Privacy policy

WellOrbs is a personal health journal provided by TallyTic LLC (“we”, “us”). You use it to record symptoms, habits, medications, appointments and photos, and to share them with people you choose. This policy covers the WellOrbs website and any WellOrbs phone apps we make available. It explains what we collect, why, who can see it, how long we keep it and the choices you have. Our separate Consumer Health Data Privacy Policy explains the collection and sharing of consumer health data and your rights under applicable state laws.

WellOrbs is offered directly to consumers, rather than on behalf of a healthcare provider or health plan. HIPAA generally does not protect the information you enter in a consumer app of this kind. Other privacy and consumer health data laws may apply, depending on where you live and how you use the service.

The short version

• Your health information is yours. We use it only to run WellOrbs for you and the people you share with.
• We never sell your data and never show ads. There are no analytics or advertising trackers in your journal or the phone app; our signed-out homepage uses Google Analytics with analytics storage disabled.
• You control which other users can access your journal. We and our providers also process data to run and secure the service, as described below.
• The contents of your private vault are encrypted on your device. We can’t see them.
• You can download journal records, request a complete copy, or request account deletion at any time.

What we collect

• Account information: your email address, a name you choose, your password (stored only as a secure hash), one-time sign-in codes, and settings such as units, time zone, language and notification preferences. We also record the version and time of your agreement to the terms and acknowledgement of the privacy policies.
• About you and the people you track: for yourself and anyone you keep a journal for (such as a child or parent) — name, relationship, date of birth, sex, time zone and, if you add one, a pregnancy due date. Date of birth and sex are optional; we use them to show age on reports and to tailor patterns.
• Consumer health data you enter: symptoms, where they are on the body and how severe they are; notes and tags; tracked items such as water, caffeine, alcohol, mood, sleep, urination and bowel movements; conditions and episodes; pregnancy-related symptoms such as bleeding or the baby’s movements; medications and their doses, schedules, prescriber, pharmacy, stock, refills, change history and the doses you take or skip; goals; and appointments, including the clinician, location, reason, notes and questions.
• Photos and videos you add. Before upload we remove location (GPS) data and other camera metadata from photos, and location data from videos; we keep the date a photo was taken. Vault photos and videos, and their captions, are encrypted on your device before upload. We can still see basic details about vault items — their type, size, dimensions, length, the date they were taken and which entry they belong to — but not what they show.
• People you invite: when you invite a caregiver or hand a journal over, we store their email address and send them an email that includes your name and email address, the name of the person whose journal it is, and the access you chose.
• Notifications: if you turn on notifications in a browser, we store a push address for that browser with a label such as “Chrome on Android” and when it was last used. In a native phone app, if available, reminders are scheduled on your phone itself.
• Optional weather location: if you choose a city or ask to use your current location, we save an approximate location and its history with the journal. A current device position is rounded to 0.1° (roughly 10 km) before it is sent to WellOrbs or saved. If you enable travel updates, the app checks for a move when you open it, at most every few hours, after you’ve granted location permission. Our servers send the approximate location, or the city name you type, to Open-Meteo and OpenStreetMap to get weather and place names. Those services don’t receive your name, your journal or your IP address.
• Health Connect (Android app, optional): if you connect Health Connect, the app reads only the types you allow there (blood pressure, weight, blood glucose, resting heart rate, oxygen saturation, body temperature, sleep sessions, daily step totals, exercise sessions and water) and saves them as entries in your own journal, starting with the 30 days before you connected. It reads when you open the app, never writes to Health Connect, and keeps its settings on your phone. Imported entries are stored, shared and deleted like the rest of your journal. You can stop it or remove access at any time in WellOrbs or in Health Connect; entries already imported stay until you delete them.
• Technical information: our hosting providers process your IP address, device and browser type, and request details (which can include a city you searched for or an approximate location) to deliver the service, keep you signed in and protect it from abuse. We don’t use this to build profiles.

We do not receive or store your precise device location: the app rounds it on your device before sending it. We do not collect your contacts or data from other apps or health platforms, except Health Connect when you connect it, and we do not buy data about you. Data from Health Connect is used only to show you your own journal and the features described here: never for advertising, never sold, and never used to train AI models. WellOrbs does not use advertising or external crash-reporting services. It keeps a small diagnostic log on your device that you can choose to export. Homepage analytics is described under Website analytics.

