Privacy Policy

Last updated: August 12, 2026

This Privacy Policy describes how Wellness Rated, LLC (“WellnessRated,” “we,” “our,” or “us”) collects, uses, discloses, and protects information when you access or use the WellnessRated website and platform (collectively, the “Platform”).

The Platform is operated from the United States. This Privacy Policy applies to information collected through the Platform and related services. It should be read together with our Terms of Service, which govern your use of the Platform. Capitalized terms not defined here have the meanings assigned in the Terms of Service.

WellnessRated is a software platform for publishing and managing user-generated reviews and related information. WellnessRated does not provide coaching, training, nutrition, medical, or other wellness services. This Privacy Policy does not apply to third-party websites or services linked from the Platform.

HIPAA Notice: WellnessRated is not a HIPAA-covered entity and does not operate a HIPAA-compliant system. Users should not submit protected health information through the Platform. For a full HIPAA disclaimer, see Section 10 of the Terms of Service.

1. Information We Collect

We collect information directly from you, automatically when you use the Platform, and in some cases from publicly available sources.

A. Information You Provide

When you create an account or use the Platform, you may provide:

1. name, email address, username, and account credentials;
2. profile information and location, if provided;
3. profile descriptions, bios, goals, interests, or other information you choose to include in your user profile;
4. uploaded photos, videos, or media;
5. reviews, ratings, comments, and tags;
6. communications with customer support;
7. responses to moderation notices or appeals; and
8. subscription selections and account preferences.

If you claim or manage a coach profile, you may also provide business name, professional affiliations, credentials, website links, social media profiles, promotional materials, and verification documentation or videos.

Users may voluntarily include additional information in profile descriptions, bios, reviews, comments, or other content they submit to the Platform. Because this content is user-generated, it may contain personal information or other details that users choose to disclose, including Consumer Health Data. Users are responsible for the information they choose to include in publicly visible content and should avoid submitting sensitive personal information such as financial information, medical information, government identification numbers, or private contact details.

Third-Party Information Submitted by Users: Users may submit content that contains information about other individuals, such as testimonials, transformation photos, or references. Users are responsible for ensuring they have the necessary rights and permissions to submit such information. WellnessRated does not independently verify that users have obtained consent from individuals referenced in user-submitted content.

B. Information Collected Automatically

When you access the Platform, we automatically collect:

1. IP address and device identifiers;
2. browser type and operating system;
3. session data and log files;
4. approximate geographic location derived from IP address;
5. pages visited, searches performed, and interactions with Platform features; and
6. timestamps and usage data.

C. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication, performance monitoring, analytics, security, fraud detection, and remembering user preferences.

Essential cookies are necessary for Platform functionality (authentication, security, session management) and do not require consent. Non-essential cookies (analytics, performance monitoring) may be used where permitted by applicable law. Where required by law, we obtain consent before placing non-essential cookies on your device. You may manage cookie preferences through your browser settings or cookie consent tools provided on the Platform. Disabling cookies may affect Platform functionality.

Product analytics on the Platform are provided by PostHog Inc. (United States) and are strictly opt-in. PostHog places cookies or similar client-side storage on your device only after you affirmatively accept analytics through the cookie consent tools provided on the Platform. If you do not accept, no analytics cookies or client-side analytics identifiers are stored on your device, and page views are counted using a short-lived identifier that rotates daily, is not linked to your account, and is not used to build a profile of your activity over time. Where analytics are associated with an account, they are keyed to a one-way cryptographic hash of an internal account identifier, not to your email address, name, or other profile information. We do not use session recording, heatmaps, or automatic interaction capture for analytics purposes. Our error-monitoring service may capture a brief recording of a page when a technical error occurs, solely for the purpose of diagnosing and fixing the error; information you type into forms is masked in these recordings. Separately from product analytics, we record subscription and billing events (such as purchase, renewal, and cancellation) regardless of your analytics choice. These records are generated by our payment processor when you transact, are necessary to operate your subscription, and contain only your subscription plan, amount, and currency, not your browsing or usage activity. You may change your analytics choice at any time through the cookie consent tools provided on the Platform.

D. Information from Public Sources

We may collect, compile, and organize publicly available information about wellness professionals, programs, or services to create or supplement Platform profiles. Public sources may include business directories, licensing databases, public websites, social media profiles, and other publicly accessible materials.

