Legal
Privacy Policy
Last updated: 16 October 2026
1. Who we are
WellAtlas (wellatlas.co) is an independent guide to wellness and longevity destinations. It is operated by Sabine Schmitt, an individual based in Dubai, United Arab Emirates. WellAtlas is not yet a registered company. Until it is, Sabine Schmitt is the controller of your personal data, meaning the person who decides how and why it is used.
- Postal address: PO Box 30751, Central Post Office, Dubai, United Arab Emirates
- Privacy contact: hello@wellatlas.co
If WellAtlas becomes a registered company, we will update this section and tell newsletter subscribers.
2. What this policy covers
This policy explains what personal data we collect through wellatlas.co, why, who handles it for us, how long we keep it, and what rights you have. In short:
- You can browse WellAtlas without giving us any personal data.
- We collect personal data only when you subscribe to the newsletter, submit a review, or use search.
- We never sell your personal data, and we never share it with the destinations we review except as a published review under the name you chose.
- We delete proof-of-visit uploads once your visit is verified.
The destinations listed on WellAtlas have their own privacy policies. If you follow a link to a destination's website and book there, that destination's policy applies, not ours.
3. The newsletter
The WellAtlas Edit is sent through Substack. When you click Subscribe on wellatlas.co, Substack's own page opens and you enter your email address there. Substack stores it and sends the newsletter on our behalf. Nothing from Substack loads on wellatlas.co until you click.
- What is collected: your email address, and the subscription data Substack records, such as sign-up date and whether emails are opened.
- Why: to send you the newsletter you asked for. The legal basis is your consent.
- How long: until you unsubscribe. Every email has an unsubscribe link, and you can also ask us to remove you.
Substack also runs its own platform and account system, so it acts as a separate controller for some of this data. Its use is governed by Substack's privacy policy. If you create a Substack account or read the newsletter on substack.com, Substack's policy applies to that.
4. Reviews
WellAtlas publishes only verified guest reviews. To verify that you visited, the review form asks for some personal data. The form is provided by Airtable and opens on airtable.com. Everything you submit, including uploads, is stored in Airtable, the database we use to run WellAtlas, and Airtable's own privacy terms apply while you are on its form.
| What you give us | Why we need it | How long we keep it |
|---|---|---|
| Name | To verify your visit against your proof, and to contact you | For as long as the review is published, then 12 months |
| Email address | To contact you about your review or verification | For as long as the review is published, then 12 months |
| Proof of visit (upload) | To confirm you stayed or visited | Deleted once your visit is verified, and within 90 days if it cannot be verified |
| Ratings and written review | To publish your review and include it in the WellAtlas Score | For as long as the review is published |
| Display-name choice | To publish the review under the name you choose | For as long as the review is published |
| Marketing opt-in | To record whether you agreed to hear from us | Until you withdraw it |
Proof of visit. A booking confirmation or invoice may contain more than we need. Please cover payment details, booking reference numbers and anything about other guests before uploading. We look at the proof only to confirm the visit, and we do not share it with the destination or anyone else.
Health information. Reviews of clinics, retreats and programmes can touch on health. Please do not include medical conditions, diagnoses or treatment details about yourself or anyone else. If you do include them, by submitting you give explicit consent for us to publish them as part of your review. You can ask us to edit or remove them at any time.
Publication. Your ratings, review text and chosen display name are published on wellatlas.co and are visible to anyone. We never publish your email address or your proof of visit. We do not share reviewer details with the destination being reviewed.
Marketing opt-in. If you tick the box, we may add your email address to The WellAtlas Edit on Substack and section 3 then applies. If you leave it unticked, we use your email only about your review.
The legal basis for verifying and publishing your review is your consent, given when you submit the form. You can withdraw it and ask us to remove your review at any time.
5. Search and the AI destination finder
The search box on wellatlas.co lets you describe what you are looking for in your own words. Your query is sent through Lovable's AI gateway, hosted in the EU, to an OpenAI model running on servers in the United States. The model interprets your query and matches it against WellAtlas listings. The AI providers may use queries only to return results, and may not train their models on them. Only the query text, any filters you set and details of matching destinations are sent. Your IP address, name and email are not.
- What is saved: the query text, how it was interpreted, the destinations recommended, and the date and time. Nothing that identifies you, such as your IP address, is saved with it.
