WellRight Privacy Policy

Last Updated: July 25, 2025

This WellRight Privacy Policy (this “Privacy Policy”) applies to the websites, applications, and electronic communications on which it appears (the “Platform”). The policy describes how WellRight, Inc. as well as our affiliates (collectively, “WellRight”, “the Company”, “we”, or “us”) collect, use, disclose, store and otherwise process Personal Information about you. Please read this Privacy Policy carefully, by interacting with us through the Platform you consent to this Policy.

I. APPLICATION OF THIS PRIVACY POLICY TO THE WELLRIGHT PROGRAM AND
WEBSITES

• WellRight Program

Services provided by the Company, include an interactive health risk assessment and health and wellbeing management program that generates reports and recommended plans of action, as well as educational materials, based on information entered into the system, which may be accessed through a web-based portal or an application (the “Program”). This information may be entered by you or by someone using the Program on your behalf (such as a friend, family member, or other person). These reports can be used by you to learn more about your general overall wellbeing and health, and to track and monitor your particular wellbeing activities and goals. The more you engage with the Program, the more you will learn about your particular health situation.

We provide the Program to you on behalf of an employee benefits administrator, pharmacy, retailer or other entity that provided you access to the Program (“Program Sponsor”), in some cases through an embedded or co-branded website. In some, but not all, instances we are the relevant Program Sponsor’s “Business Associate” as defined by the Health Insurance Portability and Accountability Act of 1996, and the implementation regulations thereunder (“HIPAA”), and in such cases, we will comply with HIPAA and the applicable contractual limitations imposed on our use and disclosure of your Personal Information by the Program Sponsor. Even in instances where HIPAA does not apply, in most instances we are contractually bound to process Personal Information under the relevant Program Sponsor’s instructions, and we strongly advise you to review privacy notices provided by any Program Sponsor. While all Personal Information we collect or receive is subject to this Privacy Policy, in instances where contractual limitations we
have agreed to with a Program Sponsor do not permit a use or disclosure of Personal Information that is described in this Privacy Policy, we comply with such contractual limitations.

• WellRight Websites

In addition to information collected through the Program, we also collect information about individuals who visit WellRight-operated websites that link to this Privacy Policy (collectively, the “Site”).

II. WHAT TYPES OF PERSONAL INFORMATION DO WE COLLECT?
We collect several categories of Personal Information from and about users of the Platform. “Personal Information” means information that would allow someone to identify, relates to, describes, or is reasonably capable of being associated with or linked to an individual. Personal Information does not include aggregated information that, by itself, does not permit the identification of individual persons, such as statistics about how many visitors the Site last month.
The categories of Personal Information we collect related to an individual depend on whether the Program is used by the individual and/or if the Site is visited. The categories of Personal Information we collect may include:

Contact and Demographic Information - If you submit an inquiry, register for an account, or provide information on or through our Site or the Program, we may collect your contact and demographic information including your name, mailing address, email address, phone number, unique identification number (provided to WellRight by the Program Sponsor allowing you to establish your Program account) (“UID”), and date of birth.

• Commercial Information - If you submit an inquiry, or provide information on our Site, we may collect commercial information including information about your interest in subscribing to the Program.

• Usage Information - When you use our Site or the Program, we may automatically record information, including your Internet Protocol address (IP Address), geolocation of your device, unique device identifier, operating system, network settings, browser type,
referring URLs (e.g., the website you visited before coming to our Site), domain names associated with your internet service provider, and any other information regarding your interaction with our Site or the Program.

• Information you Communicate with Us - We may collect Personal Information contained within your communications with us via email, chat functionality, social media, telephone, or otherwise, and in certain cases we may use third-party service providers to do so.
Where permitted by applicable law, we may collect and maintain records of calls and chats with our agents, representatives, or employees via message, chat, post, or similar functionality.

• Health Information – In your use of the Program, you may provide us with “Health Information,” which includes information related to your health, including biometric screening information (such as height, weight, blood pressure, blood glucose levels, etc.),
health habits, nutrition, and exercise. Health Information does not include sensitive information regarding your health history such as prescriptions, procedures, clinical notes, full problem lists, provider identity, etc.; nor does it include contact and account information
entered when registering for the Program, and is only considered Personal Information when it can be linked or associated with the individual to which it relates.