The existence of a profile on the Platform does not require that the individual or business has created an account, claimed the profile, or agreed to participate. The inclusion of publicly available information does not constitute endorsement, verification, or affiliation.

E. Payment Information

Subscription transactions are processed by a third-party payment processor acting as Merchant of Record. We do not collect or store complete payment card numbers or security codes. We may receive limited transaction information such as subscription tier, transaction date, billing status, and payment confirmation metadata.

F. Moderation and Integrity Data

To maintain Platform integrity, we collect and maintain information related to reported content, moderation actions, abuse reports, appeal submissions, and enforcement records. These records may be retained for fraud prevention, abuse detection, dispute resolution, and enforcement of Platform policies.

G. Verification Information

Where identity verification is requested, we may collect verification videos, verification documentation, verification timestamps, and related metadata. Verification videos may contain images that could be considered biometric information under some state laws. We do not use facial recognition technology or extract biometric identifiers from verification videos. Verification is conducted through manual review processes.

2. How We Use Information

We use information collected through the Platform for the following purposes:

A. Platform Operations

We use information to create, maintain, and secure user accounts; display coach profiles, reviews, ratings, and related content; operate Platform functionality and features; enable search, filtering, and comparison tools; manage subscriptions and account preferences; and provide customer support.

B. Platform Integrity and Safety

We use information to detect fake accounts, spam, fraud, and review manipulation; prevent abuse and enforce the Terms of Service and Community Guidelines; maintain moderation and abuse detection systems; investigate policy violations; and protect Platform safety, security, and integrity.

We use automated systems to detect suspicious activity, including patterns suggesting coordinated campaigns, multiple accounts from the same device or network, suspicious timing or content patterns, and device fingerprinting. If suspicious activity is detected, we may flag content for review, delay publication, request verification, suspend accounts, or remove violating content.

C. Subscription and Billing

We use information to process subscription transactions through our payment processor; manage renewals, cancellations, and billing status; prevent fraud and chargebacks; and maintain financial and accounting records.

D. Analytics, Improvement, and AI Development

We use information to analyze Platform usage and engagement; improve features, functionality, and performance; conduct research, testing, and development; identify trends and usage patterns; and maintain security and system performance.

We may use Aggregated Data and De-Identified Data to develop, train, test, and improve machine learning models and AI-based systems used in connection with the Platform, including systems for content moderation, fraud detection, ranking, and related functions. This use is limited to data that has been de-identified or aggregated in accordance with applicable law such that it cannot reasonably be used to identify specific individuals. Individually identifiable personal information, including identifiable Review content, is not used for AI model training without separate consent.

Coaches who subscribe to paid features may receive access to aggregated analytics about their profile performance, such as view counts, search impressions, engagement metrics, and geographic distribution by region. Analytics are provided in aggregated form and do not identify individual users.

E. Communications

We send transactional emails necessary for Platform operation, including account verification, password reset, subscription confirmations, billing notifications, moderation notices, security alerts, and customer support responses. You cannot opt out of transactional emails.

We may send marketing emails, including feature announcements, updates, promotional offers, and surveys. You may opt out by clicking the unsubscribe link in marketing emails, updating email preferences in account settings, or emailing privacy@wellnessrated.com. We process opt-out requests within ten (10) business days.

F. Legal Compliance

We use information to comply with applicable laws and regulations; respond to lawful requests from courts, regulators, or law enforcement; enforce the Terms of Service and Platform policies; protect our legal rights; and establish, exercise, or defend legal claims.

G. Legal Bases for Processing

Where required by applicable law, we process information based on:

1. performance of a contract with you;
2. our legitimate interests in operating and improving the Platform, maintaining integrity, preventing fraud, publishing reviews, providing analytics, ensuring security, and developing Platform technology;
3. compliance with legal obligations; and
4. your consent where required by law.

You have the right to object to processing based on legitimate interests.

3. Automated Decision-Making and Ranking

We use automated systems and algorithms to display, rank, and reorder profiles and content; personalize search results; detect fraud; assist with moderation; and improve Platform functionality. Automated processes may consider factors including profile completeness, review recency, engagement metrics, subscription tier, verified status, and integrity signals. Paid features may influence visibility or presentation. Ranking methodologies may change over time.

These automated processes support Platform functionality and are not intended to produce legal or similarly significant effects concerning users. Where required by law, users may request additional information by contacting privacy@wellnessrated.com with “Automated Decision Inquiry” in the subject line.

