─────────────────────────────────────────

WHO WE ARE

─────────────────────────────────────────

Wellcast is operated by Wellcast Limited (company number: 16172254), registered in England and Wales ("Wellcast", "we", "us", "our"). Registered office: Lynton House, 7–12 Tavistock Square, London WC1H 9BQ.

We are the data controller for personal data collected through the Wellcast app and website. This means we decide how and why your personal data is used.

Privacy contact: privacy@wellcast.life

ICO registration number: C1745395

─────────────────────────────────────────

OUR APPROACH TO YOUR DATA

─────────────────────────────────────────

We use your personal data only to provide and improve the Wellcast service for you. We do not use your personal data for external commercial purposes, we do not sell it, and we do not share it with third parties for their own use.

Where data is shared externally — for example, workout analytics shared with trainers — it is always fully anonymised and cannot be used to identify you.

─────────────────────────────────────────

WHAT THIS POLICY COVERS

─────────────────────────────────────────

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who processes it on our behalf, how long we keep it, and your rights. It applies to users of the Wellcast app and website, and to trainers who partner with us.

This policy is governed by UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

─────────────────────────────────────────

THE DATA WE COLLECT

─────────────────────────────────────────

1. Data You Give Us Directly

Account data: your name, email address and password when you register.

Profile data: optional information such as fitness goals, experience level, preferred workout types or a profile photo.

Payment data: billing address and payment card details when you subscribe. We do not store full card details — these are processed securely by our payment processor on our behalf

Communications: messages you send us via email, in-app support or social media.

Feedback and reviews: ratings, comments or feedback about content or trainers.

2. Health and Fitness Data (Special Category Data)

When you use the app, we may collect:

• Workout history (classes completed, duration, frequency)

• Self-reported fitness level, health goals or physical limitations

• Progress metrics you choose to track within the app

• Data from connected wearable devices or health apps (such as Apple Health or Google Fit), if you choose to connect them

Health and fitness data is classed as "special category" data under UK law and receives a higher level of protection. We only collect this data with your explicit consent via a separate consent step during onboarding. You can withdraw consent at any time (see Your Rights below).

This data is used solely to personalise your experience within the app and to show you your own progress. It is never shared externally.

3. Data We Collect Automatically

Device and technical data: device type, operating system, app version, IP address, unique device identifiers.

Usage data: content viewed, time spent in the app, features used, search queries and content preferences. Used internally to improve the app and personalise your experience.

Crash and diagnostic data: error logs and performance data to identify and fix technical issues.

Cookies and similar technologies: used on our website. See our Cookie Policy at wellcast.life/cookies

─────────────────────────────────────────

HOW WE USE YOUR DATA AND WHY

─────────────────────────────────────────

We use your personal data solely for the following internal purposes:

• Creating and managing your account

• Processing your subscription and payments

• Providing access to workouts, programmes and content

• Personalising your content recommendations and in-app experience (see Profiling section below)

• Tracking your fitness progress where you have enabled this

• Sending service communications (e.g. renewal reminders, policy updates)

• Sending marketing communications where you have separately opted in

• Improving and developing the app and content

• Detecting and preventing fraud and security incidents

• Complying with legal obligations

We do not use your data for advertising on behalf of third parties or for any purpose unrelated to providing the Wellcast service.

Legal bases we rely on:

• Contract: to provide the Services you signed up for, manage your account, process payments and handle cancellations.
  

• Legitimate interests: to improve the app, personalise your experience, prevent fraud and protect platform security — where these interests are not overridden by your rights. We document our assessment of this balance in a Legitimate Interests Assessment.

• Legal obligation: where required by law.
  

• Explicit consent: for health and fitness data and for direct marketing. You can withdraw consent at any time without affecting prior processing.
  

• Recognised Legitimate Interest (DUAA 2025): for certain processing activities such as fraud prevention and network security, where the law does not require a balancing test.

─────────────────────────────────────────

PROFILING AND AUTOMATED DECISION-MAKING

─────────────────────────────────────────

The Wellcast app uses automated processing and profiling to personalise your experience. This includes:

• Recommending workouts and programmes based on your activity, preferences and fitness goals

• Adapting content suggestions over time based on what you engage with

• Personalising the order and selection of content shown to you

• Where available, using AI-assisted coaching features to suggest next steps in your fitness journey

This profiling is based on your usage data and, where you have consented, your health and fitness data. It is used solely to improve your experience within the app. It does not produce any legal or similarly significant decisions about you.

Your rights regarding profiling:

• You can object to profiling at any time by contacting us at privacy@wellcast.life

• Where profiling is based on health data, it only takes place with your explicit consent, which you can withdraw at any time

• You can request that a human reviews any personalisation decision you believe has affected you

We do not use profiling for external advertising or to make decisions with legal or significant consequences for you.

─────────────────────────────────────────

TRAINER DATA

─────────────────────────────────────────

If you are a trainer with a Partnership and Content Licence Agreement with Wellcast, we collect and use:

• Your name, biography, image and likeness for use in the app and for marketing, as set out in your trainer agreement

• Bank or payment details to process fee payments

• Communications relating to your content or partnership

Analytics shared with trainers: trainers can access performance data about their content (e.g. total views, total minutes watched). This data is fully anonymised — it contains no personal information about any individual user.

─────────────────────────────────────────

WHO PROCESSES YOUR DATA ON OUR BEHALF

─────────────────────────────────────────

We do not share your personal data with third parties for their own use. We use a small number of trusted service providers who process data on our behalf and under our instructions:

• Payment processor (Stripe]) to handle subscription payments

• Cloud hosting and infrastructure provider (Amazon Web Services (AWS)) to store data securely

• Email service provider (AWS) to send service communications

• Large Language Model (LLM)  (OpenAI)  Coach W conversations, which include fitness goals, mood, health context

• Wearable integration provider (Rook Connect) connects wearable biometric data (HRV, sleep, SpO2, skin temp, potentially menstrual data)

All service providers are bound by data processing agreements and are contractually required to process your data only as instructed by us, for no other purpose, and in accordance with UK data protection law. They may not use your data for their own marketing or commercial purposes.

