Privacy Policy
Last updated October 27, 2026
This explains what well360 collects, why, who sees it, and what you can do about it. well360 is a web app at gowell360.com for everyday low back pain exercise. We keep this as plain as we can.
1. Who we are
The company that decides how your data is used (the "controller") is:
Longhill Ventures LLC, a Wyoming limited liability company 1908 Thomes Ave STE 12092, Cheyenne, WY 82001, USA Privacy questions and requests: support@gowell360.com
Our representative in the European Union (GDPR Article 27): [REQUIRED BEFORE LAUNCH: EU REPRESENTATIVE NAME AND ADDRESS]
Our representative in the United Kingdom (UK GDPR Article 27): [REQUIRED BEFORE LAUNCH: UK REPRESENTATIVE NAME AND ADDRESS]
We have not appointed a Data Protection Officer. Email support@gowell360.com for anything about your data and the right person will read it.
2. The short version
- You must be 18 or older.
- When you give us your email in the quiz, we always save your email, your first name, whether you ticked the marketing box, and three answers about your day: how your day looks, your activity level and your preferred time. These three answers are not about your health.
- Your other quiz answers, including the ones about your back, are health information. We store them on our servers with your email, to build your plan. The first screen of the quiz says so: by starting the quiz you agree to this.
- For the safety check we store only the outcome. The outcome is either "no warning signs" or "a doctor has cleared me to exercise". We never store which warning signs you reported.
- The daily pain check-ins you log in the app (0 to 10) are health information too. We save them to your account with your progress, under the same agreement.
- We never send your health answers or pain scores to Meta or any other advertiser.
- We do not sell your data for money. We have no AI features, and nothing here is used to train an AI model.
- You can ask for your data, fix it, delete it, or withdraw your agreement at any time by emailing support@gowell360.com.
3. What we collect
| What | When | Why |
|---|---|---|
| Email address and first name | You enter them in the quiz or when you buy | To make your account, log you in, link your purchase to your quiz, send receipts and account emails |
| Whether you ticked the marketing box | A box in the quiz, off unless you tick it | To know if we may send tips and offers |
| Three answers about your day: how your day looks (sitting, standing or mixed), activity level, preferred time of day | In the quiz. Always saved with your email. | To set up your plan and your reminders |
| Health data quiz answers: age range, gender, where your back hurts, when it hurts, how long, pain level today (0 to 10), what you have tried (such as pills, heat, massage, physio), goal, and your commitment answer. We also keep the three answers about your day with them. | In the quiz. Stored on our servers when you give your email. | To build and adjust your plan |
| Safety check outcome: "no warning signs" or "a doctor has cleared me to exercise" | In the quiz. Stored when you give your email. | To record that you saw the safety check. We never store which warning signs you reported. |
| Record of your agreement: the version of the wording you saw and the time | When you start the quiz, which is the agreement | To show what you agreed to |
| Progress: your plan profile, the sessions you finished, how each session felt (too easy, just right or too hard), your streaks, articles read and settings | While you use the app. Saved to your account so your plan follows you to a new phone. | So your plan follows you and the next session fits you. |
| Health data pain check-ins: the 0 to 10 score you log for your back each day, with the date | In the app, when you log one. Saved to your account. | To show how your back is doing and adjust your plan |
| Membership and payment status: plan, status, next payment date, whether you have cancelled, and Stripe's customer and subscription IDs | When you buy | To give you access. Stripe takes the payment. We never see your card number. |
| Login codes | When you log in | To let you in. We email you a one-time code through our login provider. |
| Technical data: IP address, device and browser type, and login records | Automatically | To run, secure and fix well360 and to prevent fraud |
| Signup step counts: which signup screens a visit reached (such as the quiz start, the email screen, the plan page and payment) and the ad or link it came from. Kept under a random ID that only lives in the open page and is forgotten on reload. Never your answers, email or IP address. | Automatically, on our signup pages | To see where our signup loses people and make it better |
| Messages you send us | When you email support | To answer you |
Ad measurement, only with your permission where the law asks for it: events that say you viewed a page of our signup, left your email, started checkout or bought a plan, with the plan name and price, plus identifiers set by Meta and TikTok, your IP address and browser type. See section 7.
What we never collect on our servers: which warning signs you picked in the safety check.
What is kept on your device. Your quiz answers are also kept in your browser's local storage so your plan works and a refresh does not lose your place. Until you give your email, your answers stay only there.
4. Health information and your agreement
Information about your back pain is health information. In Europe and the UK it is "special category" data under Article 9 of the GDPR and the UK GDPR. In the US it can be "consumer health data" or "sensitive data" under laws like the Washington My Health My Data Act.