4. Public Content and Visibility

The Platform allows users to publish reviews, ratings, comments, and profile information intended to be publicly visible. Public content may be visible to other users, indexed by search engines, accessible through public links, and cached or archived by third-party services.

We do not control how third-party search engines or services index, cache, or archive publicly available content. Content may continue to appear in search results or third-party archives even if later removed or modified on the Platform. We may remove or modify content only where required by law or permitted by our Terms of Service.

A. Important Considerations for Reviewers

Reviews are publicly visible and may remain on the Platform indefinitely to preserve review history and Platform integrity. Even if you delete your account, reviews may remain visible with de-identified attribution. Choose a username that does not reveal your full identity if you wish to maintain privacy. Do not include your full name, contact information, medical information, payment details, or information about other individuals in reviews.

Coaches can see your public reviews and username but cannot see your email address or private account information. WellnessRated does not independently verify the accuracy of user-submitted reviews. Reviews containing false statements of fact may expose you to legal liability.

B. User-Generated Content Responsibility

Reviews, ratings, comments, and other content published on the Platform are created and submitted by users. WellnessRated does not independently verify the accuracy, completeness, or reliability of user-submitted content. The inclusion of user-generated content on the Platform does not constitute endorsement or validation by WellnessRated. Users are responsible for the content they submit and any personal information they choose to disclose.

5. How We Share Information

A. Service Providers

We share information with vendors and service providers that support Platform operations, including hosting, analytics, fraud detection, moderation tools, and customer support. Service providers receive access to information only as necessary to perform services and are expected to handle it in accordance with confidentiality and data protection obligations.

Service provider categories include: cloud infrastructure and hosting (including Amazon Web Services); analytics and performance monitoring; security and fraud prevention; customer support; and moderation tools. For EEA and UK users, service providers are data processors acting under data processing agreements that include Standard Contractual Clauses where required.

B. Payment Processor

Subscription transactions are processed by a third-party payment processor acting as Merchant of Record. When you subscribe, we share your email address, name (if provided), subscription tier, and geographic location (for tax calculation) with the Merchant of Record as necessary to process your subscription, calculate taxes, and provide invoices and receipts.

The Merchant of Record processes payments, calculates and remits taxes, issues invoices, and handles billing inquiries. The Merchant of Record operates as an independent data controller for payment transactions and maintains payment card information in accordance with PCI-DSS requirements. We receive limited transaction information from the Merchant of Record including subscription status, transaction date, billing period, subscription tier, and tax information, but not full payment card details. The identity of the current Merchant of Record and the applicable privacy policy and buyer terms governing payment transactions are made available during the checkout process.

C. Legal Compliance and Law Enforcement

We may disclose information where required or permitted by law, including in response to subpoenas, court orders, regulatory requests, or law enforcement investigations, or where necessary to protect rights, safety, or property.

Legal process seeking user information must be properly served on Wellness Rated, LLC at the address listed in Section 20. We review all requests to determine whether they meet applicable legal standards and may object to requests that are overly broad, vague, lack proper authority, or violate user privacy without adequate justification. Where legally permitted and appropriate, we may notify affected users before disclosing information in response to legal process, allowing users an opportunity to challenge the request. We may not provide notice if legally prohibited, if notice would create risk of harm, or if the request relates to emergency circumstances.

In emergency situations involving imminent danger of death or serious physical injury, we may disclose information to law enforcement without legal process.

D. Business Transfers

Information may be disclosed or transferred in connection with mergers, acquisitions, asset sales, corporate restructuring, financing transactions, or bankruptcy proceedings.

E. Platform Safety

We may disclose information where reasonably necessary to investigate abuse, prevent fraud, protect user safety, or enforce the Terms of Service and Community Guidelines.

F. No Sale or Sharing

We do not sell or share personal information as those terms are defined under applicable privacy laws, including the California Consumer Privacy Act.

6. Aggregated and De-Identified Data

We may create, use, and analyze aggregated, anonymized, or de-identified information derived from Platform activity for analytics, benchmarking, research, reporting, platform improvement, fraud monitoring, and security.

Aggregated or de-identified information does not identify individual users and cannot reasonably be used to identify a specific person. To the extent required by law, we maintain such information in de-identified form and do not attempt to re-identify it except as permitted by law.

