Wellspring Privacy Policy

Last updated: September 5, 2026

Wellspring ("the app") helps seniors manage their health — medication reminders, vitals tracking, wellness check-ins, a caregiver network, and an SOS button. This policy describes what information the app collects and how it is used.

Information we collect

• Account information: your name, email address, and phone number, plus a password (stored hashed, never in plain text).
• Health information you enter: medications and schedules, doses taken, vital-sign readings (such as blood pressure, weight, glucose), and wellness check-in responses.
• Caregiver connections: the caregivers you add (their name and the one email address or mobile number you enter for them), their relationship to you, and the emergency-contact designation.

What we do NOT collect

• No location data, contacts, photos, camera, or microphone access.
• No advertising identifiers, no analytics or tracking SDKs, and no sale or sharing of data with data brokers — ever.

How your information is used

Solely to provide the app's features: showing your medications and reminders, charting your vitals, and sharing your status with the caregivers you add. We do not use your data for advertising.

Caregivers

When you add a caregiver, we send a one-time invitation to the email address or mobile number you entered — by email from our own mail account, or by text message through Textbelt, a text-messaging provider that receives only the number and the invitation text. The invitation names you (first name only) and says how to install the app. There is no code to enter: a caregiver who signs up for Wellspring with that same email address or mobile number is connected to you automatically, and you see "joined as your caregiver" in your Reminders.

A connected caregiver can see, read-only: whether you checked in today and the sleep and mood you chose, today's medication doses and whether each was taken, and your latest reading of each type. They cannot see your password, your other caregivers, and they cannot change anything. You can remove a caregiver at any time from your Account screen, which ends their access immediately.

A connected caregiver can choose to receive alerts, each as a text message to their own mobile number (or an email): when you have not checked in by 3 PM in your time zone, and when a medication you log runs down to about five days of supply. Each alert names you (first name only) and, for a missed check-in, your phone number so they can call you; no reading, mood or other health detail is included. Caregivers turn these on or off from their dashboard, and removing a caregiver stops them.

Emergency SOS

When you press SOS and the countdown ends, your phone places a call to your emergency contact from its own dialer, and our server sends that same person one text message (or an email if we only have their email address) saying that you pressed SOS, the time, and your phone number so they can call you back. The message goes only to the one caregiver you flagged for emergencies (or, if none is flagged, the first caregiver with a phone number). No location is collected or shared, and nobody else is contacted. The operator of Wellspring is notified that an SOS was pressed (your name and the time only) so the service can be checked; no health information is included.

Signing in and password reset

If you forget your password, we send a one-time 6-digit code to the email address or mobile number on your account (by text message through Textbelt for a mobile number). The code expires after 15 minutes, works once, and choosing a new password signs out every other device. We never tell anyone whether an email address or number has an account.

Storage and security

Data is stored on our server hosted by Fly.io in San Jose, California (United States) and transmitted only over HTTPS (TLS). We keep periodic backups of the database so your data is not lost if the server fails.

Sharing

Your health information is visible only to you and the caregivers you have explicitly added and who have joined. We do not share data with third parties except the hosting provider that stores it on our behalf and, for text messages only (caregiver invitations, SOS texts, caregiver alerts and password-reset codes), Textbelt, which receives the recipient's mobile number and the text of that one message, nothing else.

Your choices

You may edit or delete medications, vitals, check-ins, and caregiver links in the app at any time. To delete your account and all associated data, use "Delete my account" on the Account screen, or email wellspringseniors@gmail.com and we will delete it for you.

Children

Wellspring is intended for adults and is not directed at children under 13.

Contact

Vihan Bhattacharjee wellspringseniors@gmail.com

Changes

We will update this page and the "last updated" date when this policy changes.