Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Ecosystem & AnalytiX International Inc. ("WellValet", "we", "us" or "our"), an Ontario corporation, collects, uses, discloses, retains and protects personal information when you use the WellValet mobile application, the website www.wellvalet.com, and related services (collectively, the "Services").

This Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), including its ten fair information principles, and other Canadian privacy laws that apply to the Services. The Services are not targeted to or intended for residents of Quebec, and this Policy is not intended to comply with Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), except to the extent any non-waivable rights or obligations apply by law.

By creating an account, using the Services, or providing personal information to us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use the Services.

2. Accountability and Privacy Officer

In accordance with PIPEDA Principle 1 (Accountability), we have designated a Privacy Officer responsible for our compliance with this Policy and applicable privacy law.

3. Personal Information We Collect

3.1 Information You Provide Directly

• Account information: email address, password (stored as a salted hash; we never store plaintext passwords), and display name.
• Wellness and product-preference profile (optional): age range, general weight range, wellness goals, dietary preferences, product-sensitivity preferences, ingredient exclusions or avoidance preferences. This information is voluntary and used solely to personalize product scores. You may use the core Services without completing a wellness profile.
• Shopping lists: items you add to your personal or family shopping list.
• Family group data: family group name, your display name, your role (admin or member), and shopping list items you contribute.
• Communications: messages you send to us and prompts you submit to the AI Valet assistant. You must not include PHI, medical records, health records, diagnoses, lab results, prescriptions, clinician notes, or other regulated health-care information.

3.2 Information Collected Automatically

• Scan history: barcodes you scan, products matched, resulting scores, and timestamps.
• Usage and technical data: device type, operating system version, app version, language settings, crash logs and diagnostic data, and IP address.
• On-device data: authentication token, subscription status, personal shopping list, and wellness profile cache — stored locally on your device.

3.3 Information from Third Parties

Apple App Store, Google Play, and RevenueCat may confirm the status of your subscription, in-app purchase, entitlement, cancellation, or refund. We do not receive or store your full payment card details.

3.4 Information We Do NOT Collect

• Precise geolocation data
• Contact lists, photos, or browsing history outside the app
• Camera frames (processed in real time for barcode scanning only; not stored on our servers)
• Protected health information (PHI), medical records, diagnoses, lab results, prescriptions, or other regulated health-care information — you must not submit this to the Services

4. Why We Collect and Use Personal Information

• To generate personalized wellness scores and product information based on your wellness and product-preference profile
• To provide optional ingredient, product-sensitivity, and dietary-preference flagging
• To operate account authentication, family-group administration, customer support, and verification
• To process and manage subscriptions, free trials, plan changes, and payment-related records
• To process AI Valet prompts and generate responses
• To maintain, improve and measure security, integrity, and performance of the Services
• To comply with applicable law, respond to lawful requests, and enforce our Terms

5. Consent

Express consent is obtained for the collection of optional wellness and product-preference information, for marketing communications, and at sign-up via acceptance of this Policy and the Terms. You may withdraw consent where legally available, but doing so may limit access to features that require the information.

Family Plan notice: If you join a family group, your display name and shopping items are visible to the family administrator. The administrator does not gain access to your wellness profile, scan history, or account credentials.

6. Artificial Intelligence (AI Valet) Processing

The AI Valet feature is powered by a third-party large language model provided by Anthropic, PBC. When you use AI Valet, the text of your request and limited relevant context (such as your current shopping list items and applicable wellness preferences) may be transmitted to Anthropic and its sub-processors, whose servers may be located in the United States or other jurisdictions.

We send only the minimum prompt content and context required to provide the requested response. We do not send your password, payment information, full account record, or prohibited health-care information unless you include it in a prompt contrary to this Policy.

7. Third-Party Service Providers

8. Cross-Border Transfers of Personal Information

Our primary servers and database are located in Canada (AWS Montréal region). Certain service providers process limited personal information in the United States, the European Union and other jurisdictions. While your information is in another jurisdiction, it is subject to the laws of that jurisdiction, including lawful access by courts, law enforcement or national-security authorities.

9. Retention and Deletion

• Account data: retained while your account is active and deleted or de-identified within 90 days of verified account deletion, except where required by law
• Wellness and product-preference profile: retained until you edit or delete it, or your account is deleted
• Scan history and shopping-list data: retained while your account is active or until you delete the applicable items
• Aggregated or anonymized data: may be retained for analytics, service improvement, and product development where it does not identify you

You can request account deletion in-app or view our Account Deletion Page for complete instructions. Account deletion requests are actioned within 30 days of verification, and data is fully deleted or de-identified within 90 days. You may also email support@wellvalet.com (subject: "Account Deletion Request").

10. Safeguards

• Encryption in transit (TLS/HTTPS) and encryption at rest for our database
• Password hashing with a modern salted algorithm; we cannot read your password
• Token-based authentication with expiring credentials
• Restricted production access, least-privilege roles, staff confidentiality obligations, and logging and monitoring

11. Your Privacy Rights

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information — most profile information can be corrected directly in the app
• Deletion: request deletion of your account and personal information
• Portability: where required by applicable law, request your personal information in a structured, machine-readable format

We will respond to verified requests within 30 days. Contact: support@wellvalet.com (subject: "Privacy Request").

Complaints: Contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376.

12. Children's Privacy

The Services are intended for adults and are not directed at children under 13. We do not knowingly collect personal information from children without verifiable consent of a parent or guardian. A parent or guardian must supervise any minor's use of Family Plan features.

13. Special Notice — Product Preferences Are Not Health-Care Information

WellValet is a general wellness and consumer product information application. We are not a health information custodian, a HIPAA covered entity, or a regulated health-care organization. We do not provide medical, clinical, dietetic, pharmaceutical, emergency, or other professional health-care services.

14. Data Breach Notification

If a breach of security safeguards creates a real risk of significant harm to you, or if notice is otherwise required by applicable law, we will report the breach to the Office of the Privacy Commissioner of Canada, notify you as soon as feasible, and keep records of breaches, in accordance with PIPEDA's mandatory breach provisions.

15. Changes to This Policy

We may update this Policy from time to time. The "Last Updated" date at the top indicates the most recent revision. For material changes, we will provide prominent notice in the app or by email. Continued use of the Services after the effective date constitutes acknowledgement of the changes.

16. Contact Us