1. The relationship: your employer, EvolveWell, and you

EvolveWell provides its platform to employers (“Customer Organizations”). If you use EvolveWell at work, your employer decides to use the platform, controls which of its workers have accounts, and is the data controller for the workforce data processed in it. EvolveWell, Inc. processes that data on your employer’s behalf as a processor, under a data-processing agreement. For the limited data we need to operate accounts and keep the service secure, EvolveWell acts as a controller.

• EvolveWell, Inc., 1149 Amalfi Dr, Pacific Palisades, CA 90272, United States

• Privacy contact: Desiree Perez — privacy@evolvewell.com

2. Built so individuals aren’t surveilled

The platform is designed around a principle we treat as an architectural rule, not a preference: it equips decision-makers; it does not monitor individuals.

• Wellbeing and pulse signals from workers are collected confidentially and reported only in aggregate. Managers and executives see patterns across teams and cohorts — never an individual’s responses.

• The platform computes no individual risk, attrition or wellbeing score about any worker. Not displayed, not stored, not hidden in a column.

• Pulse answers are operational readiness signals — how a shift went, how workload and fatigue felt — not health or medical data. The platform makes no clinical, diagnostic or wellness assessment about anyone, and these answers are not treated as special-category health data.

• Cohort-level insights are derived from objective operational activity (for example training completions), not from profiling individuals.

• Managers are users of the system, not subjects of it: no per-manager performance scoring is exposed upward.

3. What the platform processes

• Account data — name, work email, role, team — Provisioning your account, right-sizing what you see — Contract with your employer (Art. 6(1)(b)/(f)); employer’s legitimate interests

• Work activity in the app — training progress, compliance acknowledgments, tasks, messages you send in the app — The platform’s core function: training, compliance and communication workflows — Your employer’s legitimate interests in running its operation (Art. 6(1)(f)), under its instructions

• Confidential pulse responses — Aggregate team-level insight only, and not health or medical data — both as described in section 2 — Your employer’s legitimate interests, with aggregation as the safeguard; where local law requires, consent

• Questions you ask the built-in assistant — Answering from your employer’s approved operational documents — Same as work activity above

• Voice dictation audio (transient) — If you choose to speak instead of typing, the recording is transcribed and the audio is discarded — see section 4. Legal basis: consent, given by choosing the microphone; typing is always available instead.

• Support-chat diagnostics — The support chat is built into the app; if you start a conversation, basic device and app diagnostics accompany it so problems can be reproduced and fixed. Legal basis: legitimate interests in supporting the service.

• Technical and security logs — Keeping the service reliable and secure — Legitimate interests (Art. 6(1)(f))

4. Where data lives and who touches it

• Primary data storage and authentication: hosted with Supabase in Frankfurt, Germany (EU) — customer workforce data is stored in the EU.

• Application delivery: Vercel, Inc. (US company; serves the application globally).

• AI assistance: assistant features are powered by AI infrastructure providers (Anthropic, OpenAI). Content is processed via their APIs to generate answers and is not used by these providers to train their models.

• Voice transcription: if you use voice dictation, the audio clip is relayed to OpenAI’s transcription service (Whisper), the text comes back, and EvolveWell discards the clip immediately — it is never stored with your record. The provider processes it solely to return the transcription and does not use it to train its models.

• In-app support chat: Gleap, the support-chat service, is built into the app; when you start a conversation it receives your message together with basic device and app diagnostics. It is used to fix problems, not to monitor how you use the app.

• Email delivery: Resend (transactional email).

Where any processing involves a provider outside the EEA/UK, we rely on Data Privacy Framework certification or Standard Contractual Clauses, under the data-processing agreement with your employer. A current sub-processor list is available to Customer Organizations on request.

5. Retention

Workforce data is retained for the duration of your employer’s agreement with EvolveWell and deleted or returned within a defined wind-down period after it ends, per that agreement. Within the service, your employer controls retention of its operational content. Security logs and encrypted backups are kept on short rolling windows and then age out automatically. Aggregated, non-identifying statistics may be retained beyond individual records precisely because they identify no one.

6. Your rights

Because your employer is the controller of workforce data, the fastest route for access, correction or deletion requests is your employer’s own process — and EvolveWell supports it with tooling and assistance. You can also always write to privacy@evolvewell.com: where the request concerns data EvolveWell controls we’ll answer directly within one month, and where your employer controls it we’ll pass the request on and tell you we did. You have the right to complain to your local data-protection authority.

Requesting deletion

You can request deletion of your data at any time — including after you have left your employer or uninstalled the app. Email privacy@evolvewell.com from any address and tell us the employer you used EvolveWell with. Accounts are provisioned by employers, so we will route the request to your employer as controller, support its fulfilment, and confirm to you that we did. Where EvolveWell is the controller (account and security data), we act on the request directly.

7. No automated decisions about you

The platform makes no automated decisions with legal or similarly significant effects about workers. Insights presented to managers are aggregate, advisory, and acted on by humans.

8. Changes

We’ll update the effective date when this policy changes and notify Customer Organizations of material changes so they can inform their teams.