China Privacy Policy

Wellthy.com Privacy Policy

1. Introduction

This privacy policy (the "Privacy Policy") describes how Wellthy, Inc. (together with our affiliates, "Wellthy," "we," "our," or "us") collects, uses and shares an individual’s (“you,” “your,” or “they”) personally identifiable information ("Personal Information") obtained by our business (including through our website at www.wellthy.com (the "Site"), from you, our clients and users, and from third parties).
‍

This Privacy Policy applies to all individuals who physically reside within the mainland of the People’s Republic of China (excluding Hong Kong SAR, Macau SAR, and Taiwan) (the “PRC”) whose Personal Information is processed by Wellthy and adheres to the data protection laws and regulations of the PRC. Our relationship with you and the source of any Personal Information we receive from or about you will determine how this Privacy Policy applies to you and your Personal Information.

‍

Please take time to review this Privacy Policy prior to providing Wellthy your Personal Information. If you submit Personal Information of others or other confidential information of a third party to Wellthy, you represent and warrant that you have the necessary consent or authority to do so.

This Privacy Policy applies to all of our services, including the services made available through Wellthy.com and other Wellthy sites and applications (including, as applicable, the Site and our web applications, application extensions, social media pages, marketing activities, live events and other activities described in this Privacy Policy) (collectively, the “Services”)).

2. Personal Information We Collect

Wellthy collects Personal Information to provide the Services as part of its contractual obligations to individuals who create an account on the Site (“Members”), to companies that cover the costs of Members’ access to the Services, to companies that cover the costs of Members’ access to the Services, and a number of other purposes, as set forth below. We also automatically collect and process Personal Information when individuals use the Site, including before they sign up to create an account.
‍

Wellthy receives Personal Information from employers, health plans, and other third parties (including individuals) helping to facilitate and coordinate care services on our Members’ behalf.

The following chart sets forth the categories of Personal Information we collect, how we collect such Personal Information, and how we use such Personal Information.

‍

Our use of Personal Information also includes any other purpose that you may intend or direct us to perform through your use of our Services.
‍

3. How We Share Personal Information

Wellthy shares and discloses Personal Information to third parties as needed to provide our Services and operate our business. Wellthy shares Personal Information with third parties as follows:

‍

4. Communications and Marketing

Wellthy may periodically send you newsletters that include information about our Services, partners, and enhancements. If you no longer wish to receive e-mail marketing communications, you may unsubscribe/opt out by following the steps in the email or by contacting support@wellthy.com.

‍

5. Data Retention and Disposal

Wellthy retains and disposes of Personal Information in accordance with the PIPL mandated minimum time to achieve the Processing purpose. Generally, this means:

●   Personal data collected and not used to provide Member Services such as site visitor information and sales prospect information, is reviewed for deletion periodically to assess the necessity and proportionality of the processing.

●   Certain personal data associated with the provision of our Services is retained for the provision of such Services and to comply any continuing legal or contractual obligations.

‍

Once the retention period has expired, we will delete your data and/or anonymize your Personal Information such that it can no longer identify you. In accordance with applicable PRC laws and regulations, if we take technical measures and other necessary measures to anonymize your Personal Information so that the recipient cannot re-identify specific individuals and cannot restore the information; the processing, sharing, transfer, and/or public disclosure of the anonymized personal information does not require separate notification and consent from you. With respect to all personal data, where the purpose of the processing is satisfied or where consent to processing has been withdrawn, such data will be deleted unless we need to retain it for legal or compliance purposes.

‍

6. Your Privacy Rights

Depending on how you interact with Wellthy, you may have certain legal rights over the Personal Information we hold about you, subject to the privacy and data protection laws of the PRC. The following is more information regarding your rights:

‍

Controller Relationship. Except to the extent that Wellthy may be a “processor” of Personal Information received from a third party pursuant to a contractual relationship with that third party, Wellthy is a “offshore controller” with respect to your Personal Information under the Personal Information Protection Law of the People’s Republic of China (the “PIPL”) and you may contact us directly to exercise your data protection rights or file a privacy complaint.

