Privacy Policy
01Who We Are
LeWell is operated by LEWELL Co., Ltd., Bangkok, Thailand ("LeWell", "we", "us", or "our"). We are the data controller for personal data we decide how and why to process. Contact privacy@lewell.app with privacy questions or requests.
LeWell is intended only for people aged 18 or older. We do not knowingly create or maintain accounts for anyone under 18, and we ask for a date of birth before an account can be completed or continued where age was not previously confirmed.
This Policy covers information processed through available features and records retained from earlier versions of LeWell.
02Information We Process
Waitlist records: We retain email addresses and signup-source information previously submitted through the website waitlist.
Account and legal records: We collect your email address, username, password hash if you use a password, and identifiers supplied by Google or Apple if you use social sign-in. We never receive your Google or Apple password. Apple may provide a private relay email. Your date of birth is required to check age eligibility. We record the legal-document versions and time you accepted them, plus your optional usage-data and device-health connection choices and any permission history retained from earlier versions. Information required to create, secure, or verify eligibility for an account is necessary to use an account; optional profile answers and usage analytics can be declined.
Guest onboarding draft: Before you create or sign in to an account, the device stores the goals, optional profile answers, units, learning schedule, reminder choice, and progress needed to resume onboarding. The draft expires after seven days without an update and is removed when the app next reads it, or after successful onboarding. Credentials and tokens are never included. We do not record or buffer guest analytics interactions before consent. Draft answers are uploaded only after successful account creation or sign-in, acceptance of the current Terms, acknowledgement of this Policy, and your decision to continue.
Profile and personalization: We process goals and saved learning subjects, learning and reminder preferences, units, timezone, onboarding version and progress, and offer status. We use these details to resume your experience and recommend learning content. These recommendations do not make legal or similarly significant decisions about you.
We keep the initial goals saved when you first complete onboarding and a history of later goal changes, including their time and source. Accepted lesson, quiz, practice, and Challenge completions record the content, completion time, local date, timezone, and related goals, topics, and Masteries. App version, platform, and available release identifiers help us distinguish experiences. These first-party records support progress, personalization, and aggregate reporting of completed and repeated actions; they do not establish a health benefit.
Health and wellness information: You provide your date of birth and may provide optional biological sex and weight during onboarding, nutrition or routine information, and health or emotional details in practice responses. Earlier versions also allowed mood check-ins, step logs, activity logs, and health readings such as resting heart rate, heart rate variability, blood glucose, blood lipids, and sleep. This information can be sensitive personal data.
We use optional body-profile answers and health information you choose to provide for related personalized guidance when those features are available. Mood check-ins, step logging, health-metric screens, and device-health syncing are unavailable in the current MVP. This change does not delete records created in earlier versions; retained records are handled under the retention and deletion terms in this Policy. To ask about retained account data, contact privacy@lewell.app. Skipping optional questions does not remove purchases or learning progress.
Earlier versions used mood check-ins, step logs, and activity records to calculate first-party Insights, including daily and weekly averages, trends, and associations between check-ins and activity. These user-facing mood, step, and health-metric features are unavailable in the current MVP. We do not use these records to make legal or similarly significant decisions about you.
Earlier versions could read steps, active energy, exercise minutes, resting heart rate, heart rate variability, and sleep duration from Apple Health or Health Connect where supported, with separate device permission. Access was read-only; LeWell did not write to those services. The current MVP does not request device-health permissions or read new data from Apple Health or Health Connect, even if permission was previously granted in device settings. This feature change does not delete readings already copied to your LeWell account or historical permission records; they remain subject to this Policy.
Learning-path records: We store your selected path and content version, focus, progress and activity times, plans, optional usefulness ratings, and follow-up choices. We also keep available entry-source or campaign context and identifiers needed to prevent duplicate updates. These records support your learning path and are deleted with the account. They do not establish a health benefit.
Learning and social activity: We process lesson and practice progress, quiz answers and scores, XP, gold, gems, streaks, challenges, follows, connections, reactions, and other actions needed to provide the Service.
When you view another person's profile, we temporarily record both internal account IDs and the local date to produce anonymous daily view counts and notifications. We do not currently show the viewer's identity to the viewed account or send the viewer-profile pair or viewed username to PostHog.