III. HOW DO WE COLLECT PERSONAL INFORMATION?

A. Directly From You. We collect a range of Personal Information from you in order to provide the Program to you. If you do not provide the Personal Information we request, we may not be able to provide you with full use and benefit of our Program. To use the
Program you will be required to provide certain Personal Information to establish an account to use the Program, including the UID and an email address. In using the Program, we will also collect Health Information from you directly (such as through your completion of an Assessment on the Program). 

B. From Third Parties. We may collect Personal Information from third parties, including but not limited to our business partners, including the Program Sponsors and their service providers, and third parties who you direct to send information about you to our Program (e.g., a wearable device).

C. Information Collected Automatically. We collect Personal Information automatically using cookies and similar technologies when you use the Program and the Site, as described below:

Browsing Information. When you browse or use the Site or the Program, we may collect certain browsing information, including: (a) IP address, (b) the date and time at which you accessed the Site or the Program, (c) the pages that you visited, (d) the link you followed to reach the Program or Site, and (e) your browser and operating system.

Cookies and Device Identifiers. Cookies are small files that are placed on your computer’s hard drive by your Internet browser. A device identifier is a unique identifier assigned to the device that you use to access the Site or the Program. We use cookies or device identifiers on our Site and the Program to identify visitors who have used the Platform before. Program Sponsors and their advertisers may also set cookies in connection with their content and advertisements, but we do not control their use of cookies. Most browsers provide you with the ability to block, delete, or disable cookies, and your device may allow you to disable transmission of device identifiers. If you choose to reject cookies or block device identifiers, some features of the Site and the Program may not be available or some functionality may be limited or unavailable. WellRight does not track users over time and across third party websites to provide targeted advertising. Accordingly, we do not currently respond or take any action with respect to web browser "do not track" signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of Personal Information about an individual consumer's online activities over time and across third-party web sites or online services. For more information about cookies visit: http://www.allaboutcookies.org/. Web beacons, pixels, and other tracking technologies operate independent of cookies.

Android Advertising ID. The Android Application uses a 3rd party (Google Firebase Analytics) which makes use of the Android Advertising ID to collect analytics information. The Android Advertising ID is not used in any other context within the application. Website Analytics. We use Google Analytics, an analytics service to help us analyze the traffic on the Platform. You can opt out of Google Analytics by installing Google’s opt-out browser add-on. These cookies may be ones placed by us (first-party) or by a third party. These cookies may also be Flash Cookies. To learn how to manage privacy and storage settings for Flash cookies click here. We may use cookies that are session-based or persistent. Session cookies expire when you close your browser or turn off your device. Persistent cookies remain on your device after you close your browser or turn off device. 

We may use a variety of cookies:

You can control cookies and tracking tools. Some browsers have a “do not track” feature that prevents a website from tracking you, as well as additional cookie settings. Our Platform does not currently respond to these signals. If you choose to block cookies and other trackers, certain features of the Platform may not work. Blocking or rejecting cookies will not stop all of the tracking described in this Policy. These features and options are browser and device specific and are not
uniform. You can usually find these settings in the options or preferences menu of your browser. To understand these settings, the following links for commonly used browsers may be helpful, or you can use the help option in your browser for more details:
• Cookie settings in Internet Explorer
• Cookie settings in Firefox
• Cookie settings in Chrome
• Cookie settings in Safari web and iOS.

To find out more on how to manage and delete cookies, visit aboutcookies.org. For more details on your choices regarding use of your web browsing activity for interest-based advertising you may visit the following sites:

• org
• aboutads.info
• com
• eu

On a mobile device, you may also be to adjust your settings to limit ad tracking.

IV. HOW DO WE USE PERSONAL INFORMATION?

To the extent permitted by applicable law, we use Personal Information:

• To provide and personalize the Program and our Site, such as maintaining and servicing your account on the Program, verifying your information and eligibility, and creating reports and interactive educational and health tracking features made available through the Program. Reports may include interactive features, and wellness trackers and tools. Based on the information that is entered into the Program, we may provide you with links to personal challenges, courses, or other features of the Program that are likely of interest to you.

WellRight provides social and community features. These sections are voluntary to join. No Health Information is directly provided to the community by WellRight. Some of the community sections, such as a “Diabetic Forum” may allow other participants to draw
inferences about a particular user’s health, even though no specific details regarding the user’s health is provided by WellRight to the community. As a user, you must decide what information you wish to provide to the community forums.

