[COMPANY LEGAL NAME] (“NudgeWell,” “we,” “us,” or “our”) operates the NudgeWell platform, an AI-powered benefits engagement service for employers and their employees. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our website, platform, and related services (collectively, the “Service”).
This policy applies to:
Important: For the SMB benefits service (50–500 employees), NudgeWell does not collect protected health information (PHI), medical claims data, or individually identifiable health information. We work with benefits plan details—not medical records. The separate, opt-in standalone lab-results analysis is described below.
When an HR administrator sets up NudgeWell, they may provide:
Outside the opt-in standalone lab-results tool, we do not collect: Medical claims, diagnoses, prescription records, Social Security numbers, or any individually identifiable health information. The standalone tool accepts supported lab values that a user enters, stores the submitted payload and purchased educational report encrypted at rest, and uses them only to produce and show that report. It does not sell the data or refer users to lab providers.
When employees interact with NudgeWell communications, we automatically collect:
When you visit our website or use the Service, we may automatically collect:
| Purpose | Legal Basis |
|---|---|
| Deliver personalized benefits nudges and engagement communications | Performance of contract with your employer |
| Provide Benefits Coach Q&A responses | Performance of contract |
| Generate engagement analytics and reports for HR administrators | Legitimate business interest |
| Calculate financial impact metrics (e.g., FSA savings recovered) | Legitimate business interest |
| Improve AI models and nudge effectiveness | Legitimate business interest (using aggregated/anonymized data) |
| Process payments and manage subscriptions | Performance of contract |
| Send service updates and communications | Legitimate business interest / consent |
| Comply with legal obligations | Legal requirement |
We do not sell, rent, or trade your personal information. We may share information in the following circumstances:
We use trusted third-party service providers to operate the Service:
Each service provider is contractually bound to use your data only for the purposes of providing their service to us and to maintain appropriate security measures.
We may disclose information when required by law, subpoena, court order, or government request. In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business transaction, and we will notify you before your data becomes subject to a different privacy policy.
We may share aggregated, de-identified data that cannot reasonably be used to identify any individual (e.g., “78% of employees opened their FSA reminder nudge”). This data is used for benchmarking and product improvement.
We take the security of your data seriously and implement industry-standard safeguards:
No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
We retain your data only as long as necessary for the purposes described in this policy:
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
To exercise these rights, contact us at [privacy@nudgewell.com]. We will respond within 45 days.
Residents of the following states have additional privacy rights under their respective laws: Colorado, Connecticut, Delaware, Indiana, Kentucky, Montana, Rhode Island, Texas, Utah, Virginia, and Washington.
These rights generally include:
To exercise any of these rights, contact us at [privacy@nudgewell.com]. We will respond within the timeframe required by your state’s law (typically 30–45 days).
NudgeWell acknowledges the Washington My Health My Data Act. NudgeWell may receive sensitive consumer health data when an employee affirmatively consents to read-only wearable categories such as steps, activity, sleep, and resting heart rate. Separately, a user may opt into the standalone lab-results analysis by entering supported values; those values and the purchased report are encrypted at rest and used only to produce and show the educational report. We do not sell this data or refer users to lab providers. The tool is not diagnosis, treatment, medical advice, lab ordering, or emergency care. We do not sell or use consented health data for targeted advertising, and provide withdrawal and deletion controls. Retention depends on owner and legal approval; this policy is subject to privacy and state-law review.
NudgeWell is a business-to-business service designed for adult employees and HR administrators. We do not knowingly collect personal information from children under 13 years of age. If we become aware that we have collected data from a child under 13, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at [privacy@nudgewell.com].
Our Service may contain links to third-party websites, including benefits provider portals, insurance carrier sites, and healthcare resources. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.
We use cookies and similar technologies for the following purposes:
You can control cookies through your browser settings. Disabling cookies may affect some features of the Service. Most browsers allow you to block or delete cookies; consult your browser’s help documentation for instructions.
For questions about this Privacy Policy or to exercise your data rights, contact us:
[COMPANY LEGAL NAME]
[STREET ADDRESS]
[CITY, STATE ZIP]
Email: [privacy@nudgewell.com]
Support: [support@nudgewell.com]
We will acknowledge your request within 5 business days and respond substantively within the timeframe required by applicable law (typically 30–45 days).
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. When we make material changes, we will:
Your continued use of the Service after the updated policy takes effect constitutes acceptance of the changes.
See also: Terms of Service