.

• let you know when the app launches, or share product news,
• reply to you if you get in touch.

Legal basis: your consent (art. 6.1.a GDPR), given by submitting the form.

The website uses no cookies and no advertising trackers. No consent banner is therefore required. It does use two measurement tools provided by our host:

• Vercel Web Analytics — visit counts and pages viewed. It works without cookies and without a persistent identifier: it cannot recognise you from one visit to the next, nor follow you across other sites.
• Vercel Speed Insights — page load times, to catch slowdowns.

Neither serves any advertising purpose and neither collects health data. Legal basis: our legitimate interest (art. 6.1.f GDPR) in measuring the audience and performance of the site.

• an email address — it is your login identifier and how we reach you;
• a password — handled by Supabase Auth, our authentication provider: we never see it and it is never stored in clear text, only as a hash;
• a display name — this is what your coach sees. You are under no obligation to use your real identity: a first name, initials or a pseudonym work perfectly well.

There is no social login, and we collect no phone number, no postal address, no date of birth and no payment card details.

Two points deserve to be stated plainly:

• These answers are health data under article 9 GDPR. Simple questions or not, information about your sleep or your pain is health data, and we treat it as such. Legal basis: your explicit consent (art. 9.2.a), given when you create your account and withdrawable at any time by deleting it.
• These answers are pseudonymised, not anonymised. They are stored under your account's technical identifier, without your name, but that identifier remains tied to your email. It is exactly that link which lets us show you your history and guarantee your right to erasure: truly anonymous data could neither be given back to you nor deleted on request.

The two free-text fields are capped at 200 characters and are yours: write only what you are willing to share with your coach, and avoid precise medical information, contact details, or anything concerning someone else.

Your answers are never used for advertising, never sold, never passed to a data broker, an insurer or an employer, and are not used to train any artificial intelligence model.

While the link exists, your coach can see:

• your display name and email address,
• every one of your Check-in answers, including pain areas and free-text fields,
• your Score and how it changes over time,
• your Check-ins from before the link was created, if any — the history is not truncated at the linking date,
• a notification when you complete a Check-in, if they enabled it.

Your coach can neither edit nor delete your answers, and has no access to any Client other than their own: that separation is enforced by the database itself, not by the app.

If the link is broken, that coach loses access immediately going forward. We can do nothing, however, about anything they may have noted or copied elsewhere during the coaching period.

• TelemetryDeck — aggregate usage measurement (for example: how many Check-ins are completed). Signals are sent without a user identifier and contain no Check-in answers.
• Sentry — technical error and crash reporting, so we can fix them. No health or payment data is sent to it.

The website uses neither; its own audience measurement is described above.

• Supabase — the app's database, authentication and server functions, plus storage of waitlist email addresses,
• Vercel — website hosting and delivery, cookie-free audience measurement and performance measurement,
• Expo, Apple (APNs) and Google (FCM) — push notification delivery,
• RevenueCat, Apple and Google — subscription management and billing,
• Sentry — technical error reporting,
• TelemetryDeck — anonymous usage measurement.

Some of our providers are, however, established outside the European Union, or belong to companies that are: this is the case for Supabase Inc. itself, Vercel, Apple, Google, Expo, RevenueCat and Sentry, insofar as their technical support may access those systems. Such transfers are covered by the European Commission's standard contractual clauses, alongside the security measures described below.

• Waitlist email address — until you unsubscribe or it no longer serves a purpose.
• Account and Check-in answers — for as long as your account exists. The history is the point of the service: there is no automatic deletion after a set period, it is your call.
• Notification tokens — until notifications are turned off or the account is deleted.
• Subscription billing data — kept by Apple, Google and RevenueCat under their own policies; on our side the status is deleted with the account.
• Technical errors (Sentry) — 90 days.
• Website audience measurement — aggregate data, kept with no way to tie it back to you.

Deletion erases your profile, all of your Check-ins and Scores, your notification tokens and, where applicable, the link with your coach — who loses all access immediately. The operation is immediate and irreversible.

Encrypted database backups may hold a residual copy for at most 30 days, after which it disappears through rotation. Those backups are only ever used for disaster recovery.

If you can no longer access the app, write to us at hello@wellfirst.app from your account email address: see the Deleting your account page.

• Access — obtain a copy of your data,
• Rectification — correct inaccurate data,
• Erasure — delete your data, directly from the app,
• Portability — receive your data in a structured, machine-readable format,
• Restriction and objection — limit or contest a processing operation,
• Withdrawal of consent — at any time, without affecting the lawfulness of processing already carried out.

To exercise these rights, write to us at hello@wellfirst.app.

You also have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French supervisory authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr. If you live in another EU country, you may also complain to your own supervisory authority.

• encryption in transit (HTTPS/TLS) on both the website and the app, and encryption at rest for the database,
• passwords stored only as hashes by Supabase Auth,
• access separation enforced at the database level (Row Level Security): a Client can only read their own data, a coach only that of the Clients linked to them,
• administrative access limited to those who need it, and established providers applying their own technical and organisational measures.

No system is infallible. In the event of a data breach likely to result in a high risk to your rights, we will inform you and the CNIL within the timeframes set by the GDPR.