Last updated: July 31, 2026
This Privacy Policy explains how Wandercraft S.A.S., as well as its subsidiaries, affiliates, and all entities it manages or controls (“Wandercraft,” “we,” “us,” or “our”), collect, use, disclose, store, and otherwise process personal data in connection with your use of Wandercraft’s websites, social media accounts, platforms, and applications (the “Platforms”). This Privacy Policy should be read in conjunction with our Terms of Use. In the event of any conflict regarding the processing of personal data, this Privacy Policy shall prevail.
It does not govern the practices of independent third parties, including Apple, Google, mobile carriers, healthcare professionals acting independently of Wandercraft, or other entities to which you navigate from our services, unless Wandercraft directly controls the processing in question.
This Privacy Policy is intended to provide users with clear information about the processing of their personal data and their rights, in accordance with applicable data protection laws and regulations, including, but not limited to, the GDPR, CCPA/CPRA, and HIPAA, as applicable.
To the extent that Wandercraft acts as a “covered entity” under HIPAA, the HIPAA Notice of Privacy Practices in Appendix 1 governs Wandercraft’s use and disclosure of PHI.
Wandercraft is located at 23 avenue d’Italie, 75013 Paris, France, and is the data controller for your personal data. If you have any questions regarding data protection or wish to exercise your rights, you can contact us at privacy@wandercraft.health .
We collect personal data, as necessary, through the following channels:
Personal data refers to any information or data that directly or indirectly identifies you or can be used to identify you.
Depending on the platform used, we may collect the following categories of personal data.
Full name, email address, mailing address, phone number, country of residence, date of birth, language spoken.
If you use Apple or Google to sign in, we may receive limited authentication-related information from these providers, such as an email address, a name, or an authentication ID, depending on the provider's settings and your selections.
In what capacity are you contacting Wandercraft (e.g., as a potential user, as a friend or family member of a potential user, or as a professional)?
IP address, device ID, mobile operating system information, app version, crash information, and application logs.
Browser type, operating system, Internet service provider, device language.
Browsing data, personal settings.
Information about your use of the Eve exoskeleton, including step count, time spent standing, time spent walking, weekly and monthly reports, progress tracking, and goals you've set for yourself.
When you interact with Wandercraft via Facebook, Instagram, LinkedIn, Twitter, or other social media platforms, we receive the information that you consent to share with us. The privacy policies of these third parties apply.
Information that may be considered special categories of personal data or protected health information under certain national or local laws. Such data is handled accordingly.
For example, health indicators and well-being data that you enter or track through our platforms, including mood, pain, digestion, sleep, and optional free-text notes about your well-being.
For more information about cookies, please visit Wandercraft's Cookies page.
Eve by Wandercraft and Follow Eve use session cookies solely to store your login information:
Unless otherwise specified, Wandercraft does not collect the following information through its applications:
For individuals in the European Economic Area and in other jurisdictions that require a legal basis for processing, we use personal data for the following purposes and on the following legal bases:
To the extent that we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out lawfully prior to the withdrawal. Withdrawing your consent may also affect our ability to provide certain features.
We may disclose personal data to the following categories of recipients, subject to appropriate contractual obligations and confidentiality obligations:
Cloud (e.g., AWS for the data from the Eve by Wandercraft app) and infrastructure providers
Service providers and data processors. They assist us with hosting, securing, supporting, maintaining, analyzing, or improving our platforms and applications.
Internal Systems and Personnel. Authorized Wandercraft employees and internal analysis environments may access information in accordance with the principle of necessity.
Authorized Physicians. For example, we may disclose limited usage data—such as the number of steps, walking duration, and standing duration—to physicians if you grant them access through the Eve Follow access process: A physician provides an Eve user’s email address, after which the Eve user receives a confirmation request to approve the physician’s access. Doctors or healthcare facilities that receive information from Eve users are also subject to their own professional obligations, as well as their confidentiality and data protection obligations.
