Effective as of August 19, 2026
1. About Wellstep
Wellstep is owned and operated by Wellstep AB, reg. no. 559322-5187, Göteborgsvägen 46, 431 37 Mölndal, SWEDEN.
Wellstep provides digital services in the areas of wellness, health, and employee engagement to companies and organizations, including health challenges, the Wellstep365 subscription, and the Wellstep Engage add-on.
2. General Information on the Concepts
Personal data is information that, either on its own or in combination with other data, can be used to identify, locate, or contact a living individual. This may include, for example, a name, phone number, and email address.
Processing of personal data means all the ways in which personal data is handled, the collection, analysis and storage of personal data.
A data controller is an organisation that determines for what purposes personal data is processed and how it is processed. A data processor is anybody who processes personal data on behalf of a controller.
3. Wellstep’s Two Roles
Wellstep has two different roles, depending on the nature of the task. It’s important to distinguish between them, as this determines who you should contact with your questions.
Wellstep is the data controller for personal data collected through interactions between Wellstep and our customers and stakeholders. This includes, for example, visitors to our website, individuals who place an order or request a demo, customer contacts and administrators, as well as data related to billing. This processing is described in Section 4.
Wellstep acts as a data processor for the personal data processed within the service on behalf of our client—that is, your employer or organization. This includes information about participants and users, activity and health data, survey responses, and messages. In this context, your employer is the data controller and has determined that the service should be used and for what purpose. This processing is described in Section 5.
Are you participating in a program through your employer? In that case, your employer is the data controller. Questions about why a survey or challenge is being conducted, how the results are used, and who within the organization has access to them should be directed to your employer. Wellstep processes the data in accordance with the employer’s instructions and under the applicable data processor agreement. You can always contact us at support@wellstep.se, but we may need to refer certain inquiries to your employer.
4. When Wellstep is the data controller
4.1 Ordering a Service
When an order is placed through the website or by other means, the following information may be stored regarding the contact person(s) who placed the order:
- Name
- Email address
- Phone number
- Company name
- Shipping and Billing Address
Purpose: To process the order, set up the service, handle billing, and maintain effective communication throughout the term of the agreement. When ordering a pedometer, your name, email address, and phone number will be provided to the shipping company handling the delivery.
Legal basis: Performance of a contract, as well as a legal obligation regarding data required under the Accounting Act.
Retention period: 24 months from the date of the most recent order. Documents subject to the Accounting Act are retained for as long as required by law.
4.2 Request for a demo or trial account
When a request for a demo or trial account is submitted via the form on the website, by email, or by phone, the following information is stored:
- Name
- Company name
- Email address
- Phone number
Purpose: To provide access to a demo environment or test account, provide feedback on the requested services, and send information and offers regarding them.
Legal basis: Legitimate interest in being able to respond to inquiries and market our services to those who have expressed interest in them. You may unsubscribe from our mailings at any time.
Retention period: 12 months.
4.3 Contact via email, form, or chat
When you contact us, the following information is stored:
- Name
- Contact information, such as email address and phone number
- The content of your inquiry
Purpose: To process and respond to your inquiry.
Legal basis: Legitimate interest in being able to communicate with those who contact us.
Retention period: 12 months.
4.4 Visits to the Website
When you visit www.wellstep.se, data is processed using cookies and similar technologies; see Section 6.
Legal basis: Consent for non-essential cookies. Essential cookies are processed based on legitimate interest.
4.5 Marketing
Wellstep sends information and offers to people who have contacted us through our website, ordered services, or otherwise shown interest in our offerings. We do not send marketing materials to participants and end users of our services.
Legal basis: Legitimate interest. Each mailing includes an option to unsubscribe.
5. When Wellstep Acts as a Data Processor
Wellstep processes the following data on behalf of the customer. The customer is the data controller and determines the purposes and legal basis for the processing. The processing is governed by the data processing agreement, which forms part of the agreement between Wellstep and the customer.
5.1 Information about Participants and Users
- Name and email address
- Phone number, when the service is used for SMS messaging
- Login Information
- Any division by law, department, or segment
The service displays participants’ names to other participants, for example, in results lists. Participants have the option to remain anonymous. Email addresses are not displayed to other participants, with the exception of the customer’s administrators.
5.2 Activity and Health Data
The following topics are covered in health challenges and in Wellstep365:
- Steps and registered activities
- Other activity data that the participant enters into the service themselves
The data can be entered manually in the app or retrieved automatically from a health service on your device, such as Apple Health (HealthKit) on iOS or Health Connect on Android.
This data is collected only if you manually enable the connection and grant access in your device’s settings. Wellstep collects only step data. You can revoke access at any time in your device’s settings. The data is used only within the service and is never shared for marketing purposes or with ad networks.
Activity and health data constitute health information. The processing is carried out on behalf of your employer, who is responsible for ensuring that there is a valid basis for it. Participation in health challenges is voluntary.
