Privacy Policy¶

Last Modified: September 15, 2026

Our Privacy Policy explains:

What information we collect and why we collect it.
How we use that information.
How we safeguard your information.
The choices we offer, including how to access and update information.

We’ve tried to keep it as simple as possible, but if you’re not familiar with terms like cookies, IP addresses, pixel tags and browsers, then read about these key terms first. Your privacy matters to Wellzesta so whether you are new to Wellzesta or a long-time user, please do take the time to get to know our practices – and if you have any questions email us.

1. Information we collect¶

Information you give us in our services. Most of our services require you to sign up for a Wellzesta Account. When you do, we may ask for personal information, like your name, email address and telephone number to store with your account. You may also choose to add to your personal profile on Wellzesta — for example, a photo.

Information you give us on our website. When you request a demo, book a meeting or contact us through wellzesta.com, we ask for your name, email address, telephone number and organization so that we can respond. We keep these requests in the systems we use to manage our relationship with prospective customers.

Information from systems your community connects. Your community may connect Wellzesta to other systems it runs — its electronic health record, sales CRM, dining or maintenance system, or staff directory. When it does, information those systems hold about you, such as your name, residence and move-in date, may flow into Wellzesta to create or update your account, and information from Wellzesta, such as a maintenance request or your engagement history, may flow to them. Your community decides which systems to connect and what moves between them.

Content you create in the services. We store the content you create in the services so that it can be delivered and so that you can come back to it. Depending on what your community has enabled, this includes posts you publish to your community's bulletin board, and the daily wellness check-ins you choose to record. Where your community has enabled Zesty AI, it also includes your conversations with Zesty — see the Zesty AI policy.

Information we get from your use of our services. We collect information about the services that you use and how you use them, like which news articles you view, which events you want to learn more about, which events you registered to attend, which events you attended, and the points you are awarded for taking part in wellness activities. This information includes:

Device information. We collect device-specific information (such as your hardware model, operating system version, unique device identifiers, and mobile network information).
Log information. When you use our services or view content provided by Wellzesta, we automatically collect and store certain information in server logs. This includes details of how you used our service. The log entry is a selective "snapshot" of the state of the Wellzesta Life system. For example, when you register for an event, we will record information that was available to you - like the date/time and other users (if any) that were registered for the event.
Local storage. We may collect and store information (including personal information) locally on your device using mechanisms such as cookies or private user default directories.
Website usage. On wellzesta.com we use cookies and similar technologies to measure how visitors use the site and how they reached it. These include analytics cookies and advertising-measurement cookies set by Google and by our marketing platform. On policies.wellzesta.com we use analytics cookies only, and only after you accept them. You can decline them through the cookie banner on either site.

2. How we use the information we collect¶

We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones, and to protect Wellzesta and our users. We also use this information to offer you tailored content – for example, the "Trending" section of the Dashboard.

We do not sell or share personal information, and we do not serve advertising in our services. We do not use information from the services for advertising. On wellzesta.com we use advertising-measurement cookies only to learn whether our own advertising brought a visitor to the site. Section 6 describes the limited circumstances in which we share personal information in order to deliver the services.

If you contact us through our website, we may follow up about Wellzesta's products. You can opt out of those messages at any time using the link in the message or by emailing us.

If you have a Wellzesta Account, we may display your Profile name, Profile photo, things you post in the services — for example, a post you publish to your community's bulletin board — and actions you take, such as registering for an event, to other members of your community. We will respect the choices you make to limit sharing or visibility settings in your Wellzesta Account.

We will ask for your consent before using information for a purpose other than those that are set out in this Privacy Policy.

Where your information is processed. Wellzesta processes and stores personal information on servers located in the United States. All of our infrastructure is operated in the United States.

3. Transparency and choice¶

Our goal is to be clear about what information we collect, so that you can make meaningful choices about how it is used.

You can review and update the information in your Wellzesta Profile at any time from within the app.
You can adjust how your Profile appears to others, and control what you share, in your account settings.
You can request access to, correction of, or deletion of your personal information — see section 5.

Your Wellzesta Account is administered by your community. Some settings, and some requests, are handled by your community's administrator rather than by Wellzesta directly — see section 6.

Many of our services let you share information with others.

Within your community. Wellzesta Life includes a search feature that lets members find content across the app — events, messages, documents, groups, well-being content, and the community directory. Search is available only to signed-in members, and returns only content that member is already permitted to see, scoped to their own organization and the organizations above and below it in the community's structure. Your directory profile — your name, photo, and the contact details in your profile — is findable this way by other members of your community.

Outside your community. Content a community chooses to publish publicly — for example, an event calendar published through Wellzesta Discover — is public, and may be indexed by external search engines. Nothing else is. The community directory is never publicly accessible: it is available only to signed-in members of that community.

Our services provide you with different options on sharing and removing your content.

5. Accessing and updating your personal information¶

Whenever you use our services, we aim to provide you with access to your personal information. If that information is wrong, we strive to give you ways to update it quickly or to delete it – unless we have to keep that information for legitimate business or legal purposes. When updating your personal information, we may ask you to verify your identity before we can act on your request.