Recipients in the field of legal and compliance matters. For example, regulatory authorities, courts, law enforcement agencies, auditors, insurers, or consultants, to the extent required by law, legal proceedings, security obligations, or to protect rights and interests.
Parties to corporate transactions. We may disclose information in connection with a merger, acquisition, restructuring, financing, sale of assets, or similar transaction, subject to applicable confidentiality and legal requirements.
We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not allow advertising partners to collect data for their own purposes.
We may anonymize, pseudonymize, or aggregate information to use it for internal analysis, product improvement, usage insights, device support and maintenance, quality management, and strategic analysis. In doing so, we take measures designed to reduce the likelihood that the information can be re-identified to a specific individual.
To the extent that data has been anonymized, aggregated, or otherwise made non-identifiable in accordance with applicable law, we may use it for legitimate business purposes without further notice to you, subject to applicable legal restrictions.
We retain personal data for as long as is reasonably necessary to provide our platforms and applications, manage your accounts, support the Eve exoskeleton service environment, comply with legal and regulatory obligations, resolve disputes, enforce agreements, and protect security and integrity.
In practice, retention periods depend on the category of information and the purpose for which it was collected. Account information is retained for the duration of your account. Usage data, logs, and analytics may be retained for support, maintenance, security, and product improvement purposes. Well-being data and notes may be retained until you delete them, close your account, or request their deletion, unless retention is required by law or necessary for legitimate operational, security, or claims-related reasons. When we no longer need personal data, we will delete, anonymize, or securely isolate it, as appropriate.
We implement administrative, technical, and organizational safeguards designed to protect personal data. These measures include access controls, authentication procedures, role-based restrictions, monitoring, and secure hosting practices.
Wandercraft employs healthcare-focused infrastructure controls, including HIPAA-compliant cloud configurations and hosting environments that meet healthcare requirements, including HDS (Health Data Hosting or “Hébergeur de données de santé”), where applicable.
No method of transmission or storage is completely secure. Although we are committed to protecting your data and are working to do so, we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying us immediately at support@wandercraft.health if you suspect unauthorized access to your account.
Since Wandercraft operates internationally and uses service providers that may operate in multiple jurisdictions, personal data may be processed in countries other than your country of residence. If personal data subject to the GDPR is transferred outside the EEA, the United Kingdom, or Switzerland, Wandercraft uses a legally recognized transfer mechanism, such as an adequacy decision or standard contractual clauses, together with supplementary measures where necessary. You may contact us to request further information about the safeguards applicable to your data.
Certain information processed through the platforms may be considered Protected Health Information (PHI) as defined by HIPAA.
HIPAA applies to “covered entities,” including certain health insurance plans, healthcare clearinghouses, and providers that conduct standard electronic transactions, as well as their “business associates.” To the extent that Wandercraft acts as a “covered entity” or “business associate” with respect to certain information or activities, Wandercraft will use and disclose the relevant PHI to the extent you authorize it or as required by HIPAA, including for treatment, payment, health care operations, support of the exoskeleton’s platforms and service environment, compliance, and other legally permissible purposes.
To the extent that the HIPAA Notice of Privacy Practices applies and conflicts with this policy with respect to PHI, the HIPAA NPP shall govern such PHI.
Nothing in this Privacy Policy limits the rights to which you are entitled under HIPAA, to the extent that HIPAA applies, including applicable rights to access your information.
You have the right to request information about your personal data, receive a copy of certain information, request the correction of inaccurate data, request erasure, request restriction of processing, object to certain processing activities, withdraw consent where processing is based on consent, and request the portability of the data you have provided to us, to the extent that this is technically feasible.
You also have the right to file a complaint with your local supervisory authority, including the CNIL in France.
Wandercraft does not use personal data to make fully automated individual decisions that significantly affect you.