We retain the right to use, analyze, and license Aggregated Data and De-Identified Data for legitimate business purposes, including machine learning model development, AI training, and related technology purposes, provided that such use is limited to data that does not identify individual users. Users do not have ownership rights in aggregated or de-identified data derived from Platform activity.

7. Data Retention

We retain information only as long as reasonably necessary to operate the Platform, preserve review history and Platform integrity, comply with legal obligations, detect fraud and abuse, and maintain security records. Retention periods vary depending on data type and collection purpose:

1. Account information: retained while account is active plus 90 days after closure, unless longer retention is required for compliance.
2. Reviews and ratings: retained indefinitely to preserve Platform integrity and review history; reviews may be de-identified after account deletion as described below.
3. Moderation records: three (3) years after enforcement action.
4. Support communications: two (2) years after resolution.
5. Audit and security logs: one (1) year, unless longer retention is required for investigation.
6. Payment records: as required by tax and accounting regulations, typically seven (7) years.
7. Verification documentation: deleted within 90 days after verification completion, unless longer retention is required for fraud prevention or legal compliance; if a profile claim is denied, retained for 90 days to support appeal, then deleted.
8. Verification videos: retained while your account is active or for up to three (3) years from collection, whichever is shorter; deleted within 90 days after account deletion, unless retention is required by law or reasonably necessary for fraud prevention, abuse investigation, or dispute resolution.
9. Verification metadata (timestamps, status, method): retained as part of account record.
10. Consumer Health Data consent records and deletion request logs: a minimum of four (4) years, as required by applicable law.

Moderation records may be shared with law enforcement where required by law or necessary to investigate illegal activity, threats, or harm. Some information may persist in backup or archival systems for up to 90 days as part of disaster recovery practices. Backup copies are securely stored and not used for active processing.

Account Deletion

If you delete your account, your login access will be disabled and your account information will be removed from active Platform systems. Your account record is anonymized through a process that: (i) removes or replaces personal identifying information associated with your account record; (ii) severs database linkages connecting your account record to other Platform data; and (iii) re-attributes any Reviews or other content you submitted to an anonymous identifier rather than your account. This anonymization process is designed to prevent re-identification of your account data while preserving the review record for Platform integrity purposes.

Previously published reviews may remain publicly visible following account deletion with de-identified or anonymous attribution. Attribution associated with reviews will be replaced to remove your personal identifiers.

For Consumer Health Data deletion requests, see Section 10D.

8. Your Privacy Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict processing of, object to processing of, or request portability of your information, and to withdraw consent where processing is based on consent.

To exercise rights, contact privacy@wellnessrated.com. We may require reasonable identity verification before fulfilling requests. We respond to verified requests within timeframes required by applicable law. Authorized agents may submit requests on behalf of individuals where permitted by law. We do not discriminate against users for exercising privacy rights.

Some requests may be limited or denied where permitted by law, including where retaining information is necessary to comply with legal obligations, maintain Platform integrity and review history, detect fraud or abuse, enforce policies, or protect rights, safety, or security.

Requests to delete Reviews or other publicly available information about a professional or their services may be subject to limitations where retention is necessary for the exercise of the right of freedom of expression and information, or for the performance of a task carried out in the public interest. WellnessRated evaluates each deletion request individually and will communicate the outcome and the basis for any limitation in writing within 30 days of receiving a verified request.

Washington residents have specific rights regarding Consumer Health Data under the Washington My Health My Data Act, including a right to deletion with a 45-day response window. See Section 10 for details.

9. California Privacy Rights

The following disclosures are provided to California residents pursuant to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

A. Categories of Personal Information Collected

We collect the following categories of personal information:

1. Identifiers: name, email, username, IP address, device identifiers.
2. Internet or network activity: browsing history, search history, Platform interactions.
3. Commercial information: subscription tier, transaction history, billing status.
4. Geolocation data: approximate location derived from IP address (not precise geolocation).
5. Audio, visual, or similar information: profile photos, verification videos if submitted.
6. Professional or employment-related information: credentials, certifications, and business information for coaches.
7. Inferences: Platform-generated insights about preferences or characteristics.
8. Account authentication data: login tokens or authentication-related identifiers.

Verification videos may contain images that could be considered Sensitive Personal Information under California law. We do not use facial recognition technology or extract biometric identifiers from verification videos. Verification is conducted through manual review.