We may reject requests that are unreasonably repetitive, require disproportionate technical effort (for example, developing a new system or fundamentally changing an existing practice), risk the privacy of others, or would be extremely impractical (for instance, requests concerning information residing on backup systems).

Where we can provide information access and correction, we will do so for free, except where it would require a disproportionate effort. We aim to maintain our services in a manner that protects information from accidental or malicious destruction. Because of this, after you delete information from our services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems.

We do not share personal information with companies, organizations and individuals outside of Wellzesta unless one of the following circumstances applies:

With your consent. We will share personal information with companies, organizations or individuals outside of Wellzesta when we have your consent to do so. We require opt-in consent for the sharing of any sensitive personal information.
With your community. Your Wellzesta Account is provided to you by your community. Administrators and authorized staff at your community have access to your Wellzesta Account information. They may be able to:
- view your account information and your activity in the services.
- help you sign in, or reset your password.
- suspend or terminate your account access.
- access or retain information stored as part of your account.
- receive your account information in order to satisfy applicable law, regulation, legal process or enforceable governmental request.
Please refer to your community's own privacy notice for more information.
With systems your community connects. Where your community has connected Wellzesta to another system it uses, we exchange information with that system on the community's instruction. Those systems are operated by their own providers under their own privacy policies.
For external processing. We provide personal information to our affiliates or other trusted businesses or persons to process it for us, based on our instructions and in compliance with our Privacy Policy and any other appropriate confidentiality and security measures.
For legal reasons. We will share personal information with companies, organizations or individuals outside of Wellzesta if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to:
- meet any applicable law, regulation, legal process or enforceable governmental request.
- enforce applicable Terms of Service, including investigation of potential violations.
- detect, prevent, or otherwise address fraud, security or technical issues.
- protect against harm to the rights, property or safety of Wellzesta, our users or the public as required or permitted by law.
We may share non-personally identifiable information publicly, or with the communities we serve. For example, we may share information publicly to show trends about the general use of our services.

If Wellzesta is involved in a merger, acquisition or asset sale, we will continue to ensure the confidentiality of any personal information and give affected users notice before personal information is transferred or becomes subject to a different privacy policy.

7. Information security¶

We work hard to protect Wellzesta and our users from unauthorized access to or unauthorized alteration, disclosure or destruction of information we hold. In particular:

Encryption in transit. All traffic between your device and Wellzesta is encrypted in transit using TLS.
Encryption at rest. All customer data is encrypted at rest using provider-managed encryption — the database, storage and backups.
Access control. We restrict access to personal information to Wellzesta employees, contractors and agents who need to know that information in order to process it for us, and who are subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.
Review. We review our information collection, storage and processing practices to guard against unauthorized access to systems.

8. HIPAA¶

Wellzesta serves senior living communities, many of which are covered entities under HIPAA. When we process protected health information (PHI) on a community's behalf, Wellzesta acts as a Business Associate, and we enter into a Business Associate Agreement (BAA) with that community. A copy is available on request.

Our obligations under that agreement include:

Permitted use and disclosure. We use and disclose PHI only as the agreement permits — to deliver the services, and as required by law.
Safeguards. We maintain the administrative, physical and technical safeguards required by the HIPAA Security Rule. Our technical controls include unique user authentication, role-based access control, access logging and monitoring, automatic session timeout, encryption in transit and at rest, and tested backup and recovery procedures.
Subcontractors. We enter into a Business Associate Agreement with every subcontractor that handles PHI on our behalf. See our Subprocessors list.
Breach notification. If we discover a breach of unsecured PHI, we notify the affected community without unreasonable delay, in accordance with the Breach Notification Rule.
Individual rights. We support the community in responding to an individual's request for access to, or amendment of, their PHI, and for an accounting of disclosures.
Return or destruction. On termination of the agreement, we return or destroy PHI as the agreement provides.

HIPAA compliance is a shared responsibility between Wellzesta and the community. We are responsible for the safeguards in the services we operate; the community remains responsible for its own workforce, its account administration, and how it uses the services.

9. Artificial intelligence¶

Wellzesta does not use client information to train AI models. The Wellzesta API uses the Google Enterprise API for Gemini, called Vertex AI ("LLM"), under a Business Associate Agreement. This dependency is disclosed in our Subprocessors list, alongside every other third party that comes in contact with customer data on our behalf. The API uses the LLM as a general purpose data processing tool. The LLM is not customized, through training or other means, for Wellzesta or for a particular client.

Zesty AI is offered as an optional Generative AI add-on for Wellzesta Life. The Zesty AI policy, which forms part of this Privacy Policy, describes What Zesty can and cannot do, how conversation data is handled, and which third party provides the underlying AI model.

10. When this Privacy Policy applies¶

Our Privacy Policy applies to all of the services offered by Wellzesta Inc. and its affiliates, and to our websites, wellzesta.com and policies.wellzesta.com. It excludes services that have separate privacy policies that do not incorporate this Privacy Policy.

Our Privacy Policy does not apply to services offered by other companies or individuals, including other sites linked from our services. Our Privacy Policy does not cover the information practices of other companies and organizations, including their use of cookies and similar technologies.

11. Compliance¶

We regularly review our compliance with our Privacy Policy. When we receive formal written complaints, we will contact the person who made the complaint to follow up.

12. Changes¶

Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of privacy policy changes).