We handle it like this:
- The first screen of the quiz tells you, before you answer anything, that by continuing you agree to us keeping your quiz answers, including details about your back and your safety check result, and the pain check-ins you log in the app. Starting the quiz is that agreement. If you do not agree, do not start the quiz.
- Your answers reach our servers when you give your email. We use your answers to build and adjust your plan. We do not use them for anything else.
- We never send them, or your pain scores, to Meta or any other ad platform. We never sell them.
- You can withdraw your agreement at any time by emailing support@gowell360.com. We then delete your quiz answers and pain check-ins from our servers within 30 days (see section 11) and stop saving new check-ins. This does not affect anything we did before you withdrew. Your plan keeps working from what is on your device.
- The wording you agreed to is kept with a version ID, so we can show what you saw.
5. Why we use your data, and our legal basis
If you are in the EU, EEA, UK or Switzerland, the law asks us to say which legal basis we rely on.
| Purpose | Legal basis |
|---|---|
| Make your account, give you access, take payment, send receipts and service messages, link your purchase to your quiz | Contract (GDPR Article 6(1)(b)) |
| Keep your email, first name and the three answers about your day before you buy | Steps you ask for before a contract, and our legitimate interest in running the signup (Article 6(1)(b) and (f)) |
| Store your quiz answers, safety check outcome and pain check-ins, and build and adjust your plan from them | Your explicit consent (Article 6(1)(a) and Article 9(2)(a)) |
| Save your progress and make your plan follow you to a new device | Contract |
| Marketing emails | Your consent (marketing opt-in) |
| Ad measurement with the Meta and TikTok pixels and their server versions | Your consent, through the cookie banner |
| Count how many visits reach each signup screen | Our legitimate interest in improving our signup (Article 6(1)(f)) |
| Security, fraud prevention, fixing problems | Our legitimate interests in running a safe and working service (Article 6(1)(f)) |
| Keep a record of what you agreed to, so we can show it later | Our legitimate interest in handling legal claims (Article 6(1)(f)), and Article 9(2)(f) for any health detail in that record |
| Tax, accounting, responding to authorities | Legal obligation (Article 6(1)(c)) |
You can withdraw consent at any time. If we rely on legitimate interests, you can object (section 12).
6. Who we share it with
We do not sell your data for money. We share data only with the companies that help us run well360, and only what they need.
| Who | What they do | Data involved |
|---|---|---|
| Supabase | Database, login and login emails. Database servers in the EU. | Account, quiz answers and pain check-ins (if you agreed), progress |
| Stripe | Takes payments, manages subscriptions | Name, email, payment details, plan. No health answers. |
| Vercel | Hosts the website and app | Technical data such as IP address |
| Resend | Sends receipts, account emails and marketing emails, and keeps the list of people who agreed to marketing emails | Email, first name, whether you are a member, content of the email |
| Meta and TikTok (only if you allow ad measurement, see section 7) | Measure our ads | Ad measurement events, identifiers, IP address, browser type and your email in scrambled (hashed) form. Never health answers or pain scores. |
| Professional advisers, payment partners, authorities | Where needed for legal, tax or fraud reasons | What they need |
| A buyer of our business | If we are sold or merged | Your account data, under this policy |
The spoken cues in well360 were made in advance with a text-to-speech tool from Fish Audio. No user data goes to Fish Audio.
Supabase, Vercel and Resend act for us under contracts that limit what they can do with your data. Stripe acts for us when it takes your payment, and on its own account for things like fraud checks and its legal duties. See Stripe's privacy policy. Meta and TikTok act for their own purposes too, see section 7.
7. Marketing emails and ads
Emails. We send tips and offers only if you ticked the marketing box. You get a short reminder about your plan soon after the quiz, then up to four more emails over about a week, and the odd email after that. The first email offers a free desk routine if you reply YES. If you reply, we read your reply: a YES sends the routine, and a reply asking us to stop unsubscribes you. Every marketing email has a one-click unsubscribe link and our postal address. Once you buy, we stop sending the offers meant for people who have not. Receipts and account emails are not marketing and are sent either way. To make the emails about your plan, we use your first name and the schedule you picked (which days and what time of day). We never use your health answers or pain scores in marketing emails.
