Effective date: September 1, 2026
Last updated: October 6, 2026

Wellness Frontier is operated by Advanced Health and Wellness Group (“Wellness Frontier,” “we,” “us,” or “our”). Your employer makes Wellness Frontier available to you, but using it is your choice.

This policy explains what information Wellness Frontier collects, how we use it, what your employer can and cannot see, and the choices you have.

The short version

• We do not sell your personal information or consumer health data.
• We do not use your information for targeted advertising.
• Connecting Apple Health or Health Connect is optional. We read only the

categories you approve, and you can stop future collection.

• Your employer can see the named points board, limited roster information,

program participation counts, and certain group-level reports. You can take your name off the board in the app. Your points still count.

• Your employer does not receive your individual health measurements, health

survey answers, coach questions, benefits questions, medical history, or use of sensitive support resources.

• Your Wellness Score is yours. Your employer sees one company-wide average

each month and never your own score.

• Opening crisis, behavioral-health, substance-use, domestic-violence, or

employee-assistance resources creates no event, counter, or activity record.

• If your program has the coach turned on, Microsoft keeps a copy of what you

type to it and a person at Microsoft may read it, to detect misuse of their service. We cannot delete that copy for you. Section 2 explains this.

• Videos play in YouTube's or Vimeo's player. Google or Vimeo can see that a

video was loaded on your device. Section 2 explains this.

1. What this policy covers

This policy covers the Wellness Frontier employee website and mobile apps. It does not cover your employer’s systems, your health plan, a health care provider, Apple Health, Health Connect, or another service you choose to use. Those organizations have their own privacy practices.

The program is not directed to children under 13.

2. Information we collect

Account and workplace information

Your employer may provide your name, work email address, preferred language, work site, shift, hire date, and an initial department. You may choose a different department in the app; the department you choose is the one the program uses.

We also create sign-in, session, security, and audit records needed to operate and protect your account. These records may include timestamps, app or browser version, device and network information, and an IP address.

Your employer's admin, or our platform staff, can send an invite email to the people on your employer's staff list who have not signed in yet. The invite goes to the email address we have for you. It names your employer and has links to the app. Nothing in it records whether you opened it. We keep the time an invite was last asked for you. Your employer cannot see that time. The admin can be told how many invites were queued, and is shown no names.

Device check and app information

Before your steps can earn points, the app asks Google (on Android) or Apple (on iPhone) to confirm that it is the real Wellness Frontier app on a real phone. Google or Apple receives information about the app and the phone, and a scrambled fingerprint of the upload. They never receive your steps. We keep the result of the check, not the information Google or Apple used to reach it.

The first time the app runs on a phone, it makes a random identifier for that installation. The identifier describes the installation, not you or the phone's hardware. We store only a scrambled version of it with your account, so that one phone earns step points for one employee at a time. We delete it 30 days after it was last used to verify a phone, and at once if you delete your account. On Android, deleting the app or clearing its data removes the identifier from the phone. On iPhone, the app also keeps a key for the device check, which we store with your account; the key's reference stays in the iPhone's keychain after the app is deleted.

If your phone cannot be verified, the app may offer to send us a report. You choose whether to send it. A report contains which check failed and the codes Google or Apple returned, the phone model, the system and app versions, and, if you pick one, a choice from a short fixed list such as "This is a new phone". It never contains typed text or your steps. Only our platform staff read reports. Your employer never sees them. We keep a report for 90 days, and delete it at once if you delete your account.

The app also sends us the name of the time zone your phone or browser is set to, such as "America/Chicago". We use it to work out which day and month your activity belongs to. We keep one current time zone for you and the day it was set, and we change it at most once in seven days. Your steps and other health readings are also saved with the time zone that was sent with them. A time zone name is a clock setting. It can show which part of the country your phone's clock is set for. It is not an address or a point on a map. The app does not ask for your location and reads no coordinates. Your employer cannot see your time zone.

Health and wellness information

Depending on the features available to you, we may collect:

• steps, sleep duration, and resting heart rate from Apple Health or Health

Connect after you authorize access;

• answers you choose to give in a health or wellness survey;
• the wellness area you voluntarily select as most important for the month;
• food, weight, and action plan records you choose to keep;
• which library videos you finished;
• goals you set and program actions you complete; and
• points, achievements, and days-in-a-row progress created through your use of

the program.

The first time you connect Apple Health or Health Connect, the app also sends your step totals and time asleep for the last 14 finished days, once. We use them only to start your Wellness Score. They never earn points.

