Privacy Policy

Last updated: 24th of August 2026

1. Introduction

Welcome to WellQuest. This Privacy Policy explains how WellQuest S.r.l. ("WellQuest," "we," "us," or "our") collects, uses and protects personal data when you visit our website, apply to join our practitioner network, act as a referrer ("ambassador"), take part in our editorial and documentary productions, or otherwise interact with us.

We are committed to protecting your privacy and to being transparent about how we handle personal data, in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Italian data protection law. Please read this policy carefully.

This policy replaces any previous privacy policy published by WellQuest and covers all of our current activities.

2. Who We Are (Data Controller)

Data Controller: WellQuest S.r.l.

Registered office: Via Fedele Lampertico 6, 00191 Rome (RM), Italy

Contact for privacy matters: hello@wellquest.media

We have not appointed a Data Protection Officer (DPO), as we are not required to do so under Article 37 GDPR. You may direct any data protection question to the contact above.

3. Who This Policy Applies To

This policy applies to the following groups of people whose data we process:

Website visitors — people who browse our website.

Newsletter subscribers — people who subscribed to our newsletter, whether directly or through an online campaign. The newsletter is currently paused.

Practitioners who apply directly — wellness practitioners who complete our onboarding form to be considered for the WellQuest network.

Practitioners we identify or who are referred to us — practitioners whose contact details we obtain from an ambassador, from another practitioner, or from their own public professional profile, before we have contacted them.

Practitioners included in the Practitioner Index — practitioners who have been assessed and admitted to our curated network.

Ambassadors — individuals who refer practitioners to us.

Hospitality, venue and sponsor contacts — individuals at venues, properties, organisations and prospective sponsors we work with.

Participants in our productions — practitioners and others who take part in our expeditions, events and editorial or documentary content.

Prospective investors — individuals and representatives of organisations we approach in connection with financing the company.

Our membership club is not yet operating. When it launches, this policy will be updated to describe how we process members’ data before any member data is collected.

4. What We Collect, Why, and Our Legal Basis

We only process personal data where we have a lawful basis under Article 6 GDPR. Below we set out, for each activity, the data involved, the purpose, our legal basis, and how long we keep the data.

Newsletter (currently paused)

Data: your name and email address, held on our newsletter platform, Substack.

Status: the newsletter is not active at present. We describe it here because we still hold subscriber lists and may reactivate it.

Purpose: to send newsletters, updates and information about our work.

Legal basis: your consent (Art. 6(1)(a)). Some contacts were originally collected through an online advertising campaign; before we send to those contacts, we will confirm that we have a valid consent to email them, and where we do not, we will ask for it or will not contact them.

Retention: until you unsubscribe or withdraw consent, after which we delete or anonymise the record. You can unsubscribe from any newsletter we send.

Practitioner applications (submitted directly)

Data: your name, contact details, location, professional background, description of the services you offer, availability, pricing, links, and any video you submit. Our form also invites you, optionally, to tell us about the personal path behind your work; if you choose to complete that field and tick the related consent box, it may include information about your health or beliefs, which we process only on the basis of your explicit consent (see Section 5).

Purpose: to assess your application and take steps toward a possible collaboration at your request.

Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b)); and, for anything you provide in the optional personal-path field, your explicit consent (Art. 9(2)(a)).

Retention: if you are not admitted to the network, 5 years from your application, so that we can reconsider you as the network develops; if a collaboration begins, for its duration plus 24 months.

Practitioners we identify or who are referred to us

Data: your name and contact details, and any professional information provided by whoever referred you. We hold these in a separate file and do not add assessments or notes to it until you become an applicant.

Purpose: to evaluate whether to contact you about a possible collaboration.

Legal basis: our legitimate interest in building a curated network (Art. 6(1)(f)). We provide the information required by Article 14 GDPR at the latest when we first contact you (see Section 6).

Retention: 30 days from obtaining your details if we never contact you; 12 months from our last contact if we contact you and you do not respond. If you become an applicant, the retention above applies instead.

Inclusion in the Practitioner Index and introductions to partners

Data: your name, professional contact details, discipline and specialisation, qualifications and certifications, location, availability, pricing, professional references, and the outcome of our assessment.

Purpose: to maintain the WellQuest Practitioner Index and to make your professional profile available to hospitality groups, venues, concierge networks, corporate clients and, in future, members of the WellQuest membership club, so that they may engage you for wellness services. WellQuest earns management fees, commissions or revenue share on engagements arranged through the Index.

Legal basis: our legitimate interest, and yours, in connecting practitioners with clients seeking their services (Art. 6(1)(f)). We consider this within your reasonable expectations, since the purpose of joining is to receive professional opportunities. You may object at any time and we will remove your profile from the Index (see Section 9).