• To communicate with you. We may use Personal Information to contact you if you request or have consented for us to do so, if there is a problem or an update to your account that requires you to be notified, or, if you are a registered user of the Program, to send you information relating to the Program or similar services that we provide. You may withdraw your consent or opt out to receiving certain communications (e.g., marketing communications) by following the instructions provided in the messages that you receive.

• To optimize, improve and maintain the Program and the Site, including understanding how users interact with the Program and the Site, gauging user interest in certain Program or Site functionality, and troubleshooting problems. We may also anonymize some Personal Information so that it is no longer associated with you. In this case, we are entitled to retain and use information freely.

• For legal, security, or safety reasons, such as protecting our and our users' safety, property, or rights; complying with legal requirements; enforcing our terms, conditions, and policies; detecting, preventing, and responding to security incidents; and protecting against malicious, deceptive, fraudulent, or illegal activity.

• As part of a corporate transaction, such as in connection with the sale of part or all of our assets or business, the acquisition of part or all of another business or another business' assets, or another corporate transaction, including bankruptcy. • To fulfill any other purpose for which you provide it, including purposes described when you provide the information or give your consent.

V. UNDER WHAT CONDITIONS DO WE DISCLOSE YOUR INFORMATION?

We do not disclose—including selling, leasing, renting, loaning, or transferring—Personal Information to third parties except as stated in this Privacy Policy, as may be permitted by our agreements with the Program Sponsor, when relevant, and/or with your explicit consent. Our disclosure of Personal Information is limited to the types of recipients and the purposes described in this section:

Contractors. We use contractors to help support certain aspects of our business operations, and in some instances, in order to provide services for us, such service providers require access to Personal Information. We takes steps to contractually require that these contractors maintain and protect the confidentiality and security of Personal Information and use Personal Information only as necessary to perform the Program they are asked to perform. Such service providers may include technology companies and online service providers. We never use, disclose, or share your Personal Information collected through the Program for third-party marketing purposes, and we never sell, rent or lease your Personal Information to third parties. At the request of your Program Sponsor, we may use and aggregate your Personal Information to deliver you targeted messages related to the Program. Combining data sets for a Program Sponsor in this way may be deemed to constitute a sale of Personal Information under certain laws.

Program Sponsors. We may share Personal Information with the relevant Program Sponsors. Such Personal Information will only be shared on an identifiable basis if permitted by applicable law, and generally, Personal Information is aggregated prior to sharing with the Program Sponsor.

Other Disclosures. We may share Personal Information with third parties under the following circumstances: (i) in connection with a court order, subpoena, government investigation, or when otherwise required by law; (ii) in the event of a corporate sale, merger, acquisition, or similar event; (iii) to work with third-party companies to support any technical operation or execute a specific promotion or program (such as providing responses to conduct surveys, or maintain a database of visitor information, etc.); (iv) to enforce or investigate a potential violate of any agreement you have with us; (v) to detect, prevent, or otherwise respond to fraud, security or technical concerns, (vi) to support our audit and compliance functions and to protect the rights
and safety of our Company and its employees, customers, and the public against harm, and (vii) when explicitly requested by or consented to by you for the purposes indicated in such request or consent.

VI. YOUR RIGHTS RELATING TO PERSONAL INFORMATION?

Depending on where you live, you may have the following rights with respect to your Personal Information under applicable data protection laws:

• Access. You may have the right to request access to and obtain a copy of any Personal Information we may have about you.
• Deletion. You may have the right to delete your Personal Information that we have collected or obtained, subject to certain exceptions.
• Correction. You may have the right to request corrections to inaccuracies in your Personal Information, subject to certain exceptions.
• Opt out of certain processing. You may have the right to opt out of the processing of your Personal Information for purposes of (i) targeted advertising, (ii), the sale or sharing of your Personal Information; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effect concerning you. We do not offer the option to limit its use. We also do not profile you or other individuals in a manner that would result in legal or similarly significant effects, so we do not offer an opt out related to processing Personal
Information for this purpose.
• Data portability. You may have the right to receive a copy of your information in a portable and readily usable format.
• Objection/Restriction of Processing. You may have the right to object or restrict us from processing your Personal Information in certain circumstances.
• Withdraw Consent. You may have the right to withdraw your consent where we are relying on your consent to process your Personal Information. Related to participation in the Program, if you withdraw your consent, you may be ineligible for rewards offered
through the Program by the relevant Program Sponsor that are based on health-related objectives and metrics.
• Automated Decision-Making. You have the right to know when you are subject to automated decision-making, the Personal Information used to render the decision, the principal factors and parameters involved in the decision, and human review or correction
of the decision (or its underlying data, where appropriate). You may also have the right to consent or opt out of this automated decision-making, depending on your location.
• Lodge a Complaint - The right to lodge a complaint with a supervisory authority or other regulatory agency if you believe we have violated any of the rights afforded to you under applicable data protection laws. We encourage you to first reach out to us so we have an opportunity to address your concerns directly before you do so.