B. Sources of Personal Information

We collect personal information directly from you (account creation, profile submissions, reviews, uploaded content); automatically from your device (cookies, log files, usage data, analytics); from publicly available sources (business directories, licensing databases, social media, public websites); and from third parties (payment processor, service providers).

C. Business and Commercial Purposes

We use personal information for: operating the Platform and providing services; processing subscriptions and billing; fraud prevention and security; analytics and Platform improvement; communications and customer support; legal compliance and protection of rights; maintaining Platform integrity and review accuracy; and developing and improving AI and machine learning systems using de-identified and aggregated data.

D. Categories of Third Parties

We share personal information with: service providers (hosting, analytics, security, customer support); payment processor (Merchant of Record, identified during checkout); law enforcement or regulatory authorities (when required by law); and business transaction parties (in connection with mergers, acquisitions, or asset sales).

E. Sale or Sharing

We do not sell personal information or share personal information for cross-context behavioral advertising as those terms are defined under applicable privacy laws, including the California Consumer Privacy Act.

F. Sensitive Personal Information

We collect account credentials (username and password for authentication only) and verification videos (for identity verification only, reviewed manually without facial recognition technology). We do not use or disclose sensitive personal information for purposes other than those specified in CCPA Section 7027(m). We do not use or disclose sensitive personal information to infer characteristics about you. Because we do not use such information beyond permitted purposes, no additional opt-out mechanism is currently required.

G. Retention

Information is retained as described in Section 7.

H. California Rights

California residents have the following rights:

1. right to know what personal information is collected, used, shared, or sold;
2. right to delete personal information, subject to exceptions;
3. right to correct inaccurate personal information;
4. right to opt out of sale or sharing (not applicable — we do not sell or share);
5. right to limit use of sensitive personal information (not applicable — we only use for permitted purposes); and
6. right to non-discrimination for exercising rights.

To exercise rights, contact privacy@wellnessrated.com. We respond to verified requests within 45 days, extendable to 90 days with notice. Authorized agents may submit requests with proof of authorization. We verify requests using information provided during account creation or through additional verification steps.

I. Shine the Light Law

California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

10. Washington Consumer Health Data

WellnessRated is subject to the Washington My Health My Data Act (RCW 19.373 et seq.) (“MHMD Act”) with respect to Washington consumers. This Section describes our practices regarding Consumer Health Data as defined under the MHMD Act. The Consumer Health Data Privacy Notice, which provides additional required disclosures under the MHMD Act, is published separately and accessible via a link in the website footer.

A. Consumer Health Data We May Collect

WellnessRated is a review platform for wellness coaches and services. We do not intentionally collect Consumer Health Data as a primary function of the Platform. However, Users may voluntarily include Consumer Health Data in Reviews, profile descriptions, comments, or other User-Generated Content submitted to the Platform. For example, a reviewer might describe a health condition in the context of their coaching experience.

Consumer Health Data collected through User-Generated Content is incidental to the Platform's review function and is submitted voluntarily by Users. We do not use or analyze Consumer Health Data submitted in User-Generated Content for purposes beyond operating the Platform, maintaining review integrity, and complying with legal obligations.

B. Consent

To the extent WellnessRated collects Consumer Health Data through User-submitted content, we obtain consent at the point of submission. When you submit a Review or other content that may contain Consumer Health Data, the submission process includes a consent disclosure and affirmative consent mechanism. Completion of that consent step is logged server-side with a timestamp and is associated with your submission record.

Your consent covers the collection, use, and display of Consumer Health Data you voluntarily include in your submitted content for the purposes described in this Privacy Policy. You may withdraw consent by submitting a Consumer Health Data deletion request as described in Section 10D.

C. How We Use Consumer Health Data

We use Consumer Health Data only as necessary to:

1. display the User-Generated Content you submitted on the Platform;
2. maintain Platform integrity and moderation records;
3. comply with legal obligations; and
4. respond to deletion requests as described below.

We do not sell Consumer Health Data, share Consumer Health Data for advertising or marketing purposes, or use Consumer Health Data to make inferences about your health status beyond displaying what you have chosen to submit.

D. Consumer Health Data Deletion Rights

Washington residents have the right to request deletion of their Consumer Health Data. Deletion requests under the MHMD Act are content-specific: you may request deletion of Consumer Health Data contained in specific content you submitted, such as a Review that includes health-related information. A deletion request for Consumer Health Data does not automatically result in deletion of your account or non-health-related data.