Retention: the duration of your inclusion in the Index plus 24 months.

What we share: only a professional extract relating to your practice. We do not share the personal-path information described in Section 5, we do not share information about your own clients, and we do not sell your data.

Ambassadors

Data: your name, contact details, and the referrals you submit.

Purpose: to manage the referral relationship and follow up on the practitioners you introduce.

Legal basis: pre-contractual measures or legitimate interest (Art. 6(1)(b)/(f)), depending on our relationship with you.

Retention: the duration of the relationship plus 24 months.

Hospitality, venue and sponsor development

Data: the name, professional contact details and role of individuals at properties, venues and prospective sponsors, and our correspondence with them.

Purpose: to develop and manage commercial partnerships.

Legal basis: legitimate interest (Art. 6(1)(f)), or pre-contractual and contractual measures where a relationship begins (Art. 6(1)(b)).

Retention: 24 months from last contact, or the duration of the relationship plus 24 months where one begins.

Editorial, documentary and social content

Data: images, video, voice and interview transcripts of practitioners and others who take part in our expeditions, events and productions, and, where a participant chooses to share it on camera under a separate release, information that may fall within Article 9.

Purpose: to produce and publish documentary and editorial content, atlases and social media content, and to promote it.

Legal basis: a signed image and content release as a contract (Art. 6(1)(b)), together with Articles 96-97 of Law 633/1941; explicit consent for any special-category content shared on camera (Art. 9(2)(a)); and our legitimate interest in promoting and defending our productions (Art. 6(1)(f)).

Retention: published material for as long as the production is exploited; identification data of participants for 10 years for contractual and tax purposes. Participation is governed by a separate release, which contains its own privacy notice.

Fundraising and investor relations

Data: the name, professional contact details and correspondence of prospective investors and their representatives.

Purpose: to identify and approach potential investors in connection with financing the company. This data is kept separate from practitioner data.

Legal basis: legitimate interest (Art. 6(1)(f)).

Retention: the duration of the fundraising process plus 24 months.

Feedback on practitioner engagements

Data: feedback from clients, partners or venues about an engagement carried out by a practitioner in the Index.

Purpose: quality management of the network. We record it as a dated assessment, in operational terms.

Legal basis: legitimate interest in maintaining a curated network (Art. 6(1)(f)).

Retention: as for the practitioner record it relates to.

Website usage and analytics

Data: your IP address, browser type, pages visited, time spent on pages, and similar information.

Purpose: to understand how our website is used and to improve it.

Legal basis: consent for non-essential cookies (Art. 6(1)(a)); legitimate interest for essential, aggregated statistics (Art. 6(1)(f)). See Section 7.

Retention: as set out in our cookie settings.

Direct communications

Data: the messages you send us by email and our replies.

Purpose: to respond to you and manage our relationship.

Legal basis: legitimate interest (Art. 6(1)(f)) or pre-contractual measures (Art. 6(1)(b)).

Retention: for as long as needed to handle your request and for a reasonable period afterward.

Accounting and tax records (where a paid engagement arises)

Data: the data needed to issue and receive invoices and meet our bookkeeping obligations. This concerns only practitioners and others who invoice or are paid, and is held separately from the practitioner network data.

Purpose: to meet our legal accounting and tax obligations.

Legal basis: legal obligation (Art. 6(1)(c)) and contract (Art. 6(1)(b)).

Retention: 10 years, as required by Italian law.

5. Special Categories and Practitioner Profiles

The information practitioners provide describes their professional services and background. It is not information about the health of their clients or patients, and you should not include personal data about your own clients when completing our form.

Separately, our onboarding form includes one optional field inviting you to describe the personal path behind your work. Some practitioners choose to share, in that field, information that reveals their own health history or beliefs. We process that information only where you have given explicit consent by ticking the related box, we keep it separate from the rest of your application, we use it solely to understand and assess your application, and we do not include it in any profile made available to partners, venues, clients or members. You may withdraw that consent at any time by writing to hello@wellquest.media, and the rest of your application is unaffected. If you do not tick the box, we do not use what you wrote there.

We do not otherwise collect special categories of personal data, and our documented instructions to staff and contractors prohibit doing so.

6. Where We Obtain Data About Practitioners We Have Not Yet Contacted

If you are a practitioner who did not contact us directly, we obtained your details either from an ambassador or another practitioner who recommended you, or from your own public professional profile. The responsibility to inform you rests with us as the data controller.

When we first contact you, we will tell you the real source of your details — who referred you, or where we found them — and give you access to this policy. We will also, at that point and separately, tell you that you can object to our processing. You may object at any time and ask us to delete your details; if you ask us to stop, we will, and we will add you to a suppression list so that you are not contacted again.

7. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. We use:

Essential cookies — necessary for the website to function.

Performance / analytics cookies — to understand how visitors use the site.

Targeting / advertising cookies — to show relevant content and measure campaigns.

Non-essential cookies are only set with your consent, which you give through our cookie banner and can withdraw at any time via your browser settings or the banner controls. Blocking some cookies may affect how the website works.

8. Service Providers, Sharing, and International Transfers

Service providers

We rely on the following service providers, each of which acts as our data processor under an agreement meeting the requirements of Article 28 GDPR:

Productivity and storage — Google Workspace (Google Ireland Limited / Google LLC), which we use to collect, store and manage the data described in this policy, including the assistive features made available within it. Our Google Workspace is configured to store data at rest within the European Union.

Website and forms — Squarespace (Squarespace Ireland Limited), which hosts our website and onboarding form.

Content production — providers used to store, edit, transcribe and design our editorial and video content.

Artificial intelligence assistance — business accounts with providers of AI assistants, used under our instructions to support drafting and analysis. Under these business agreements, the providers do not use your data to train their models.

We do not permit our staff or contractors to use personal accounts, personal cloud storage or personal AI accounts to process your data.

Other recipients

We also share data with the following, who act as independent controllers in their own right, not as our processors:

Our accountant — who processes invoicing data to meet statutory tax and accounting obligations.

Our payment institution — Revolut Bank UAB, which processes payment data under its own legal and regulatory obligations.

Our newsletter platform — Substack, which hosts our newsletter and manages its relationship with subscribers under its own terms, and which processes subscriber data on servers in the United States.

Consultants and contractors

Some of the work of assessing practitioners, building the Index, developing partnerships and supporting fundraising is carried out by independent contractors engaged by WellQuest, some located outside the European Economic Area. They act as our data processors, are bound by written instructions and confidentiality obligations, may not engage anyone else without our written consent, and access data only through our approved systems.

When we share data

We do not sell your personal data. We share it only:

with your consent;

with the service providers described above, who process data on our behalf and under our instructions;

with the independent controllers described above, for the purposes stated;

with hospitality groups, venues, concierge networks, corporate clients and members, where you are a practitioner included in the Practitioner Index, for the purpose described in Section 4;

where required to comply with a legal obligation;

to protect our rights, safety or property; and

in connection with a business transfer such as a merger or acquisition.

International transfers

Some of our providers, including Google, may process data on servers outside the European Economic Area (EEA), including in the United States. Some of our contractors access data from outside the EEA, currently from the United Kingdom and Indonesia. These two are not the same in law, and we treat them differently:

United Kingdom — the European Commission has decided that the United Kingdom offers an adequate level of protection, so no further safeguard is required for access from there for as long as that decision remains in force.

Indonesia, and providers in the United States — the transfer is protected by the European Commission’s Standard Contractual Clauses together with supplementary technical and organisational measures — in particular, contractors access data remotely on our EU-hosted systems and do not store it locally — and, where applicable, by the provider’s certification under the EU-U.S. Data Privacy Framework. Our newsletter platform, Substack, also processes subscriber data in the United States under its own terms.

You may request more information about these safeguards, including a copy of the relevant clauses, using the contact details in Section 2.

9. Your Rights

Under the GDPR you have the right to:

Access — obtain a copy of the personal data we hold about you.

Rectification — have inaccurate or incomplete data corrected.

Erasure — ask us to delete your data in certain circumstances.

Restriction — ask us to limit our processing in certain circumstances.

Data portability — receive your data in a structured, commonly used, machine-readable format.

Object — object to processing based on our legitimate interests, including referral-based processing and inclusion of your profile in the Practitioner Index.

Withdraw consent — withdraw consent at any time where we rely on it, without affecting prior processing.

To exercise any of these rights, contact us at hello@wellquest.media. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

10. Data Relating to Minors

Our network and our online services are directed to adults, and we do not knowingly collect personal data from anyone under 18 through our website or onboarding form.

A minor may take part in one of our productions — for example at an event or on an expedition — only where each person holding parental responsibility has signed the relevant image and content release. In that case we do not publish any information falling within Article 9 (such as health data or beliefs) concerning the minor. If you believe a minor has provided us with data outside this process, contact us at hello@wellquest.media and we will delete it.

11. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including access controls, multi-factor authentication, encryption in transit and at rest, and restriction of access to approved systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Please review it periodically.

13. Contact Us

Email: hello@wellquest.media

Address: WellQuest S.r.l., Via Fedele Lampertico 6, 00191 Rome (RM), Italy