Practice responses and AI feedback: When you request AI feedback under the Terms, we process your response, including health or emotional information you choose to include, and send it with the relevant practice instructions to Anthropic's commercial Claude API. We do not attach your account ID or email address, but the response itself may contain identifying information. You can choose not to submit a response and use other learning features. AI feedback evaluates responses against activity requirements; it is not a medical assessment. Avoid including information about another person or details you do not want processed for this purpose. Anthropic does not use commercial API inputs or outputs to train its models by default. Under its standard retention, Anthropic may retain inputs and outputs for up to 30 days, with longer retention possible for safety, abuse prevention, or legal obligations. Responses that form part of your LeWell history, such as commitments and check-ins, remain in your account until deleted.
Optional practice feedback: After completing a practice, you may rate whether it helped. We save the selected rating and its time with that completed practice in your account until deleted. This feedback is optional, works independently of Share usage data, and is not sent to AI providers or PostHog. Skipping does not affect your progress or rewards.
Optional product analytics: If you opt in to Share usage data, PostHog receives selected events about onboarding, feature use, plan engagement, time spent, purchases, trials, and retention. PostHog starts only after you are authenticated and your choice is recorded. We identify the analytics profile using an internal account ID and may attach coarse product properties such as level, Premium status, and whether your account has legacy catalog access or requires subscription activation. When an opted-in event is sent, PostHog uses the request's IP address to derive approximate location properties, for example country and region. This is network-derived location, not GPS or precise device location, and we use it only for aggregate product analytics, not advertising. We do not send your email, username, raw birth date, sex, height, weight, practice text, user-created routine names, user-selected reminder times, or health-reading values to PostHog. PostHog data is hosted in the EU. If you decline, no PostHog product analytics are sent from your device. You may change this choice in Settings at any time.
With the same optional usage-data choice, we also store account-linked first-party records of recommendations actually shown, their content, rank, reason and goal context, and explicit selections, dismissals or changes. An explicitly selected recommendation may be linked to a completed practice. Optional usefulness ratings are linked to completed actions; they are not medical assessments. We record observed foreground sessions and dates, session identifiers, app/platform/release and onboarding versions, and available campaign/source labels and referring website hostname observed after consent. We do not collect full attribution URLs, private query parameters, advertising identifiers, or pre-consent guest activity for this measurement. Selected recommendation, completion and usefulness context may also be sent to PostHog after opt-in. Declining or withdrawing usage-data consent stops new optional collection, including these first-party records, without preventing normal use of LeWell.
We separately keep first-party operational records required to provide and understand the Service, such as account and onboarding completion, goal history, accepted learning and action completions, purchases, entitlements, subscription lifecycle, notification delivery, and the local calendar dates on which authenticated app requests are observed. Operational activity dates support aggregate retention reporting and are distinct from optional foreground-session observations. These records are not advertising analytics.
Crash diagnostics: Sentry receives crash and technical diagnostic information, which may include device model, operating-system version, app version, network context, and the code path involved in an error. Sentry is used for security and reliability, independently of the optional Share usage data setting. We redact known sensitive fields and do not intentionally include practice text or health-answer values.
Access eligibility: We keep your account's access-policy version, selected free-topic identifier where applicable, and purchase and entitlement records to apply your access rights.
Purchases: Apple or Google processes mobile payments and RevenueCat validates receipts and entitlements. We receive product and transaction identifiers, store, entitlement status, trial status, renewal, cancellation, expiration, and conversion information. We do not receive card or bank details.
Operational billing records also include account-linked provider event and transaction references, timestamps and their source, offer codes, store environment, cancellation reasons, currency, purchase and refund amounts, taxes, commissions, and estimated proceeds where available. These records support reconciliation and financial reporting independently of optional usage-data consent.
Notifications and email: We process device push tokens, notification preferences, user-selected reminder times, delivery records, and email delivery information needed for verification, password reset, account notices, and communications you request. If you enable a personal routine reminder, the routine text is used in its notification message and may appear on your device lock screen depending on your notification settings.
Heart refill alerts use the affected activity's identifier and type, blocking and status-check times, and expected recovery time. Pending alert data is cleared when recovery is observed or the alert is sent or discarded. This processing is separate from optional product analytics.
