Privacy Policy
How we handle personal data
Controller
Wellioness (wellioness.com) is the data controller. Privacy contact: office@wellioness.com.
Data we process
We process identity and contact details, account authentication, retreat registration and uploaded documents, payment metadata via PayPal (not full card numbers), health information you voluntarily submit, inquiries/newsletter details, and — only with consent — analytics events. We do not sell personal data.
Why and on what basis
Contract: bookings, payments, and your account. Consent: marketing email, non-essential analytics cookies, and health declarations. Legitimate interests / legal duties: security, fraud prevention, and minimized accounting records after anonymization.
Where data is stored
Core app data runs in the EU (Firestore Belgium eur3; hosting europe-west1). Uploaded files in Firebase Storage are in the US (us-east1). Payments use PayPal; optional analytics use Google Analytics. Transfers rely on provider safeguards (including SCCs where applicable).
Cookies
Essential storage keeps language and accessibility preferences. Google Analytics loads only after you choose “Accept analytics” on the cookie banner.
Your rights
You may request access, correction, erasure, restriction, objection (including marketing), and portability (GDPR; Israeli Privacy Protection Law where relevant). Withdraw consent anytime. Signed-in users can export or delete data under Account → Profile; marketing opt-out is also available via email unsubscribe links. Contact: office@wellioness.com.
Last updated: July 2026.