If you otherwise believe that we have collected Personal Information about you, and would like to exercise your rights listed above, please email us at privacy@wellright.com or submit a ticket through our customer portal.

Depending on the type of information (i.e., Personal Information or Health Information) and our relationship with the relevant Program Sponsor, we will either (i) make the change; (ii) direct you to contact the applicable Program Sponsor; or (iii) promptly forward your request to the applicable Program Sponsor.

You have a right not to receive discriminatory treatment by any business when you exercise your privacy rights. This means we will not deny goods or services to you, provide different prices or rates for goods or services to you, or provide a different level or quality of goods or services to you. You will not be discriminated against in any way by virtue of your exercise of the rights listed in this Policy. However, should you withdraw your consent or object to processing of your Personal Information, or if you choose not to provide certain Personal Information, we may be unable to provide some, or all, of the Program services to you.

Verification. Only you, or an authorized agent that you authorize to act on your behalf, may make a request related to your Personal Information. We must verify your identity before fulfilling your requests. If we cannot initially verify your identity, we may request additional information to complete the verification process. We will only use Personal Information provided in a request to verify the requestor’s identity. If you are an authorized agent making a request on behalf of a California consumer, we will also need to verify your identity, which may require proof of your written authorization or evidence of a power of attorney.

We endeavor to respond to requests within the time period required by applicable law. If we require more time, we will inform you of the reason and extension period in writing.

We do not charge a fee to process or respond to your requests unless they are excessive or repetitive. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
We may deny certain requests, or only fulfill some in part, as permitted or required by law. If you are not satisfied with the resolution of your request, and pursuant to applicable state law, you are afforded a right to appeal such decision, you may seek to appeal the decision by contacting us through any of the methods set forth at the beginning of this Section XI. In submitting the request, please indicate that the submission is a “Notice of Appeal,” and fully describe your concerns and disagreement.
You don’t need to create an account with us as part of a Program in order to make a request to exercise your rights hereunder.

VII. CHILDREN'S PRIVACY

The Program is not intended for use by children. Accordingly, we do not intend to collect Personal Information from anyone we know to be under 18 years of age. The Platform is not designed for use by persons under the age of 16, and we do not knowingly collect Personal Information about children under the age of 16. If you are a parent or legal guardian and think your child has given us information you can email us at privacy@wellright.com. You can also write to us at the address listed in the “Contact Us” section of this Policy. Please mark your inquiries “COPPA Inquiry.”

VIII. HOW DOES THIS PRIVACY POLICY RELATE TO THIRD-PARTY WEB SITES?

We cannot control, nor are we responsible for, the privacy practices or content of third-party websites and applications linked to or from the Platform, including information or content contained within them. Our Privacy Policy applies solely to Personal Information collected through the Platform.

IX. HOW DOES THE COMPANY PROTECT PERSONAL INFORMATION AND HEALTH INFORMATION?

Security Measures. We have implemented commercially reasonable and industry standard measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. Except as provided elsewhere in this Privacy Policy, we limit access to Personal Information to those persons in our organization who have a business need (including servicing your account, informing you of news and offers, or aggregating information) for such access. No company, including us, can fully eliminate security risks associated with Personal Information. As such, we cannot guarantee that our standard measures will prevent a third party from circumventing our security measures and unlawfully intercepting or accessing transmissions or private communications.

X. FOR CALIFORNIA RESIDENTS

California Civil Code Section 1798.83 permits users that are residents of California to request certain information regarding a company’s disclosure of personal information (as defined by California law) to third parties for such third parties’ direct marketing purposes. If you are a California resident and would like to make such a request, please contact us as set forth above in Section VI.