We do not change information in Apple Health or Health Connect.

Food, weight, and action plan records

You can keep three kinds of records in the app. All three are optional.

• Food. What you ate or drank, how much, the date and time, and calories if

you add them.

• Weight. A weight you type, in pounds or kilograms, and the date.
• Action plans. After a library video you can write a plan: a goal and

three actions. For each action you say what, where, when, and how long, what could get in the way, and what you will do if that happens. You can tick an action as done. For seven days after you finish a plan, you can mark each day yes or no.

Before your first food or weight entry, the app tells you once that logging can add to your points and asks if you want to start. We record that you said yes and when.

We keep these records with your other personal information, on a separate server from the one that holds points and program records. Only you can see them. Your employer never sees them. No person reads what you write. Our software checks only that each box of an action plan has something in it. It looks for no words and flags nothing. You can change or delete an entry or a plan. If you ask us for a copy of your information, these records are in it. If you delete your account, they are deleted.

When you add a food or weight entry, or finish an action plan, the app tells our program service. It sends none of your words or numbers. The program service keeps three facts:

• that you added a food or weight entry on a day. It cannot tell which of the

two;

• that you finished an action plan for a video in a month; and
• the day you finished an action plan.

Nothing else about these records goes to the program service. The facts can earn points and badges, which count in your points total. Your employer cannot see the facts themselves.

Library videos

The app has a library of healthy living videos. They play in YouTube's player, which Google runs. Each time you open one, Google receives your IP address, details about your device, which video it is, and the time. Google also receives the web address of the app, which can include your employer's name. If you are signed in to Google on that device, Google may know who you are by name. Google keeps this for as long as its own rules say. YouTube may show its logo, suggested videos, and ads. We do not choose the ads and cannot turn them off.

The app does not give Google your name, your email address, or your account. Only our own service records who watched. When a video has played 90 percent of the way through, the app tells our program service that you finished it. The record holds three things: you, the video, and the month. It holds no time of day and no count of how long you watched. Finishing a video counts toward your Education goal and can earn points and badges. Your employer cannot see which videos you watched.

A challenge can have a video too. It plays in YouTube's or Vimeo's player. The player loads when the challenge is on your screen, before you press play. Google or Vimeo then receives the same kinds of information.

Benefits and AI coach information

If your program enables the benefits coach, we process the question you type and the recent conversation needed to answer it. The coach uses your employer’s plan documents to explain what those documents say. It is not a doctor, therapist, lawyer, or insurance representative, and its answers are not medical or legal advice.

Wellness Frontier does not keep a conversation transcript. We may keep a de-identified version of a question, without your name, work site, or exact time, to evaluate and improve the coach. A de-identified record may retain the employer program involved. We keep it only in a form intended not to identify you.

The coach uses Microsoft Azure OpenAI, and you should know what that means for what you type.

Microsoft keeps a copy of your question and the coach's answer, and a person at Microsoft may read it. Microsoft does this to detect abuse and misuse of its service. It applies to every question, not only ones that look unusual. Microsoft keeps that copy for a limited period and then deletes it.

We have not been granted an exemption from this monitoring. Microsoft grants those exemptions only to customers managed by a Microsoft account team, and we are not one. If we are granted one later, we will update this policy and this paragraph will change.

That Microsoft copy is not our conversation transcript. We cannot read it, and we cannot delete it for you. Asking us to delete your account does not reach it, because it is not ours to delete.

If there is something you would rather not have handled this way, do not type it into the coach. Call the number on your plan card instead.

Information we deliberately do not collect

We do not ask for family medical history. We do not collect your precise location or camera roll. We do not create health conclusions about you from your browsing behavior. We do not record whether you opened crisis, behavioral-health, substance-use, domestic-violence, or employee-assistance resources.

3. How we use information

We use information to:

• create and secure your account;
• deliver the wellness program and features you request;
• show your own health-source measurements, goals, progress, and program

activity;

• calculate points and achievements;
• work out your own Wellness Score;
• answer benefits questions when the coach is enabled;
• operate, troubleshoot, protect, and improve the service;
• produce the employer-visible information described below; and
• comply with law and respond to valid legal process.

We do not use consumer health data for advertising, and we do not sell it.

