1. Who is responsible for your data?
The Welbeo platform is operated by Welbeo — legal entity pending registration, Legal form to be confirmed, at Registered office to be confirmed before commercial launch. For privacy questions or requests, contact .
Depending on the feature, Welbeo may act as a data controller or as a processor on behalf of a practitioner. A practitioner remains responsible for the purposes and means of processing that they determine for their own client relationship. Our Data Processing Agreement describes the processor relationship.
2. Data we process
- Account data: name, email, authentication identifiers, language and account preferences.
- Practitioner and business data: professional profile, services, availability, credentials, public content, business settings and team membership.
- Booking data: client contact details, appointment details, booking status, communications and limited notes where a user or practitioner provides them.
- Payment-related data: payment status and provider identifiers. Card details are handled by the payment provider and are not stored by Welbeo.
- Wellness data: optional goals, activities, mood/check-in information or other user-directed wellness information when those features are used.
- Integration data: authorization tokens and limited calendar, messaging or connected-service data needed to provide an integration.
- Technical and support data: device/browser information, security and operational logs, support messages and diagnostics.
Some booking or wellness information may reveal or permit inferences about health or other sensitive matters. We minimize collection and access to such information and apply additional controls where applicable.
3. Purposes and legal bases
- Provide accounts, bookings and practitioner tools: performance of a contract or steps requested before entering a contract.
- Operate optional wellness or sensitive-data features: the applicable contractual basis and, where required for special-category data, explicit consent or another valid Article 9 GDPR condition.
- Security, fraud prevention and service reliability: our legitimate interests in protecting users and operating a secure service.
- Transactional communications: performance of the service requested by the user or practitioner.
- Marketing: consent or another lawful basis permitted by applicable electronic-communications and data-protection law. Marketing is kept separate from transactional messages.
- Legal and accounting obligations: compliance with applicable law.
4. Recipients and service providers
Access is limited to the relevant user, practitioner/business members with appropriate permissions, authorized Welbeo personnel where needed, and providers required to operate a feature. Depending on enabled features, these may include hosting, database/authentication, email, object storage, calendar, AI, messaging and payment providers.
The current provider register is available on our Subprocessors and service providers page.
5. International transfers
Some providers may process data outside the European Economic Area. Where GDPR transfer rules apply, Welbeo uses an applicable transfer mechanism and contractual safeguards, such as an adequacy decision or Standard Contractual Clauses, and assesses supplementary measures where required. Provider-specific details are maintained in our internal processor and transfer register.
6. Retention
We retain personal data only for as long as needed for the purpose for which it was collected, including service delivery, dispute handling, security, accounting and other legal obligations. Retention periods vary by dataset. Account and practitioner content is generally kept while the account is active, while operational and legal records may be retained for a limited additional period. Backups and security logs follow separate, bounded retention schedules.
Welbeo is formalizing per-dataset retention and automated deletion controls as part of its GDPR operational program. We do not retain data indefinitely merely because storage is available.
7. Your GDPR rights
Subject to the conditions of applicable law, you may request access, rectification, erasure, restriction, portability or object to certain processing. Where processing is based on consent, you may withdraw that consent at any time without affecting processing already carried out lawfully.
Send requests to . We may ask for proportionate information to verify identity when necessary. You also have the right to lodge a complaint with the CNIL, the French data-protection authority, or another competent supervisory authority.
8. Security
Welbeo uses measures appropriate to the nature of the data and risk, including encrypted transport, access controls, tenant isolation, database row-level security, protected secrets, restricted administrative access and additional encryption for selected credentials and private content.
9. Cookies and browser storage
Essential storage may be used for authentication, security and user-requested preferences. Non-essential trackers are not intended to be activated before the required choice has been obtained. See our Cookie policy for details.
10. Changes and contact
We may update this policy when our services, providers or legal obligations change. Material changes will be communicated where appropriate. Privacy questions can be sent to .