To submit a deletion request, contact privacy@wellnessrated.com with the subject line “Washington Consumer Health Data Deletion Request” and describe the specific content from which you are requesting deletion of Consumer Health Data.

We will respond to verified deletion requests within forty-five (45) days of receipt. If additional time is required, we will notify you within the initial 45-day period and may extend our response by an additional forty-five (45) days with notice.

Upon a valid deletion request, we will delete or de-identify the Consumer Health Data from the specified content. Where Consumer Health Data is integral to the content and cannot be severed without rendering the content unintelligible, we may remove the content in its entirety. Where Consumer Health Data is severable, we will redact the relevant health-related information while retaining the non-health-related portions of the content where permitted by law and our policies.

We will also direct service providers who have received the Consumer Health Data to delete it in accordance with applicable law.

E. Compliance Records

We maintain timestamped records of consent obtained at the point of Review submission and logs of Consumer Health Data deletion requests and responses for a minimum of four (4) years, as required by the MHMD Act.

F. Consumer Health Data Privacy Notice

WellnessRated publishes a standalone Consumer Health Data Privacy Notice describing in detail our practices with respect to Consumer Health Data as required by the MHMD Act. The Consumer Health Data Privacy Notice is available at https://www.wellnessrated.com/privacy/consumer-health-data and is accessible via a link in the website footer.

G. Enforcement

The MHMD Act provides Washington consumers with a private right of action for violations. If you believe your Consumer Health Data rights have been violated, contact us at privacy@wellnessrated.com to attempt informal resolution. You also have the right to contact the Washington Attorney General's Office.

11. Additional State Privacy Rights

Residents of certain states have rights under comprehensive state privacy laws. If you are a resident of Virginia, Colorado, Connecticut, Utah, Montana, Oregon, Texas, Delaware, Iowa, or Nebraska, you may have rights to confirm whether we process your information, access your information, correct inaccuracies, delete your information, obtain a copy (data portability), and opt out of sale, targeted advertising, or profiling for decisions that produce legal or similarly significant effects.

Washington residents have additional specific rights regarding Consumer Health Data under the MHMD Act, as described in Section 10. Washington does not currently have a separate comprehensive general privacy statute; Washington residents' general privacy rights arise under applicable federal law and the MHMD Act.

We do not sell personal information or engage in targeted advertising as those terms are defined under applicable state laws. Our automated systems for ranking and fraud detection are not intended to produce legal or similarly significant effects. If you believe you are subject to automated decision-making with such effects, contact privacy@wellnessrated.com with “Automated Decision Appeal” in the subject line.

If we decline your privacy request, you may appeal by contacting privacy@wellnessrated.com with “Privacy Rights Appeal” in the subject line. We respond to appeals within timeframes required by law. If your appeal is denied, you may contact your state attorney general. To exercise rights, contact privacy@wellnessrated.com.

12. Verification Video Notice

Verification videos may contain images of an individual's face. We do not use facial recognition technology, biometric identifiers, or automated facial analysis. Verification videos are reviewed manually for identity confirmation purposes only.

Verification videos are retained while your account is active or for up to three (3) years from collection, whichever is shorter. Verification videos are permanently deleted within 90 days of account closure or within three (3) years of collection, whichever occurs first, unless retention is required by law or reasonably necessary for fraud prevention, abuse investigation, or dispute resolution.

Verification videos are not sold, leased, or disclosed except to service providers bound by confidentiality obligations or as required by law.

Submitting a verification video is optional. Verification is required only if you wish to claim and manage a professional profile. You may withdraw consent by deleting your account or contacting privacy@wellnessrated.com. After withdrawal, verification videos are deleted within 90 days, subject to the retention exceptions described above.

13. International Data Transfers

The Platform is operated in the United States. If you access the Platform from outside the United States, your information will be transferred to, stored, and processed in the United States or other jurisdictions where our service providers operate. Where required by law, we implement safeguards to protect information transferred across borders, including Standard Contractual Clauses or other legally recognized transfer frameworks.

For EEA and UK Users

Data Controller: Wellness Rated, LLC, 5625 German Church Road #2191, Indianapolis, IN 46235, United States.