4. What your employer can see

Your employer can see:

• your name, points, and place on the points board if you have points, unless

you take your name off that board in the app;

• your name, work email, department, and the date you were added, on your

employer's staff list. This is the information your employer gave us;

• one company-wide average Wellness Score each month, and how many people it

covers. This average has no minimum group size. Your employer never sees your own score;

• how many people joined and average points by department;
• your work site, shift, and hire date, which came from the employer’s records;
• the department you selected and whether it differs from the employer’s

starting department;

• counts of people who finished a survey, completed a verified program action,

started a coach conversation, connected a health app, or finished a program checklist item;

• those participation counts for the company and, where available, by site,

shift, length of service, age group, and sex at birth;

• company-wide totals for the monthly wellness-area question; and
• correction records when a challenge or points result is fixed, including who

made the correction and why. If points of yours are missing, you can ask us to look at it; Section 8 says how.

If you delete your account, your name comes off your employer's staff list. Your employer can see that you are no longer on the list. We do not show your employer a reason or a date. Your name and points can stay on your employer's points board until we next rebuild the board, which we do once a day.

Your employer can also remove you from its staff list. After that you can no longer sign in. Section 8 explains how to ask us about your information once you can no longer sign in.

Your employer's admin, or our platform staff, can change the email address you sign in with. We send one email to your old address. It says an administrator asked for the change. It does not show the new address, and it cannot be used to stop the change. The change usually takes effect within minutes, after that email is sent. You are then signed out, and you sign in with the new email. A PIN you set is cleared. Your health information, records, points, and badges stay with the account. The one exception is what you do in the app while the change completes, usually a few minutes. Points, a finished video, or credit for a record or plan from that time may not be kept. If you had asked to delete your account and had not yet entered the code, you need to ask again. Anyone who can read mail at the new address can sign in and see everything in the account. We keep a record of which admin asked, and the admin can see whether the change is pending, made, or not made. If you did not expect the change, email privacy@wellnessfrontier.ai at once.

Your employer does not receive:

• your individual survey answers;
• your steps, sleep, resting heart rate, water entries, or another individual

number from a connected health source;

• what you ask the coach, what the coach answers, or your benefits questions;
• your doctor visits, lab results, medical history, or care you sought;
• your date of birth;
• your food, weight, or action plan records;
• which library videos you watched;
• your own Wellness Score;
• the wellness area you personally selected for the month;
• the pages you read, how long you use the app, or how often you open it; or
• whether you opened crisis, behavioral-health, substance-use,

domestic-violence, or employee-assistance resources.

Small groups

Some employer reports can contain small counts. The program does not apply one universal minimum group size to every employer report. A count for some activities or wellness areas can be one.

The monthly wellness question has an additional rule for the Mental and Financial areas. If one, two, three, or four people choose either of those areas, the employer receives no monthly wellness-area numbers for that month. If nobody chooses one of those areas, a zero may appear. The other five areas do not use this special rule.

5. Connected health sources

Connecting Apple Health or Health Connect is optional. Before the app reads a supported category, your phone presents the platform’s permission controls. Your phone lets you allow each category on its own, but the app reads nothing until steps, sleep, and resting heart rate are all allowed.

When the app sends your data. The app shows you your Health Connect or Apple Health readings on the phone as they change. It sends them to us at most once a day, and only for finished days. On a phone you told us is yours, the app sends your last three finished days once a day: when you open the app, or, if you allowed background access, without your opening it. On a phone you share, the app never sends anything by itself. It sends yesterday's readings only when you tap to save them.

New Best. On a phone you told us is yours, the app may show "New Best — your highest day yet" during the day. The phone works this out itself: it compares today's step total on the phone with your best day, which it gets from us. Today's steps are not sent to make the comparison, and your best day is not stored on the phone. The badge and any points come only after the next day's upload confirms the day.

You can stop future collection by using the account controls in the app and the permission controls on your phone. Disconnecting stops new collection; it does not automatically delete information already sent to Wellness Frontier. Use the deletion options described below if you also want existing information removed.

6. When we disclose information

We disclose information only as described in this policy:

• Your employer: receives only the information listed in Section 4.
• Service providers: process information for hosting, databases, storage,

email delivery, security, support, document processing, search, and the AI coach. Our principal hosting and AI provider is Microsoft Azure in the United States. Service providers may use information only to perform services for us under their contracts. Google (on Android) and Apple (on iPhone) receive the information described in "Device check and app information" to confirm the app and the phone. They process it under their own terms.

• YouTube and Vimeo: library videos play in YouTube's player, which Google

runs. A challenge video plays in YouTube's or Vimeo's player. "Library videos" in Section 2 lists what they receive. Google and Vimeo handle it under their own terms.

• Legal and safety requirements: we may disclose information when required

by law, valid legal process, or when reasonably necessary to protect the rights, safety, and security of people or the service.