Other circumstances in which we may disclose data:

Legal and regulatory: where required by law, court order or regulatory authority, or to protect the rights, property or safety of Wellcast, our users or others.

Business transfers: if Wellcast is involved in a merger, acquisition or sale of assets, data may transfer as part of that transaction. We will notify you before any such change takes effect.

─────────────────────────────────────────

INTERNATIONAL DATA TRANSFERS

─────────────────────────────────────────

Some service providers may be based outside the UK. Where data is transferred to countries without equivalent protection, we ensure appropriate safeguards are in place — such as UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs). Contact us at privacy@wellcast.life to request details.

─────────────────────────────────────────

HOW LONG WE KEEP YOUR DATA

─────────────────────────────────────────

Account and profile data: retained while your account is active. Deleted or anonymised within 30 days of account deletion, unless retention is required by law.

Health and fitness data: retained while your account is active and consent is in place. Deleted within 30 days on account deletion or consent withdrawal.

Payment and transaction data: retained for 7 years to comply with HMRC requirements.

Support and communications: retained for up to 3 years after last interaction.

Marketing preferences: retained until you withdraw consent or unsubscribe.

─────────────────────────────────────────

DATA BREACH NOTIFICATION

─────────────────────────────────────────

We maintain appropriate technical and organisational security measures to protect your data. In the event of a personal data breach, we will notify the ICO within 72 hours where required by law. If a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, explaining what happened, what data was affected and what steps we are taking.

If you believe your account has been compromised, contact us immediately at privacy@wellcast.life.

─────────────────────────────────────────

YOUR RIGHTS

─────────────────────────────────────────

Under UK data protection law, you have the following rights:

• Right to access: request a copy of the personal data we hold about you.

• Right to rectification: ask us to correct inaccurate or incomplete data.

• Right to erasure: ask us to delete your data in certain circumstances.

• Right to restriction: ask us to limit how we use your data in certain circumstances.

• Right to data portability: request your data in a structured, machine-readable format.

• Right to object: object to processing based on legitimate interests, and opt out of profiling or direct marketing at any time.

• Right to withdraw consent: for health data and marketing, withdraw consent at any time without affecting prior processing.

• Right regarding automated decisions: request human review of any automated decision that significantly affects you, and make representations about it.

• Right to complain: contact the ICO at www.ico.org.uk or 0303 123 1113.

To exercise any right: email privacy@wellcast.life. We will respond within one calendar month.

─────────────────────────────────────────

MARKETING AND PECR

─────────────────────────────────────────

Marketing emails and push notifications are governed by both UK GDPR and the Privacy and Electronic Communications Regulations (PECR). We will only send you marketing communications where you have separately and explicitly opted in. You can withdraw at any time by:

• Clicking "unsubscribe" in any marketing email

• Updating notification preferences in the app settings

• Emailing us at privacy@wellcast.life

─────────────────────────────────────────

WEARABLE DEVICES AND THIRD-PARTY HEALTH APPS

─────────────────────────────────────────

If you choose to connect a wearable device or health app (such as Apple Health, Google Health Connect, Fitbit, Garmin, WHOOP, Oura, or others supported by our integration partner), we may receive the following categories of health and biometric data, depending on your device and what it is capable of measuring:

Activity and movement data: steps, distance, floors climbed, elevation, pace, speed, active and basal calories burned, activity type and duration, GPS coordinates during activities.

Heart and cardiovascular data: heart rate (resting, workout, maximum, minimum), heart rate zone durations, heart rate variability (HRV), ECG readings (where available), blood oxygen saturation (SpO2), blood pressure.

Sleep data: sleep duration and efficiency, sleep stages (light, deep, REM, awake), sleep interruptions, sleep latency, sleep breathing rate, sleep score.

Body and recovery data: VO2 max, skin temperature, respiratory rate, weight, height, recovery scores, strain scores.

Reproductive health data: menstrual cycle data, where your device records and you choose to share this.

We collect this data only with your explicit consent, through a separate consent step during onboarding, solely to display your progress and personalise your experience within the app. We do not share this data externally.

Your wearable data is processed on our behalf by Rook Connect (our health data integration partner) and stored on our infrastructure. A full list of our data processors is set out in the "Who Processes Your Data" section above.

You can disconnect any device at any time through your account settings. We will stop receiving new data immediately on disconnection. You can request deletion of previously received wearable data by exercising your right to erasure (see Your Rights).

Wellcast is not a medical device. Data displayed from wearables is for general fitness and informational purposes only and does not constitute medical advice, diagnosis or treatment.

─────────────────────────────────────────

AGE REQUIREMENT

─────────────────────────────────────────

The Wellcast app is for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a user under 18 has registered, we will delete their account and data promptly.

If you believe someone under 18 has registered, please contact us at privacy@wellcast.life.

─────────────────────────────────────────

CHANGES TO THIS POLICY

─────────────────────────────────────────

We may update this policy from time to time. Where changes are material, we will notify you via the app or by email before they take effect. The version number and "Last updated" date at the top always reflect the most recent version.

─────────────────────────────────────────

CONTACT US

─────────────────────────────────────────

Privacy / Data queries: privacy@wellcast.life

Post: Wellcast Limited, Lynton House, 7–12 Tavistock Square, London WC1H 9BQ

To complain to the ICO:

Website: www.ico.org.uk

Phone: 0303 123 1113