- Rate limiting: your IP address is used briefly, in memory only, to limit how many searches can be made per minute. It is never stored.
- Why: to return results, and to see what readers look for so we can improve the guide and its coverage. The legal basis is our legitimate interest in running and improving the site.
- How long: 90 days, after which searches are deleted.
Please do not type personal details, such as your name or a health condition, into the search box. Anything you type is sent to the AI provider as part of the query.
6. Who handles your data for us
We use a small number of service providers. They process personal data only to provide their service to us.
| Provider | What it does for WellAtlas | Data it handles | Where |
|---|---|---|---|
| Lovable | Hosts the website through a global network of servers, including Cloudflare, and runs the AI gateway | Request data including IP address, in standard server logs; search queries in transit | Global network; AI gateway in the EU |
| Supabase | Database behind the website | Search log (no identifying data); request data including IP address, in standard server logs | Germany (Frankfurt) |
| Airtable | Review form and editorial database | Review submissions, proofs of visit, opt-in records | United States |
| Substack | Newsletter | Subscriber email addresses and subscription data | United States |
| OpenAI, via Lovable | Interprets search queries | Search query text and filters | United States |
| Google Workspace | Messages you send us | Global |
Our hosting providers keep standard server logs, including IP addresses, for security and troubleshooting. The providers decide how long these logs are kept, and we do not use them to identify visitors.
We do not sell personal data, and we do not share it with advertisers or with the destinations we review. We may disclose data if the law requires it.
7. Cookies and analytics
wellatlas.co does not use analytics, advertising pixels or any other tracking tool.
To return you to the same spot when you press Back, the site keeps a note of how far down each page you scrolled in your browser's temporary session storage. It holds nothing about you, is not a cookie, and is cleared when you close the tab.
If you open the review form, it runs on airtable.com, where Airtable may set its own cookies under its privacy policy.
Our hosting provider sets two cookies that the site needs in order to work. Because they are strictly necessary, we do not ask for consent to them:
- __cf_bm, set by Cloudflare to tell visitors from bots and protect the site. It expires after 30 minutes.
- _dpl (or __dpl), which sends your visit to the same version of the site throughout. It identifies the site version, not you.
You can also block or delete cookies in your browser settings.
8. Legal bases and international transfers
We follow the EU and UK General Data Protection Regulation and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Where they differ, we apply the stricter standard.
| Use | Legal basis |
|---|---|
| Sending the newsletter | Your consent |
| Verifying and publishing your review | Your consent |
| Any health information you choose to include in a review | Your explicit consent |
| Marketing emails after the review opt-in | Your consent |
| Logging search queries | Our legitimate interest in running and improving the site |
| Keeping the site secure and working | Our legitimate interest |
Where we rely on consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it.
Transfers. WellAtlas is run from the UAE, and our providers store and process data in the EU and the United States. So if you are in the EU, the UK or elsewhere, your data is transferred outside your country. We use providers that protect transferred data through the EU Standard Contractual Clauses, the EU–US Data Privacy Framework, or equivalent safeguards. You can ask us for details of the safeguard that applies.
9. Your rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you and get a copy
- Correct data that is wrong or incomplete
- Delete your data, including removing a published review
- Restrict or object to our use of it, including use based on legitimate interest
- Port data you gave us, in a common electronic format
- Withdraw consent at any time
How to ask. Email hello@wellatlas.co, or write to the address in section 1. Tell us which right you want to use. We may ask for something that confirms the request comes from you, such as replying from the email address you used. We reply within one month. There is no charge.
To unsubscribe from the newsletter, use the link at the bottom of any email.
Complaints. We would like the chance to sort out a concern first. You also have the right to complain to a data protection authority: in the EU, the authority in your country of residence; in the UK, the Information Commissioner's Office; in the UAE, the UAE Data Office.
10. Children, security and changes
Children. WellAtlas is written for adults. The newsletter and review form are not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will delete it.
Security. Access to WellAtlas data is limited to the people who run it, and our accounts with each provider are protected by strong passwords and two-factor authentication. No system is perfectly secure; if a breach affects your data and puts you at risk, we will tell you and the relevant authority as the law requires.
Changes. We will update this policy when how we handle data changes, for example when WellAtlas becomes a registered company. The date at the top shows the latest version. If a change matters to you, we will tell newsletter subscribers by email.
Contact. Questions about this policy: hello@wellatlas.co.