Trust & Safety

Is Wellzy HIPAA compliant?

Written by Anthony Tapias, Founder, Wellzy ·Last reviewed June 2026 ·Fact-checked against authoritative sources (see Sources)

Wellzy is a direct-to-consumer wellness app. It is not a HIPAA-covered entity, so HIPAA does not apply to your conversations here, and we don't claim HIPAA certification or SOC 2 attestation. Below is exactly how we protect your information instead.

What HIPAA actually covers

HIPAA is a US law that governs how "covered entities" (like healthcare providers and insurers) and their business associates handle protected health information. Most consumer wellness apps used directly by individuals are not covered entities. That distinction matters, which is why we describe our approach precisely rather than using a blanket "HIPAA compliant" label.

How Wellzy protects your information

The controls we actually use (the Privacy Policy, section 10, has the same list):

Data in transit protected with TLS (1.2 or 1.3), including what is sent to our AI providers
The text of chat messages and replies encrypted in our database (Fernet: AES-128-CBC with HMAC); other stored information, such as memory notes and reflections, protected by access controls but not separately encrypted
Access to user data restricted to authorized staff
No selling of personal data, and no health information shared with advertisers
Account deletion: deactivated right away, permanently deleted about 30 days later

What we do not claim

We do not claim formal HIPAA certification or SOC 2 attestation unless and until we complete those programs. If that changes, we will say so explicitly and publish the details. We would rather be precise than overstate our compliance posture.

Frequently asked questions

Is Wellzy HIPAA certified?

No. There is no official HIPAA certification, and Wellzy is not a HIPAA-covered entity. We describe our actual controls above so you can judge them directly.

Is my data encrypted?

Partly. The text of your chat messages and the AI's replies is encrypted in our database (Fernet, AES-128-CBC with HMAC), and data in transit uses TLS 1.2 or 1.3. Other information, such as memory notes and reflections, is protected by access controls but not separately encrypted.

Can I get a copy of my data or delete it?

Yes. You can ask us for a copy of your data, and you can delete your account at any time. Our Privacy Policy explains how.

Sources

Summary of the HIPAA Privacy Rule— U.S. Department of Health & Human Services (HHS)
Covered Entities and Business Associates— U.S. Department of Health & Human Services (HHS)

Wellzy is not a crisis service. If you are in crisis or thinking about harming yourself, please contact emergency services or a crisis line right away — in the US, call or text 988 (Suicide & Crisis Lifeline), or text HOME to 741741. Wellzy is designed to complement, not replace, licensed mental health care and emergency services.

Start feeling a little lighter — free

Talk to Wellzy's AI for support with anxiety, stress, low mood, and sleep. A free account is all you need to begin — no credit card — and a free tier you can keep using.

Start free chat → Download on the App Store