• Business changes: if the business is reorganized, financed, sold, or

transferred, information may be disclosed as part of that transaction, subject to applicable law and the promises in this policy.

We do not sell personal information or consumer health data, and we do not give it to data brokers. Apart from the video players, we do not disclose it to advertising networks or social-media advertising platforms.

7. How long we keep information

We keep information only for the periods needed for the purposes described here, subject to legal and contractual requirements:

• profile information, private survey answers, connected-health measurements,

goals, and source permissions are generally kept while you are enrolled or until they are deleted;

• wellness-score history uses a rolling 52-week window;
• the 14 finished days sent when you first connect a health source are kept with

your account and deleted with it;

• the scrambled installation identifier is deleted 30 days after it was last

used to verify a phone, or when you delete your account;

• the device-check key kept for an iPhone is kept with your account and deleted

with it;

• a device-check report you choose to send is kept for 90 days;
• food, weight, and action plan records are kept until you delete them or

delete your account;

• the record that you finished a library video is kept until your account is

deleted;

• the three facts about your food, weight, and action plan records are kept

until your account is deleted;

• the time an invite was last asked for you is kept with your account. An

invite that could not be sent is dropped after seven days;

• sign-in codes and sessions last minutes to hours and expire automatically;
• audit and security records kept with your personal information are generally

kept for up to 400 days. Our program server keeps a separate log, and nothing deletes it yet, even after you delete your account. It has an entry each time our platform staff or your employer's admin viewed you on the staff list, viewed your name in the points-correction log, sent a points-correction file that named you, or removed you from the staff list, and each time your sign-in email was changed. An entry holds your account reference, which is a scrambled code and not your name, what was done, and when. All but the email-change entry also hold who did it;

• de-identified coach questions may be retained indefinitely; and
• published group totals may remain after you leave because they do not contain

your identity.

When deletion applies to archived or backup systems, deletion may occur on the backup rotation or when a backup is restored, within the period allowed by applicable law.

After you delete your account. We keep two deletion markers, one on each of our two servers. They stop a staff file your employer sent before you deleted your account from creating the account again. Each holds your employer, a random value, a scrambled code made from that value and your account reference, and the day after you deleted your account. Neither holds your name or your email address. While we hold them, we can use them to tell that your account was deleted, and on which day. Your employer cannot read them. A daily job deletes each one once 45 days have passed since the day that follows your deletion. If your employer lists you in a staff file on a later day, a new, empty account is created for you.

8. Your choices and privacy rights

Participation is voluntary. You may skip a survey, the monthly question, a health-source connection, or the entire program. Skipping does not reduce your pay or employment benefits through Wellness Frontier.

Depending on where you live, you may have the right to ask us to:

• confirm whether we hold information about you;
• provide access to or a copy of your information;
• correct inaccurate information;
• withdraw consent for future collection or disclosure;
• delete information; or
• explain or appeal a refusal to act on a request.

You can disconnect a health source or request account deletion from the app’s Account area where that control is available. You may also make any privacy request by emailing privacy@wellnessfrontier.ai. If your employer has removed you from its staff list, you can no longer sign in, and we keep your information until you ask us to delete it. Email us at that address, or use the account-deletion page on this website, and we will act on your request without your signing in. We may need to verify your identity before completing a request. We will respond within the time required by applicable law and will not unlawfully discriminate against you for using a privacy right.

Washington residents should also read our separate Consumer Health Data Privacy Policy, which describes rights under the Washington My Health My Data Act.

9. HIPAA and health-plan information

Whether HIPAA applies to a workplace wellness program depends on how the program is structured. A program offered as part of a group health plan may involve protected health information governed by HIPAA, while a program offered directly by an employer may not.

This policy is not a HIPAA Notice of Privacy Practices for your employer’s health plan or health care provider. If Wellness Frontier handles protected health information on behalf of a covered health plan, the applicable health plan documents, Notice of Privacy Practices, and business-associate agreement also govern that information.

10. Security and incidents

We use administrative, technical, and organizational safeguards designed to protect information. No system can guarantee absolute security.

If a privacy or security incident triggers a notification duty, we will notify affected people and regulators as required by applicable law.

11. Changes to this policy

We may update this policy as the program changes. If a change materially affects what we collect, how we use it, or what an employer can see, we will provide notice before the change takes effect when required by law.

12. Contact us

For privacy questions or requests, contact:

Wellness Frontier Privacy
Advanced Health and Wellness Group
privacy@wellnessfrontier.ai