Ads from Meta and TikTok. We advertise on Facebook, Instagram and TikTok. To see which ads work, we use the Meta pixel and the TikTok pixel on our signup pages (not inside the app), and send copies of the same events from our server (Meta's Conversions API and TikTok's Events API) so that ad blockers do not skew the counts. They tell Meta and TikTok that you viewed a signup page, left your email, started checkout or bought a plan, with the plan name and price. The server copies include your email in scrambled (hashed) form so the platform can match the event to its own user. We never send quiz answers, health answers or pain scores. Where the law asks for permission first, nothing is sent until you tap Allow, and if you tap No thanks nothing is sent. Meta and TikTok also use this data for their own purposes. They and we are joint controllers for collecting and sending it. See facebook.com/privacy/policy and tiktok.com/legal/privacy-policy for what they do with it.
No email lists to ad platforms. Apart from the scrambled email in the measurement events above, we do not give Meta, TikTok or anyone else your email address, and we do not upload customer lists for ad targeting. If we ever do, we will ask for a separate permission first and update this policy.
Sensitive inferences. Using a back pain app can itself say something about your health. Where the law treats it that way, we will only send ad measurement events about you with your separate permission, and we will turn the events off if you say no. In Washington and Nevada we send none unless you say yes.
8. Cookies and similar technology
We use:
| Type | What it does | Needs your consent? |
|---|---|---|
| Strictly necessary | Keeps you logged in, saves your progress and quiz answers in your browser (local storage), remembers your choices, helps secure checkout (including Stripe's fraud prevention) | No. The app does not work without them. |
| Advertising | The Meta pixel and the TikTok pixel, which set identifiers to measure our ads. Signup pages only. | Yes, in the EU, EEA, UK, Switzerland, Washington and Nevada: we ask first, and well360 works the same if you say no. Elsewhere in the US you can opt out with the "Cookie choices" link at the bottom of this page or the Global Privacy Control signal (section 13). |
We do not use any other advertising or analytics cookies at this time. Our own signup step counts (section 3) use no cookies and store nothing on your device. If we add some, we will update this policy and ask first where the law requires it.
We honour the Global Privacy Control signal sent by your browser as an opt-out of advertising events. You can change your choice at any time with the "Cookie choices" link at the bottom of this page.
9. International transfers
We are based in the United States. Our database is in the EU, and some of our providers (such as Stripe, Vercel, Resend, Meta and TikTok) process data in the US and elsewhere. If you are in the EU, EEA, UK or Switzerland, your data may be sent to and accessed from the US.
When that happens, we use protections the law accepts. For our providers, that is the EU-US Data Privacy Framework (and the UK and Swiss extensions) where the provider is certified, and otherwise the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of the clauses we use.
10. Security
We use HTTPS, access controls, and providers that encrypt data in transit and at rest. We limit who can see health information. No system is perfectly safe. If a breach puts you at risk, we will tell you and the authorities as the law requires.
11. How long we keep it
| Data | How long |
|---|---|
| Email, first name, marketing opt-in and the three answers about your day, for people who never buy | 12 months after you gave them, or until you ask us to delete them |
| Quiz answers, safety check outcome and pain check-ins (if you agreed) | For members, until 12 months after your membership ends. For people who never buy, 12 months after you gave them. Sooner if you withdraw agreement or ask us to delete. |
| Account details and progress (email, first name, plan profile, sessions) | While you are a member and for 12 months after, then deleted, unless you ask sooner |
| Payment and invoice records | As long as tax and accounting law requires, usually up to 7 years |
| Records of what you agreed to (wording version, time and, at checkout, the plan and price) | At least 3 years from the date you agreed, or 1 year after your membership ends if that is later. Then deleted. |
| Marketing email address after you unsubscribe | We keep your email on a suppression list so we do not email you again |
| Technical and security logs | Up to 12 months |
| Signup step counts | Up to 12 months |
| Messages to support | Up to 3 years |
When you ask us to delete data, we delete it within 30 days, remove it from our active systems and ask providers to do the same. Backups are deleted on their normal cycle, which is no more than 30 days after that. We may keep what the law requires us to keep, such as payment records.
12. Your rights (EU, EEA, UK and Switzerland)
You have the right to:
- Get a copy of your data.
- Have wrong data corrected.
- Have your data deleted.
- Limit how we use it.
- Object to uses based on our legitimate interests.
- Receive your data in a file you can move (portability).
- Withdraw consent at any time. This is as easy as giving it: email us and we act on it.
- Complain to a data protection authority. In the UK that is the Information Commissioner's Office. In the EU you can choose the authority in the country where you live or work.
To use a right, email support@gowell360.com from the email on your account. We reply within one month. We may need to check it is you.
13. Your rights in the US
This section covers California (CCPA and CPRA) and other states with privacy laws such as Virginia, Colorado, Connecticut, Texas, Oregon and others. We give these rights to people in those states, whether or not the law fully applies to us.