Data Protection Officer: We have not appointed a Data Protection Officer. Privacy inquiries should be directed to privacy@wellnessrated.com.

International Transfers: Information of EEA and UK residents is transferred to and processed in the United States, which is not subject to an adequacy decision by the European Commission. We rely on Standard Contractual Clauses approved by the European Commission and UK-approved transfer mechanisms.

Legitimate Interests: Where we process information based on legitimate interests, those interests include operating and improving the Platform, maintaining integrity, preventing fraud, publishing reviews, providing analytics, developing Platform technology, and ensuring security. You have the right to object to processing based on legitimate interests.

Right to Erasure — Article 17(3) Limitations: EEA and UK residents have the right to request erasure of personal data under Article 17 of the GDPR and UK GDPR. However, this right is not absolute. WellnessRated may decline erasure requests for Review content or publicly available professional information where retention is necessary for the exercise of the right of freedom of expression and information under Article 17(3)(b), or where retention is necessary for the performance of a task carried out in the public interest under Article 17(3)(d). WellnessRated evaluates each erasure request individually, taking into account whether the professional whose information is at issue has held themselves out publicly and whether the public interest in transparent information about that professional outweighs their individual privacy interest. WellnessRated will communicate the outcome of any erasure request and the basis for any denial within 30 days of receiving a verified request.

Supervisory Authority: You have the right to lodge a complaint with the supervisory authority in your country of residence. For EU supervisory authorities, see https://edpb.europa.eu/about-edpb/board/members_en. For UK users, the supervisory authority is the Information Commissioner's Office at https://ico.org.uk/.

14. Data Security

We implement reasonable technical and organizational safeguards to protect information from unauthorized access, disclosure, alteration, or destruction, including encrypted transmission, access controls, authentication mechanisms, and system monitoring.

No method of transmitting or storing information can guarantee complete security. Users should exercise caution when sharing information online and are responsible for maintaining the confidentiality of account credentials. If you believe your account has been compromised, contact us immediately at privacy@wellnessrated.com or security@wellnessrated.com.

15. Data Breach Notification

In the event of a security incident involving personal information, we will investigate the incident, take steps to contain and mitigate it, assess whether information was accessed or disclosed, and determine whether notification is required under applicable law.

If notification is required, we will notify affected individuals and, where required, regulatory authorities within legally required timeframes. Notifications will be provided by email to the address associated with your account, by notice posted on the Platform if email is not feasible, or by other methods required by law. Breach notifications will include, to the extent known, a description of the incident, types of information involved, steps we have taken, steps you can take, and contact information.

16. Children's Privacy

The Platform is intended for individuals 18 years of age or older. We do not knowingly collect information from individuals under 18. If we become aware that information has been collected from an individual under 18, we will take reasonable steps to delete such information. If you believe a minor has provided information through the Platform, contact privacy@wellnessrated.com.

17. Third-Party Links and Services

The Platform may contain links to third-party websites or services, including coach websites, external programs, social media, and payment processor portals. These operate independently. We do not control and are not responsible for the privacy practices of third parties. Information provided to third parties is governed by their privacy policies. Users are encouraged to review third-party privacy policies before providing information to those services.

18. Do Not Sell or Share My Personal Information

We do not sell or share personal information as those terms are defined under applicable privacy laws, including the California Consumer Privacy Act. We do not sell personal information to third parties for monetary consideration, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising based on your activity across websites.

If our practices change, we will update this notice and provide appropriate opt-out mechanisms. For more information about your privacy rights, see Section 8 (Your Privacy Rights) and Section 9 (California Privacy Rights).

A standalone page providing this notice is available at https://www.wellnessrated.com/privacy/do-not-sell and is accessible via a link in the website footer titled “Do Not Sell or Share My Personal Information.”

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Platform, applicable laws, or data practices. The “Last Updated” date indicates when the most recent revision was made. Where required by law, we will notify users of material changes by posting a notice on the Platform, sending email notification, or other appropriate means. Review this Privacy Policy periodically to stay informed about how we protect your information.

20. Contact Information

If you have questions about this Privacy Policy, contact us at:

Wellness Rated, LLC

5625 German Church Road #2191

Indianapolis, Indiana 46235

United States

Support: support@wellnessrated.com

Privacy: privacy@wellnessrated.com

General inquiries: info@wellnessrated.com

Legal process (subpoenas, court orders): legal@wellnessrated.com