Website analytics

Google Analytics runs only on the public homepage for visitors who are signed out. It does not run on our legal pages, sign-in or invitation screens, inside the journal, or in a native phone app. It does not receive journal contents. Google receives the homepage address, browser and device details, screen size, and an approximate location derived from your IP address; Google states that it does not log or store individual IP addresses in Google Analytics.

We disable analytics storage, Google signals and advertising personalization before loading the tag. New analytics cookies are not created. Google can receive measurements without cookies; disabling storage does not mean no information is transmitted. If your browser sends Global Privacy Control or Do Not Track, the tag does not load. The homepage and legal pages also remove first-party Google Analytics cookies left by older versions when you visit them.

Where it comes from

From you; from people you allow to add to a journal (contributors and managers); and from your device, such as its time zone, if you allow it, an approximate location, and, if you connect it in the Android app, readings from Health Connect.

How we use it

• To provide WellOrbs: store and show your journal, calculate charts and insights, and create reports when you ask.
• To send the reminders you set up, and a weekly summary notification (on by default; you can turn it off in Reminders & notifications). Discreet mode, on by default, keeps medicine names, doses, people’s names and summary figures out of notifications.
• To share with the people you invite, at the level of access you choose.
• To keep WellOrbs secure: sign-in, rate limiting, preventing abuse and investigating problems.
• To send account emails: sign-up, sign-in and password-reset codes, codes to confirm an email change (to both addresses), invitations and handovers, and security notices such as “your password was changed”. We don’t send marketing email.

Insights and reports are computed for you and shown only to you and the people you share with. We don’t use your health data for advertising, and we don’t use it to train AI models.

We keep acknowledgement records to document which terms and privacy policy versions you agreed to or acknowledged, and when.

Who can see your data

• You, and people you invite (caregivers, family). You choose which parts they can see — logs (which include the weather location history), medications, appointments, photos — whether they can view, add or manage, and for how long. You can remove them at any time and see a history of who was given or lost access. Your vault is not shared through caregiver access. Removing access cannot recall copies or exports a recipient already saved.
• Service providers that process information on our behalf to operate WellOrbs:
  • Supabase — database and sign-in (United States).
  • Cloudflare — application hosting, photo and video storage, email delivery and security.
  • Google — measurements on the signed-out homepage only (see Website analytics).
  • Your browser’s or phone’s notification service (Apple, Google, Microsoft or Mozilla), which delivers notifications. Web notifications are encrypted so the service can’t read them.
• Weather services — Open-Meteo and OpenStreetMap receive only an approximate location or a city name, as described above.
• Legal reasons: we may disclose information if required by law, and we’ll tell you unless we’re legally prohibited from doing so. We can’t disclose the contents of your vault because they’re encrypted with a key only you have.
• Business changes: if WellOrbs is merged, acquired or its assets are transferred, your information may transfer as permitted by law. We provide notice of material changes to how it is handled and obtain consent where required.

We do not sell personal data or consumer health data, and we don’t share it for targeted advertising.

Consumer health data

Symptoms, conditions, medications, pregnancy information, health-related media, measurements and data used to infer health status may be consumer health data. Our separate Consumer Health Data Privacy Policy explains the categories we collect, their sources, why we use them, the categories shared and their recipients, and how to exercise your health data rights.

Your choices and rights

• See and download: view your journal in the app. From Me → Export your data you can download your entries, trackers, people, conditions, episodes, tags, medications, schedules and doses, reminders, photo details, sharing, settings and your legal acknowledgement history as JSON, and entries as CSV. Appointments, goals, location history, access history, medication change history, and photo and video files are not included — email us for a complete copy.
• Correct: edit any entry, medication or detail in the app.
• Delete: delete photos and videos (erased by a background cleanup job, normally within about 30 minutes), entries and appointments (removed from the app straight away and kept, hidden, until you delete the person or your account — email us to have them erased sooner), a person you track (erased after 30 days), or your whole account. Account deletion takes effect after a 7-day grace period so an accidental request can be undone; then account and owned journal records are removed from active storage, with media files erased by a background cleanup job. Contributions you made to someone else’s journal may remain there without your account attribution; contact us if you need particular health data erased. Backup copies may remain temporarily, subject to applicable deletion requirements described below.
• Withdraw consent: remove shared access, turn off optional features and notifications, or contact us to withdraw consent to collection or sharing. We explain if a feature can no longer be provided without that data. You can also request account deletion.
• Keep less on your device: turn off “Keep recent data on this device” in Account & security on shared devices.

