Wellspot privacy notice

This notice explains how personal data is processed in the Wellspot service (app.wellspot.fi) and on the website wellspot.fi. It has been prepared in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). If the language versions differ, the Finnish version prevails.

Updated: 12 October 2026 · Version 1.0

1. Controller and contact details

Wellspot Oy (Business ID 3648328-6), Kerava, Finland. Data protection matters: tietosuoja@wellspot.fi

Wellspot has not appointed a data protection officer. Joona Salo is responsible for data protection matters and can be reached at the address above.

2. Who this notice concerns and who the controller is

Wellspot is a workplace wellbeing service that your employer has acquired for its staff. Your data is processed in two roles.

Your employer does not see your wellbeing data, does not know whether you have given consent, and does not see whether you have booked an appointment. Your employer only sees group-level summaries of at least five people (section 4). Your employer's own privacy notice describes its own processing.

3. Data processed, purposes and legal bases

3.1 User account (your employer as controller)

Data: name, work email, role (employee, manager, HR), team and manager, location, invitation and login status.

Source: your employer's HR adds you to the service, and the service sends an invitation to your email.

Purpose: creating and maintaining the user account, login, providing the service under the agreement with your employer, and calculating the number of billable users (organisation-level count only).

Who can see it: your employer's HR sees the employee list (name, email, role, team, manager, invitation status). A manager sees the names of their direct reports and their invitation status.

Login data: the login service stores login sessions, including IP address and browser details, to ensure information security.

3.2 Wellbeing data (Wellspot as controller)

Data:

• your answers to the onboarding survey and the baseline calculated from them
• your answers to the weekly survey and theme scores (stress, sleep, mood, vitality, lifestyle, financial security, belonging, meaningfulness)
• micro-actions and how you say they made you feel (better, same, worse)
• steps, level and answer streak
• consent history: when you gave, refused or withdrew consent and which text version it was based on (no IP address)

Some of this data may reveal information about your health, so it is processed as special category data under Article 9 GDPR.

Legal basis: your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR). Consent is voluntary. Without it, you can still use the self-care content and book appointments. We keep the consent history so that we can demonstrate that consent was valid (Articles 7(1) and 6(1)(c) GDPR).

Purpose:

• to show you how your wellbeing develops
• to suggest suitable micro-actions based on your answers
• to send notifications when the weekly survey opens, and reminders
• to produce group-level summaries with at least five respondents for your employer
• to calculate the team alert level (section 4)

3.3 Bookings and session feedback (Wellspot as controller)

Wellspot arranges appointments with independent short-term therapists.

Data: time of the booking, therapist, status (confirmed, cancelled, completed), any cancellation reason, video meeting link, your feedback after the session (rating and themes) and extra session requests (requester, year, request date, status).

Legal basis: your explicit consent, which you give when booking through a separate choice (Articles 6(1)(a) and 9(2)(a) GDPR). Booking consent is separate from wellbeing consent.

Who can see it:

• You and the therapist you booked. The therapist sees the time of the booking and a client code, not your name or email.
• In the video meeting, the name you type in the meeting lobby yourself is shown.
• The therapist only sees a summary of feedback once there are at least five responses.

Video meetings: in the Whereby service (wellspot.whereby.com). Meetings are not recorded. The therapist does not record session content in the service.

Emails: you receive booking-related messages at your work email. Message subject lines do not mention therapy, but the content may reveal that you use the booking service.

3.4 Pulse survey (your employer as controller)

The pulse survey is your employer's workplace wellbeing survey on work-related strain factors, and Wellspot runs it on your employer's behalf. Your employer states the legal basis in its own privacy notice.

• Answering is voluntary.
• Your name or user identifier is not stored with your answers. Only team, location and response week are attached to an answer.
• The fact that you have answered is kept only while the survey is open, to prevent duplicate answers.
• Do not write information about your health, or information that could identify you or someone else, in free-text answers.
• Wellspot's administrators cannot see individual answers. The service only shows summaries of answers with at least five respondents.
• The pulse survey is not covered by wellbeing consent, and Wellspot does not use the answers for its own purposes.

3.5 Therapists (Wellspot as controller)

Data: name, email, phone, education, introduction, photo, working languages and areas of expertise, availability and schedule, fee and invoicing details.

Legal basis: contract with the therapist (Article 6(1)(b) GDPR) and bookkeeping obligation (6(1)(c)).

Who can see it: an approved therapist's profile (name, introduction, photo, languages, areas of expertise) is visible to logged-in users of the service. The profile photo is in public storage and can be opened via a direct address. Phone, education, email and fee details are visible only to the therapist and Wellspot.

3.6 Therapist applicants (Wellspot as controller)

Data: name, email, phone, education and professional title, years of experience, working languages, areas of expertise, introduction, fee request, estimated weekly availability, photo, submission time, and the time you confirmed that you had read this notice.

Source: from you, through the application form at wellspot.fi/terapeuteille.