In addition, the state of California provides California residents with certain other rights concerning their Personal Information. This section describes (1) the categories of Personal Information, collected and disclosed by us, subject to California privacy law, (2) your privacy rights under California privacy law, and (3) how to exercise your rights.

Sources of Personal Information. We collect Personal Information from the categories of sources detailed in Section III above: (i) directly from you; (ii) from third parties; and (ii) data collected automatically through tracking technologies.

Use of Personal Information. We collect Personal Information for the business and commercial purposes detailed in Section IV above.

Disclosure of Personal Information. The categories of third parties to which we disclose personal information for a business or commercial purpose or to whom we sell or share personal information are summarized in the chart below. We do not knowingly collect, sell, or share the personal information of minors under the age of 16. *While we do not disclose your Personal Information to third parties in exchange for monetary compensation, in certain instances we do share your Personal Information with third parties for cross-contextual behavioral advertising (i.e., targeted advertising based on your Personal Information and activity on our Site and across websites, which could be deemed a “sale” of Personal Information under applicable laws. Personal Information collected through the Program is not utilized for this purpose.

We do not collect the following types of Personal Information (as specified pursuant to California law): Biometric identifier information (e.g., DNA, fingerprints, retinal scans voice recordings, etc.); audio, electronic, visual, thermal, olfactory, or similar information; and education information, defined as information that is not publicly available personally identifiable information as defined in the Family Education Rights and Privacy Act.

We will retain each category of your Personal Information for as long as necessary to fulfill the
purposes described in Section IV, unless otherwise required by applicable laws. Criteria we use to determine how long we retain your Personal Information includes whether: we need your Personal Information to provide you with products or services you have requested; we continue to have a relationship with you; you have requested information, products, or services from us; we have a legal right or obligation to continue to retain your information; we have an obligation to a third party that involves your information; our retention or recordkeeping policies and obligations dictate that we retain your information; we have an interest in providing you with information about our products or services; and we have another business purpose for retaining your information.

Your Privacy Rights Under California Law. If you are a resident of the State of California, you have the following rights:

Depending on the type of information (i.e., Personal Information or Health Information) and our relationship with your Program Sponsor, we will either (i) make the change in accordance with Section XI; (ii) direct you to contact the applicable Program Sponsor; or (iii) promptly forward your request to the applicable Program Sponsor. Only you, or an authorized agent that you authorize to act on your behalf, may make a request related to your Personal Information. You may also make a request on behalf of your minor child.

XI. International Use and Cross Border Transfers

If you are visiting the Platform from outside of the United States, please note that the Platform is hosted in the United States. Where permitted by applicable law, we may transfer the Personal Information we collect about you to the United States for the purposes set out in this Notice. For individuals in the European Union, European Economic Area, Switzerland, and United Kingdom: we will only transfer Personal Information to third parties located outside of this region when it has ensured appropriate safeguards for such Personal Information through use of the standard contractual clauses or other lawful and approved methods. To request a copy of applicable cross-border data transfer agreements, please reach out using the information in the Contact Us section.

XII. Retention of Personal Information

We will retain Personal Information about you for the period necessary to fulfill the purposes for which Personal Information about you has been collected as outlined in this Privacy Policy. Typically, we delete all Personal Information relating to an agreement with a Program Sponsor upon the expiration of that agreement, unless a longer retention period is required by law. We retain backup copies of Personal Information for 90 days thereafter.

XIII. GENERAL

Amendments to this Privacy Policy. WellRight may modify or update this Privacy Policy from time to time, so please review it periodically. Where required by applicable law, we will provide you with notice of material changes to the Privacy Policy and, if further required by law, provide you with an opportunity to consent to such changes. Unless otherwise indicated, any changes to this Privacy Policy will apply immediately upon posting to the Platform.

Contact WellRight’s Privacy Officer. Our intention is to be diligent in protecting your privacy by strictly following our Privacy Policy. If you would like to make suggestions or find out more about our privacy practices, please contact our Privacy Officer at privacy@wellright.com or call (312) 724-6925. Our mailing address is WellRight, Inc., PO Box 773178 Chicago, IL 60677-3178. Miscellaneous. The term “including” in this Privacy Policy means “including without limitation.”