Feedback and support: If you send product feedback in the app, we store the category and message with your account. We also store limited technical context shown before submission: the app version, platform, and the app screen path without query parameters. You can choose whether LeWell may contact you about the submission. We do not send the message text to PostHog.
04Why We Process Information
We process information to create and secure accounts, provide requested learning and social features, save progress, personalize goals and practices, deliver notifications, process purchases, review product feedback, provide support, prevent fraud, diagnose faults, and comply with law. Optional product analytics requires your opt-in. Optional body-profile and health information you provide is used for the related purposes described above and in the Terms. The current MVP does not access device health services.
Depending on your location and the activity, our legal basis is performance of our contract with you, your consent, compliance with legal obligations, or our legitimate interests in operating and securing LeWell. Where we rely on legitimate interests, we balance those interests against your rights. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.
06Security
We use HTTPS, salted password hashing, short-lived access tokens, restricted database access, authenticated purchase webhooks, field redaction, and other reasonable safeguards. On the web, the refresh token uses an HTTP-only cookie. Native apps store the refresh token in app-controlled local storage and native preferences so the session can survive restarts. No storage or transmission method is completely secure.
07Retention and Deletion
- Guest onboarding draft: Expires after seven days without an update; removed on the next read or successful onboarding
- Temporary profile-view records: Normally no more than three days, then deleted by rolling cleanup
- Active-account profile, health, learning, social, and product-feedback data: While the account is active, unless deleted earlier
- First-party goal history, completion evidence, and optional recommendation, foreground-session, and usefulness records: While the account is active; optional collection stops on withdrawal, and existing records are removed on account deletion
- Optional PostHog analytics: Up to 24 months under the project retention setting, unless erased earlier
- Sentry diagnostics: Up to 90 days under the project retention setting
- Routine application and security logs: Normally up to 30 days, longer only for an active security or legal matter
- Anthropic commercial API inputs and outputs: Normally up to 30 days under Anthropic's standard retention, subject to stated safety and legal exceptions
- Transaction, consent, fraud-prevention, tax, and legal records: Only as long as required for the applicable obligation or limitation period, which may be up to seven years
- Service backups: Until overwritten through the hosting backup cycle, with access restricted and no use except restoration
You can delete your account in Settings or request deletion at the account-deletion page. Before the local account is deleted, LeWell requests deletion of account-linked PostHog and RevenueCat customer data where applicable. Provider processing may complete asynchronously. We also clear LeWell browser storage and native app preferences on the device used for in-app deletion. Other devices may retain local data until sign-out, storage clearing, or uninstall.
Deleting a LeWell account does not cancel a subscription managed by Apple or Google. Manage or cancel it separately through the relevant store; cancellation is not a condition for requesting account deletion. Apple, Google, and legally required transaction records may remain under their policies or law. We may retain narrowly limited records where legally required, to resolve an active dispute, or to prevent fraud, and will not use retained data for unrelated purposes.
08Your Rights
Depending on where you live, including under Thailand's Personal Data Protection Act and the EU or UK GDPR, you may have rights to access, correct, delete, restrict, object, obtain a portable copy, withdraw consent, and complain to a data-protection authority.
Use available in-app controls to update information, change your optional usage-data choice, or delete your account. The current MVP has no in-app controls for health readings or device-health connections. Revoke any device-health access granted in an earlier version through your device settings. For requests about retained health readings or historical permission records, contact privacy@lewell.app. You may change your optional usage-data choice in Settings or unsubscribe from marketing email through its unsubscribe link. Contact privacy@lewell.app for other requests not available in the app; we may need to verify your identity. Withdrawal does not recall an AI request already sent or affect processing that was lawful before withdrawal.
09International and Regional Rights
Mandatory privacy and consumer rights where you live continue to apply. Contact privacy@lewell.app for regional privacy questions or to request information about applicable international-transfer safeguards.
10Changes
We may update this Policy as LeWell changes. We will change the date above and provide an in-app or email notice when a change is material. Where law requires renewed consent, we will request it before the new processing begins.
11Contact
- Email: privacy@lewell.app
- Data Controller: LEWELL Co., Ltd., Bangkok, Thailand