Your rights and how to use them

Email privacy@wellorbs.com to ask whether we collect, share or sell your consumer health data, obtain a copy, correct it, withdraw consent to its collection or sharing, or request deletion. You can also request a list of third parties and affiliates with whom your consumer health data has been shared, with a way to contact them. We do not sell consumer health data. You do not need to create an account to make a request.

Tell us which right you want to use and enough information to identify the relevant account or journal. Please do not send your password, vault passphrase, recovery phrase or unnecessary health details. We may ask for additional information to verify your identity or authority to act for someone else.

We handle requests without undue delay and within the deadline that applies to you. For Washington requests, we respond within 45 days of receipt; if a permitted extension is necessary, we explain why within that period and take no more than 45 additional days. For Nevada health-data deletion requests, we delete the requested data from active records within 30 days after verification, subject to applicable legal exceptions. Other applicable laws may require a shorter deadline. Access requests are free at least twice a year; any fee or refusal for an excessive or repetitive request must be permitted by applicable law.

A request to erase health data is different from hiding an entry in the app. When handling an erasure request, we also notify relevant processors and other recipients as required by law. Backup or archived copies may remain temporarily while those systems are restored or expire, subject to applicable deletion deadlines. For Washington health-data requests, any delay for backup or archived copies is limited to six months after verification. We explain any lawful exception that prevents us from deleting particular records.

If we decline a request, reply to our decision to appeal. We respond in writing within 45 days of receiving the appeal, explaining the decision and how to submit a complaint to the relevant regulator. You can contact your state Attorney General; in Washington, use the Attorney General’s complaint process. We do not discriminate against you for exercising your rights.

Do Not Track and Global Privacy Control

We don’t track you across other websites or apps and don’t sell or share personal data for targeted advertising. If your browser sends a Do Not Track or Global Privacy Control signal, our homepage does not load Google Analytics, and we treat the signal as a request to opt out of any sale or sharing.

How long we keep it

• Your journal, photos and settings: until you delete them or your account, as described above.
• Invitations and the history of who was given or lost access: until you delete the person they relate to or your account.
• Technical and sign-in logs: for the periods configured with our providers, as needed to operate and secure the service. Contact us for information about the retention that applies to your records.
• Emails: delivered through Cloudflare; we don’t keep copies.

On your device

WellOrbs stores some data on your device so it’s fast and works offline: your sign-in session, recent journal data (the last 90 days, unless you turn this off), entries and photos waiting to upload, drafts, cached photo thumbnails, and preferences such as theme and text size. An app lock PIN is stored only as a secure hash on the device. A normal sign-out clears your session, cached journal data and thumbnails; the app warns you about pending uploads first. A forced sign-out or signing out from the acknowledgement screen may retain local journal data and pending changes so they are not lost. Theme preferences and local diagnostics may also remain. On a shared device, use Device help to clear local data when needed.

If you use a native phone app, it asks for permission before using notifications (and, on Android, exact-time alarms for reminders), the camera and microphone (to take photos and videos), your photo library (to add existing photos), Face ID or fingerprint (for the app lock and vault) and, on Android, Health Connect (to bring in readings). You can change these at any time in your phone’s settings.

Security

Data is encrypted in transit and at rest. Access rules are enforced in the database for every record, photos are served through links that expire after five minutes, sharing requires a recent sign-in, and you can add an app lock and an end-to-end encrypted vault. No system is perfectly secure; if we learn of a breach affecting your data, we’ll notify you as the law requires.

Children

WellOrbs isn’t directed to children under 13, and children under 13 shouldn’t create accounts. A parent or guardian can keep a journal for their child as a person they track, and can later hand it over when the child meets our account eligibility requirements. Users who are minors must have a parent or guardian’s permission to use WellOrbs. If we learn that a child under 13 has created an account, we’ll delete it.

Where data is stored

Our database is in the United States. Photos and videos are stored by Cloudflare; storage and processing locations depend on our provider configuration. Requests to WellOrbs pass through Cloudflare’s network, which may handle them in the country you’re in.

Changes

If we make material changes, we’ll tell you in the app or by email before they take effect.

Contact

TallyTic LLC. Email: privacy@wellorbs.com.