‍

Lawful Basis for Processing Personal Information. Our lawful basis for collecting and processing Personal Information will depend on the circumstances upon which the Personal Information was collected.

‍

●   In most circumstances, Wellthy may process your Personal Information as necessary to perform a contract with you, including to provide our Services pursuant to our Terms of Service.

●   You have provided consent (in which case, such consent can be withdrawn at any time in accordance with your rights to your Personal Information below).

●   Processing is necessary to comply with applicable legal and regulatory obligations.

●   Processing is necessary to protect the vital interests of an individual.

●   Processing is in the public interest.

●   Processing is necessary to establish, exercise or defend our legal rights or for the purpose of legal proceedings.

●   Processing is necessary for other situations stipulated by laws and administrative regulations.

‍

Automated Decision-making. Wellthy’s processing of Personal Information may include automated decision-making, specifically with respect to the assignment of a Care Coordinator to a Care Recipient. This processing is intended to best align a Care Coordinator to your specific needs. Re-assignment of Care Coordinators is available.

‍

International and Onward Transfers of Personal Information. Wellthy is a US-based company with data centers located in the United States. Your Personal Information will be transferred across international borders and processed in the US. The US may have different or less protective data protection laws than your own country. Before any cross-border transfer, and thereafter upon material changes or at least annually where required, we will conduct and retain a Personal Information Protection Impact Assessment covering the necessity, scope, risks, and security measures for the transfer. If applicable data protection laws and regulations require us to obtain your separate consent for cross-border transfers of personal information, we will obtain your separate consent before transferring your Personal Information across borders. We will use legal cross-border transfer mechanisms to transfer your personal information abroad and take necessary measures to ensure that the overseas recipients can provide the same level of protection as required by applicable data protection laws.

‍

You can contact us through the contact information provided in this Privacy Policy to obtain more information about cross-border transfers of personal information or to obtain more information about other overseas recipients of your Personal Information. Where necessary, supplementary measures are adopted by the data importer and exporter to ensure personal data is afforded an essentially equivalent level of protection in such other country.

‍

Privacy Rights of Data Subjects. The data protection laws of the PRC provide certain rights to individuals based in the PRC. Subject to certain limitations, your data protection rights include the following:

‍

●   Right to Knowledge – You have the right to know about and decide on the processing of your Personal Information.

●   Right to Access and Copy – You have access to and may request a copy of your Personal Information that we collect.

●   Right to Withdraw Consent – If processing is based on your consent, you have the right to withdraw consent to the processing at any time.

●   Right to Object to Processing – If processing is based on legitimate interest, you have the right to object to the processing at any time.

●   Right to Stop Processing – You have the right to object to the processing of your Personal Information and to ask us to restrict the processing of your Personal Information, subject to certain limitations.

●   Right to Object to Automated Processing – You have the right not to be subject to a decision based solely on automated processing, including profiling.

●   Right to Correction – You have the right to correct, supplement and update your Personal Information without undue delay.

●   Right to Deletion – You have the right to request deletion of your Personal Information without undue delay.

●   Right to Portability – You have the right to move, copy, or transfer personal data from our Service to another service. If requested, we will provide you with a machine-readable file to transfer.

●   Right to Request Information – You have the right to request explanations of the rules governing the processing of your personal information.

●   Right to Submit a Complaint – You have the right to submit a complaint to your data protection authority about our collection and use of your Personal Information.

‍

Exercising Your Rights Under Law. You may exercise any of your rights through your account or our self-service portal or by submitting a request to our Data Protection Officer at support@wellthy.com.

‍

We respond to and process requests promptly and within the timeframes required by PRC law. Please note that requests that could adversely impact the rights and interests of a data subject are subject to appropriate verification before processing.

