Privacy

Updated on 4 November 2026

This English version is provided for convenience. If it differs from the Italian version, the Italian version prevails.

This notice explains how we handle the data of people who visit www.wellilab.it and use the WELLi app.

Data controller

Arimaslab S.r.l., Via Tiburtina Valeria km 68,200, 67061 Carsoli (AQ), Italy, VAT no. 02039300666. For any request: privacy@arimaslab.com. Data protection: dpo@arimaslab.com.

The site

The site does not use cookies, does not include analytics or advertising tools and does not load resources from external services. The server may record technical data, such as IP address and browser type, to run and protect the service. If you write to us, we'll use your address and message only to reply.

Data handled in the app

• Account: name, email, phone and profile data.
• Health: the lab reports you upload, the results taken from them that you confirm, and the measurements you enter.
• Diary: meals, water, sleep, mood and activity, if you record them.
• Apple Health and Health Connect: the data you choose to import, only if you turn on the connection.
• Welli AI: the messages you write and the meal photos you send.
• Appointments: the appointments you book and the facility you choose.
• LOOKAT medallion: if you use it, the location sent to your chosen contacts with the request for help.
• Device: the identifiers needed to send you notifications.

Why, and on what basis

We handle data to provide the service you request (Art. 6(1)(b) GDPR). For health data the basis is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw. We keep technical and security logs for our legitimate interest in protecting the service and to meet legal obligations. We do not sell your data and do not use health data for advertising.

Welli AI

AI features only turn on with separate consent. We send OpenAI, acting as a data processor, test results and dates, age and sex, the text of your messages and meal photos. We do not send your name, email or tax code. OpenAI does not use this data to train its models and may keep it for up to 30 days solely for safety checks. Processing may also take place outside the European Union, with the safeguards required by the GDPR. You can withdraw consent from Profile › Privacy and consents: AI features turn off and the rest of the app keeps working.

Family

Joining a family doesn't share your data. Sharing is turned on per person and per category, by you or by the family organiser: in that case you get a notification and an email. You can revoke it whenever you want. Whoever receives a share sees the data in that category.

Who we entrust data to

• DigitalOcean: hosts the servers, in Frankfurt.
• OpenAI: AI features, with your consent.
• Google Firebase: notifications.
• Brevo: sending emails.
• Twilio: sending text messages, where applicable.
• Open Food Facts: the terms and barcodes you search for in the diary.
• Apple and Google: stores, notifications and connections with Apple Health and Health Connect, under their respective terms.
• Healthcare facilities: the data needed to manage an appointment you choose to book.

Some of these providers are based outside the European Union: transfers take place with the safeguards required by the GDPR.

How long

We keep data while your account is active or until you delete it. If you delete your account, it is deactivated immediately: see Delete account. Some logs may remain for the time required by law.

Your rights

You can request access to, a copy of, rectification, erasure, restriction and portability of your data, object to processing and withdraw consent without affecting processing already carried out. Write to privacy@arimaslab.com. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Changes

If this notice changes substantially, we'll tell you in the app and, where needed, ask for your consent again.