What we collect, and why.
| Category | Examples | Source | Purpose | Shared with |
|---|---|---|---|---|
| Identifiers | Email, first name, IP address | You, your device | Account, security, emails | Supabase, Stripe, Vercel, Resend. Meta and TikTok (measurement events only, see section 7). |
| Commercial information | Plan, payment status | You, Stripe | Billing and access | Stripe, Supabase |
| Internet or app activity | Sessions finished, how each felt, articles read. Signup pages visited and signup screens reached, email left, checkout started, plan bought. | Your device | Run the app. Measure ads. | Supabase. Vercel. Meta and TikTok (signup page, lead, checkout and purchase events only). |
| Sensitive personal information (health) | Quiz answers about your back, pain, what you tried, safety check outcome, daily pain check-ins | You, only if you agreed | Build and adjust your plan | Supabase only (acts for us). Never sold or shared. |
| Inferences | Your plan level | Made by our plan engine | Build your plan | Nobody |
We do not sell your personal information for money. Sending ad measurement events to Meta and TikTok can count as "sharing" for cross-context behavioural advertising under California law. You can opt out with the "Cookie choices" link at the bottom of this page, or by emailing support@gowell360.com. We also honour the Global Privacy Control signal. We do not knowingly sell or share the data of anyone under 18.
Sensitive information. We use health information only to give you well360 as you asked. You can limit this by withdrawing your agreement (section 4).
Your rights. You can ask to know what we collect and use, to get a copy, to correct it, to delete it, to opt out of sale or sharing, to limit the use of sensitive information, and to withdraw consent. We will not treat you worse for using a right. We reply in 45 days (we can extend it once by 45 days and will tell you). Email support@gowell360.com. We will check it is you by matching your email. You can use an authorised agent, who needs your written permission.
Appeals. If we say no to a request, you can appeal by replying to our email within 60 days. We will answer your appeal in writing within 60 days. If you are still unhappy, you can contact your state attorney general.
14. Consumer Health Data Privacy Policy
This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act and similar laws (for example in Nevada and Connecticut). It applies to consumer health data of people in those places. It is linked from our homepage.
What consumer health data we collect and why.
- Your quiz answers about where your back hurts, when, for how long, your pain level, and what you have tried, and the daily pain check-ins you log in the app. Also your age range, gender, your goal, your commitment answer, your activity level and how your day looks. We collect these only if you agree.
- The outcome of the safety check ("no warning signs" or "a doctor has cleared me to exercise"). We collect it only if you agree.
- Your progress and how each session felt. We collect this because it is needed to give you the service you asked for.
- Your membership status in a back pain exercise service. We collect this because it is needed to give you the service you asked for.
We use the quiz answers, pain check-ins and safety outcome to build and adjust your plan. We use progress and membership status to give you access and keep your plan on track.
Where it comes from. From you, through the quiz and the app. We ask for your agreement to store quiz answers separately from this policy and from the Terms.
Who we share it with. We do not sell consumer health data. We do not share it with advertisers. No third party gets it. Supabase stores it for us and acts only on our instructions. Stripe takes payments and gets no health answers. We do not use a geofence around any place that provides health care.
Ad measurement. Using a back pain app can itself say something about your health. For people in Washington and Nevada, we send no ad measurement events about them to Meta or TikTok unless they give separate permission.
Your rights. You can:
- Confirm that we collect your consumer health data and get a list of the third parties we share it with (today, none).
- Withdraw your consent at any time.
- Have your data deleted. We delete it from our active systems and our backups on their normal cycle, and tell our providers to delete it within 30 days.
- Ask for access.
Email support@gowell360.com. We reply within 45 days, and we can extend this once by 45 days if we tell you why. If we say no to a request, you can appeal by replying within 60 days. If you are still unhappy, you can contact your state attorney general, for example the Washington Attorney General.
15. Children
well360 is for adults only. We do not knowingly collect data from anyone under 18. If we find that we have, we delete it. Tell us at support@gowell360.com if you think a child has used well360.
16. Decisions by computer
Your plan is built from fixed rules and your answers. There is no AI. No decision with a legal or similarly significant effect on you is made this way. You can ask us to look at your plan.
17. Changes
We may update this policy. If a change matters, we will tell you by email or in the app before it applies. If it needs your agreement, we will ask again. The date at the top shows the latest version.
18. Contact
Longhill Ventures LLC 1908 Thomes Ave STE 12092, Cheyenne, WY 82001, USA support@gowell360.com