Wave asks you to trust it with how you sleep, what you eat, what your blood says and how you feel. So it is built and run to HIPAA-aligned standards, encrypted in transit and at rest, stored on Cloudflare, and never disclosed to anyone, for any reason.
We never sell, share, license, rent or disclose your data to anyone, for any reason. Not to advertisers, not to data brokers, not to a device maker, not to a "partner". It belongs to you, and there is no version of this app where your record is the product.
We run Wave to the safeguards HIPAA asks of a medical practice: encryption in transit and at rest, access limited to the systems that serve you, every access to your record logged, and a session that lives only on your own device and is revoked the moment you sign out.
Your record is stored on Cloudflare, the security company that protects roughly a fifth of the web, on infrastructure independently certified to SOC 2 Type II, ISO 27001 and FedRAMP. Built and run by Wave Agency, an American company founded in New York in 2001.
Ask and we send you everything Wave holds about you, within 30 days. Delete your account from inside the app and it goes: your readings, your scans, your labs, your photos. No trackers, no advertising identifier, no analytics SDK, no third-party script anywhere in the app.
Wave stores your record on Cloudflare, under an account only you sign into, encrypted in transit and at rest. The people who operate the service can reach the database to run it, every such access is logged, and nobody reads your record to sell you something, because it is not for sale.
Wave Wellness is a wellness app, not a medical practice, so HIPAA does not apply to it by law. We run it to HIPAA-aligned standards anyway: the same class of safeguards, applied by choice, because the promise above is stronger than the law requires and we would rather be held to it.
Questions, requests and complaints go through the contact form or by post to Wave Agency, 200 Broadhollow Road, Suite 207, Melville, NY 11747.
Anything else? Send us a message and a real person answers.
HIPAA is a law for covered entities, such as doctors, hospitals and health plans, and the companies working for them. Wave Wellness is a consumer wellness app you use for yourself, not a covered entity, so HIPAA does not apply to it and we do not claim to be HIPAA compliant. We run it to HIPAA-aligned safeguards anyway, by choice: encryption in transit and at rest, access limited to the systems that serve you, every access to your record written to a log, sign-in by one-time code with no password to steal, and your data never sold, shared or disclosed.
No. We never sell, share, license or disclose your data to anyone, for any reason: not advertisers, not data brokers, not device makers. Where the app shows an ad, the advertiser gets a count of impressions and taps and nothing about who saw it.
On Cloudflare, the security company that protects roughly a fifth of the web, on infrastructure independently certified to SOC 2 Type II, ISO 27001 and FedRAMP, encrypted in transit and at rest. The service is built and run by Wave Agency, an American company founded in New York in 2001.
From inside the app: open your profile and choose Delete my account. Your readings, scans, labs, photos, journal, connections and sign-in tokens go with it. You can also ask us to do it for you through the contact form.
Yes. Ask through the contact form, from the email address on your account, and we send you everything Wave holds about you within 30 days. There is no export button in the app yet.
Only for the feature you are using, and only with your permission. Wave AI, powered by Claude from Anthropic, answers in Ask, turns what you say or type into entries, and reads a lab sheet, a meal photo or a supplement label you hand it. Anthropic does not use it to train its models. You can see what Wave AI remembers about your usuals in your profile and forget any of it, Ask keeps no transcript, and your journal is never sent to a model at all.
Last updated 22 October 2026. This policy covers the wavewellness.app website, the early-access waitlist, and the Wave Wellness app for iPhone, Apple Watch, iPad and the web, and for Android when it arrives in November. Wave Wellness is operated by Wave Agency ("we"), 200 Broadhollow Road, Suite 207, Melville, NY 11747.
If you connect Apple Health, the app reads the measurements you allow, such as steps, sleep, heart rate, heart-rate variability and workouts, so it can show them to you and compute your scores. It never writes to Apple Health. Data read from Apple Health is never used for advertising or marketing, never sold, and never shared with anyone for their own purposes. It is stored with the rest of your record and deleted with your account. You can change what the app may read at any time in the Health app's settings. Health Connect on Android, when the app supports it, follows the same rules.
If you connect a WHOOP, you approve it on WHOOP's own page, and the app then reads daily summaries through WHOOP's API: recovery, heart-rate variability, resting heart rate, blood oxygen, skin temperature, respiratory rate, strain, sleep and its stages, and workouts. It reads nothing second by second and never reads location. The same rules as Apple Health apply: never used for advertising, never sold, deleted with your account. Disconnecting in the app deletes our access to your WHOOP at once.
To run the app and show you your own data; to compute the scores, ages and insights the app exists for; to send sign-in codes, the reminders you turn on, and occasional product news you can stop with one click; to answer you when you write to us; and to keep the service secure. We do not use your health data to target advertising, and we do not build advertising profiles. If you choose ad interests in Settings, those choices, and only those, decide which sponsored spots come first; nothing is hidden either way, and you can change or clear them any time.
We never sell your personal or health data. We never share it with advertisers, data brokers, device makers or any third party for their own purposes. Where the app shows an advertisement, the advertiser receives a count of impressions and taps and nothing about who saw it.
Wave Wellness is built and operated to HIPAA-aligned standards. Your data is encrypted in transit (TLS) and at rest, stored on Cloudflare, Inc. infrastructure that is independently certified to SOC 2 Type II, ISO 27001 and FedRAMP. There are no passwords to steal: you sign in with a one-time code, and sign-in codes and session tokens are stored only as salted hashes. Access to your record is limited to the systems that serve it to you, and every access is written to an append-only log. Wave Wellness is operated by Wave Agency, an American company founded in New York in 2001.
You. We never sell, share, license or disclose your data to anyone, for any reason. Sign-in emails and notifications are delivered through Cloudflare's email and push services and the Apple and Google notification services. Some features use Wave AI, which is powered by Claude from Anthropic: answers in Ask, turning what you say or type into entries to check (sets, meals, supplements, sleep), reading a lab sheet you photograph or upload, reading a meal photo or a supplement label, and comparing SmileScan photos. When you speak, your phone turns your voice into text on the device where it can; we receive the text, never the audio. The app asks your permission before any of these is used, you can turn it off at any time in the app, and only what that feature needs is sent. Anthropic processes it to return the answer to you and does not use it to train its models. These providers process data on our behalf, under our instructions and under contract, and none of them may use it for anything else. No one else has access. The only thing that could ever compel a disclosure is a valid United States legal order, and we would tell you unless the law forbade it.
For as long as you have an account, and for up to 30 days after you ask us to delete it, so the deletion can be confirmed and completed. Waitlist and contact records are kept until you ask us to remove them.
You can delete your account and everything under it yourself, inside the app. You can also ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it, through the contact form, from the email address on your account. We answer within 30 days. You can disconnect any device, turn off any notification and unsubscribe from any email inside the app or from the email itself. If you are in a place whose law gives you further rights, such as the EU, the UK or California, you have them, and the same address is where to exercise them.
Wave Wellness is for adults. We do not knowingly collect data from anyone under 18, and we delete it if we learn we have.
This site sets no advertising cookies and carries no advertising trackers. It does use Google Analytics, and only that, so we can see which pages people read and whether the site is working: page views, rough location by country or region, and which site or search sent you. It is not linked to anything in the app, and nobody is identified by it. You can opt out of Google Analytics on every site you visit with Google’s own browser add-on. The waitlist and contact forms store what you submit, with your IP address and browser identifier for abuse prevention only.
If this policy changes in a way that matters, we say so in the app and by email before it takes effect. The date at the top is the date of the current version.
Wave Agency, 200 Broadhollow Road, Suite 207, Melville, NY 11747. Contact form.