‍

7. Exercising Control Over Your Privacy

We provide several ways for you to exercise control over your privacy. For Members, you may access and correct much of the Personal Information we have collected about you simply by logging into your account. For other individuals, you may make a privacy request by contacting us at support@wellthy.com. In our discretion and without obligation, we may fulfill privacy requests as a courtesy to other individuals subject to appropriate prior verification.

‍

You may have certain choices and rights associated with your Personal Information, including opting out of targeted advertising or other disclosures to third parties or right to have an authorized agent submit requests on your behalf. You or your authorized agent may request that Wellthy honor these rights by contacting us as outlined in the “Contact Us” section below.

‍

Non-Discrimination. You will not receive any discriminatory treatment by us for the exercise of your privacy rights.

‍

Verifying Your Request. Only you, or a person that you authorize to act on your behalf, may make a request related to your Personal Information. In the case of access and deletion, your request must be verifiable before we can fulfill such request. Verifying your request will require you to provide sufficient information for us to reasonably verify that you are the person about whom we collected Personal Information or a person authorized to act on your behalf. We will only use the Personal Information that you have provided in a verifiable request in order to verify your request. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority. Please note that we may charge a reasonable fee or refuse to act on a request if such request is excessive, repetitive or manifestly unfounded.

‍

Information Processed by our IT Service Providers. Our IT service providers have no direct relationship with the individuals whose Personal Information they process on behalf of Wellthy. If you seek to access, correct, amend, or delete inaccurate data held by any of our IT service providers, you should contact us as outlined in the “Contact Us” section below. In that event, we will instruct our IT service providers to perform the relevant processing.

‍

8. Cookie Policy

Wellthy uses cookies to improve your experience on our Site. We may automatically collect certain Personal Information when you visit our Site, including through cookies, web beacons and other technologies. Such cookies include strictly necessary cookies, performance cookies, functional cookies, and targeting cookies. For example, we may use analytics cookies to generate and analyze statistics about your use of the Site and functional cookies to improve and customize your experience with the Site. We may also use marketing cookies to collect aggregate information about site visitors. To adjust your cookie settings, you may do so when you initially access our Site.

9. Children’s Data

Children as Members. Wellthy recognizes that children’s Personal Information is more sensitive than that of adults and that children’s Personal Information often requires greater protection. In accordance with relevant laws, this Site and Wellthy’s solution are not directed to individuals under the age of 14, and we request that such individuals under the age of 14 not provide Person Information through this Site and Wellthy’s solution. Wellthy takes steps to prevent children under the age of 14 from signing up for its Services in the PRC. If you learn that a child under the age of 14 has created an account with Wellthy, please contact support@wellthy.com.

‍

Children as Care Recipients or Journey Members. A parent or legal guardian of a child residing in the PRC may share the child’s Personal Information with Wellthy to provide their child with care coordination Services. We ask that Personal Information of children under the age of 14 not be provided to Wellthy without the prior consent of the child’s parent or legal guardian. By providing the Personal Information of a child, you are affirming that you are legally authorized to provide such Personal Information under the laws of the PRC.

‍

10. Information Security

Through our information security program, Wellthy has implemented technical and organizational measures to ensure the protection of Personal Information. Our efforts include:

●   Risk assessments

●   Access controls

●   Encryption of personal data in transit and at rest

●   Vulnerability and penetration testing

●   Monitoring

●   Incident response

●   Backup and recovery

●   Vendor management

●   Security awareness and training

‍

When interacting with Wellthy, we recommend that you create a unique and difficult password, that you not share your account credentials with others or allow your credentials to be easily accessed by others, that you connect to our Site over secure networks, that you log out after using our Service, and that you stay alert to unusual or suspicious activities.

‍

11. Breach Notification

Wellthy maintains robust security measures and an incident response plan that contemplates our response to a data breach. In the unfortunate event of a data breach, Wellthy will promptly comply with all relevant PRC laws relating to breach notification and response.

‍

12. Contact Us

For inquiries about this Privacy Policy or to make a request or file a privacy complaint, please contact support@wellthy.com.

‍

This Privacy Policy may be updated from time to time, so please check back regularly for updates.

‍