Purpose: processing the application and creating a therapist profile for an approved applicant.

Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).

Photo: processed on upload so that its metadata, including location data, is removed. During the application stage the photo is in closed storage and only Wellspot's administrators can see it. The photo is published to users of the service only if the application is approved.

Abuse prevention: the application form processes an identifier calculated from the IP address and email address, from which the original data cannot be recovered without Wellspot's secret key. The identifier is deleted after 24 hours.

3.7 Contact persons at customer companies and people who contact us (Wellspot as controller)

Data: name, work email, phone, organisation and role, content of communications and contracts.

Legal basis: preparing and performing a contract (6(1)(b)) or Wellspot's legitimate interest in managing customer relationships and responding to enquiries (6(1)(f)).

3.8 Visitors to wellspot.fi

wellspot.fi does not use cookies, analytics or advertising tracking. With every request, the hosting environment processes the IP address, browser identifier and requested page to deliver the service and ensure information security (legitimate interest, 6(1)(f)).

4. What your employer sees

For wellbeing data and bookings, your employer only sees group-level summaries of at least five people. If a group has fewer than five people, no data is shown.

Team alert: the level is calculated if the team's average answers have clearly declined over the last eight weeks compared with the previous eight weeks. The level is only calculated when the team has at least five respondents in both periods, and the manager's own answers are not included in their team's level. A manager sees their own team's level. The HR view is off by default, and your employer only enables it after informing staff.

If you are a manager: your team's alert level is also information about you, because it is shown under your name. Wellspot calculates the level and discloses it to your employer as part of the agreed service (Article 6(1)(f) GDPR).

5. Retention periods

Deletions are carried out automatically by a daily job unless the table states otherwise.

Pseudonymisation: when your account is deleted or bookings expire, the user identifier attached to the data is replaced with a random identifier that cannot be linked to your name, email or user account. Free-text content and meeting links are deleted. The rows are kept so that organisation statistics and therapist invoicing remain correct. Pseudonymised data is still personal data and is protected in the same way.

When your user account is deleted, your name, email and login identifier are deleted, your future bookings are cancelled, and other data is pseudonymised as described above. Your employer's statistics are also calculated from pseudonymised data, so they do not change because an account is deleted. Deleting the account when employment ends is your employer's responsibility.

6. Recipients, processors and transfers

Data is not sold or disclosed for marketing. The following service providers process data on our behalf under a contract.

Data is stored and processed in the EU. Some service providers are US companies whose staff may, in exceptional cases such as technical support, access data from outside the EU. The Data Privacy Framework is based on a European Commission adequacy decision, and standard contractual clauses are contract terms approved by the Commission.

Your employer receives the user account data and the summaries described in section 4. The therapist receives booking data as described in section 3.3.

7. Your rights

You have the right to:

• access and port your data: download your own data in a machine-readable format from the service settings (My data).
• withdraw your consent at any time in the settings. Your wellbeing data is deleted immediately. You can withdraw booking consent separately, in which case your future bookings are cancelled and past bookings are no longer linked to you. Withdrawal does not affect the lawfulness of processing carried out before it.
• request rectification or erasure: using the request form in the service. Requests concerning the user account are handled by your employer.
• request restriction of processing and object to processing based on legitimate interest.
• lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, tietosuoja.fi.

Requests concerning wellbeing data, bookings, therapists and therapist applications are handled by Wellspot: tietosuoja@wellspot.fi or the request form in the service. Your employer does not see these requests. We respond within one month.

8. Automated processing, security, cookies and changes

Automated personalisation: the service selects micro-actions automatically based on your theme scores. This has no legal effects or other similarly significant effects on you, and it is not automated decision-making within the meaning of Article 22 GDPR. You can turn off micro-actions in the settings.

Information security:

• Connections are encrypted (TLS), and the database is encrypted at rest.
• Access to data is restricted by role at database level. Employer views only receive summaries of at least five people for wellbeing and booking data.
• Free-text pulse survey answers are additionally encrypted at application level.
• The service's event log (e.g. logins, invitations, bookings, deletions and administrative actions) contains user identifiers but no names, email addresses or IP addresses. It is kept for 12 months.
• The login service (Supabase Auth) keeps its own event log containing IP addresses. The log is kept by the service provider for up to 7 days and is not stored in Wellspot's database.
• The hosting environment's (Vercel) request logs contain IP addresses, and in error situations a user or booking identifier may be recorded in them. The logs are kept for up to 1 day.
• The email service (Resend) keeps recipients and content of sent messages in its own log. The log is kept for 30 days.
• Approved therapists' profile photos are in public storage and can be opened via a direct address without logging in.

Cookies: wellspot.fi does not use cookies. The app app.wellspot.fi only uses cookies that are strictly necessary for it to work. The video meeting opens on Whereby's site, which uses its own cookies.

Changes: we update this notice when processing changes. We will inform you of material changes in the service. If a change concerns the processing of wellbeing data or bookings, we will ask for your consent again.