5.3 Surveys, Pulse Surveys, and Messages in Wellstep Engage
Engage covers the following topics:
- Survey Responses and Results
- Messages and comments sent using the service’s chat and messaging features
- Information about which surveys a user has been assigned and has completed
Pulse surveys and eNPS are always anonymous. The employer cannot link the responses to any individual employee. Results are displayed only in aggregate form, and only after the required number of responses for a segment has been reached. Neither administrators, managers, nor anyone else at the employer can see how an individual has responded—there is no way to opt out or circumvent this.
Customers can choose to make customized surveys anonymous or identifiable, depending on the purpose of the survey. You will be informed of which option applies before you answer the survey.
5.4 Mailings and Notices
Surveys, invitations, and reminders are sent via email, text message, or push notifications to the app, depending on the customer’s choice and the user’s settings. Users can adjust their communication preferences within the service.
5.5 Storage and Deletion
Data collected as part of the service is processed for as long as the customer’s agreement with Wellstep remains in effect.
For individual health challenges, participant data is deleted no later than 12 months after the challenge’s end date, unless otherwise agreed upon with the customer.
When a customer agreement terminates, the customer’s data is deleted in accordance with the provisions of the General Terms and Conditions and the Data Processor Agreement, unless otherwise agreed in writing or longer retention is required by law.
6. Cookies and Web Analytics
The website www.wellstep.se uses cookies and similar technologies, both to ensure the website functions properly and to measure and analyze how it is used.
When you visit the website, you’ll have the option to choose which categories of cookies you accept. Your selection is managed through our consent tool and can be changed at any time via the cookie settings on the website. Essential cookies are required for basic functionality and cannot be opted out of.
Logging in to the service, via a web browser or app, uses cookies and similar technologies that are necessary to keep you logged in and to ensure the service functions properly.
7. Where is the data stored?
Data processed by the service is stored on servers within the EU.
For certain functions, we engage service providers that may process data outside the EU/EEA, for example, for the distribution of push notifications and for website analytics. In such cases, we ensure that there is a valid basis for the transfer in accordance with the General Data Protection Regulation (GDPR), such as the European Commission’s Standard Contractual Clauses or a decision on an adequate level of protection.
8. Who Can Access the Data
Wellstep does not sell personal information to third parties.
Information may be disclosed to the service providers engaged to ensure the service functions properly. This includes, among other things, operation and storage, communications via email, text messages, and push notifications, support and customer management systems, website analytics, financial administration, and shipping for the delivery of pedometers. Data processing agreements have been entered into with these service providers to the extent applicable, and customers may, upon request, receive an up-to-date list of the sub-processors engaged for data processing within the service.
9. Data Security
Wellstep has implemented technical and organizational security measures designed to protect the confidentiality and integrity of the data. These measures include, among other things:
- Encryption using Transport Layer Security (TLS) during transmission between your browser or app and our servers
- Storage on secure servers with restricted, on-demand access
- Two-factor authentication for logging in to certain parts of the service offering, including Wellstep Engage
- Ongoing updates and reviews of systems and security procedures
10. Your Rights
When we process your personal data, you have the following rights:
- Right of Access. You have the right to know what personal data we process about you and how we process it.
- Correction. You have the right to have incorrect information corrected.
- Deletion. You have the right to have your data deleted, provided that we do not have the right or obligation to retain it on another legal basis. Please note that you will not be able to participate in a health challenge or use the service if your data is deleted.
- Restriction. You have the right to request that the processing be restricted under certain circumstances, such as while the accuracy of the data is being investigated.
- Objection. You have the right to object to processing based on legitimate interests, and to object to direct marketing at any time.
- Data Portability. You have the right to receive the data you have provided to us in a structured, machine-readable format when the processing is based on a contract or consent.
- Withdraw consent. If the processing is based on your consent, you may withdraw it at any time. This does not affect any processing that took place prior to that.
Please contact us at support@wellstep.se if you wish to exercise any of these rights.
11. Changes to This Policy
Wellstep may update this policy. The most recent version is always available on wellstep.se. In the event of significant changes, we will notify affected customers.
12. Your rights
When we collect and process your personal data, you have certain rights. You have the right to
- Request an extract of the personal data we process and how they are processed;
- Request correction of any inaccurate data;
- Request to be deleted. However, this can only be done unless Wellstep is entitled to retain the data on some other legal basis. Please note that you will not be able to participate in a competition if you request the deletion of your data.
- Request a restriction of processing in certain circumstances, such as in the meantime, a question about the accuracy of the data is being investigated.
If you wish to carry out any of the above, please contact support@wellstep.se.
12. Contact
If you have any questions about how we handle personal information, please feel free to contact us:
Email: support@wellstep.se Address: Wellstep AB, Göteborgsvägen 46, 431 37 Mölndal