To the extent that the CCPA/CPRA applies to our processing activities, California residents may have the right to know what categories of personal information we collect, use, disclose, and retain; to request access to specific personal information under certain circumstances; to request the correction of inaccurate personal information; request the deletion of personal information, subject to exceptions; object to the sale or sharing of personal information; and not be disadvantaged for exercising their privacy rights.
Since Wandercraft does not sell personal data and does not share personal data for cross-context behavioral advertising, we do not currently offer a “Do Not Sell or Share My Personal Information” mechanism. We also do not use personal data for advertising purposes.
If you access our products or services from a jurisdiction other than those listed above, your use is subject to this Privacy Policy to the extent permitted by applicable local law. To the extent that local law grants you rights regarding your personal data that are not addressed elsewhere in this policy—including rights of access, rectification, erasure, or objection—you may exercise these rights by contacting us at privacy@wandercraft.com. We will respond in accordance with applicable law.
To exercise your data protection rights, please contact privacy@wandercraft.health. We may need to verify your identity before we can comply with a request. You may also authorize another person to submit certain requests on your behalf, to the extent permitted by law and subject to appropriate verification. If we are unable to fully comply with a request, we will explain the reasons to you, subject to legal restrictions.
You can request the deletion of your app account and the associated personal data using the deletion features provided within the app or, if you are unable to access these features, by contacting support@wandercraft.health. Please note that deletion may be subject to legal, security-related, operational, fraud prevention, claims-related, or health-related documentation requirements.
The platforms are intended exclusively for adults aged eighteen (18) or older. They are not intended for children, particularly those under thirteen (13) years of age or under sixteen (16) years of age in the EU. We do not knowingly collect personal information from children under the age of thirteen. If we learn that a child under the age of thirteen in the U.S. or under the age of sixteen in the EU has provided us with personal information, we will take steps to delete that information in accordance with legal requirements.
We may update this Privacy Policy from time to time to reflect changes to our website, platforms, or applications; our data processing practices; legal requirements; or operational needs.
In the event of material changes, we will update the “Last Updated” date and will also notify you, as necessary or appropriate, for example via email, a notice on the website, or a notice in the app. Your continued use of our platforms after an updated Privacy Policy takes effect is subject to the revised version.
If you have any questions about this Privacy Policy or would like to exercise your privacy rights, please contact us at: privacy@wandercraft.health
IMPORTANT: THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE READ IT CAREFULLY.
The provisions of this Privacy Notice apply to WANDERCRAFT (“WANDERCRAFT”) and all of its subsidiaries, affiliates, and entities managed or controlled by WANDERCRAFT, including its headquarters and its employees. All of these entities disclose patients’ personal health information to the extent necessary for treatment, payment, and the operation of health care and as permitted by law. The use or disclosure described in this notice may include the electronic transmission or communication of your personal health information.
We are legally required to maintain the confidentiality of our patients’ personal health information and to inform patients about our legal obligations and privacy practices regarding personal health information. We are required to comply with the provisions of this notice as long as it remains in effect. We reserve the right to amend the provisions of this privacy practices notice as necessary and to apply a new notice to all personal health information managed by WANDERCRAFT. In the event of a change, you may obtain a revised version at the location where treatment is provided. We are also required to inform you that there may be state laws governing the protection of your health information that are more stringent than any standard or requirement under the U.S. federal Health Insurance Portability and Accountability Act. You may obtain a copy of a revised Privacy Practices Notice or information regarding a specific state law by sending your request by mail to the Privacy Officer at WANDERCRAFT.
Uses and Disclosures for Treatment: We may use and disclose your personal health information to the extent necessary for your treatment. Physical therapists and other professionals involved in your care use the information in your medical record, as well as the details you provide about your symptoms and your response to treatment; this may include, among other things, procedures, medications, tests, and your medical history.
Uses and Disclosures for Payment: We may use and disclose your personal health information to the extent necessary for payment purposes. In the ordinary course of business, we may provide your insurance company with information about your medical procedures and treatments to facilitate reimbursement for the services provided to you. We may use your information to issue an invoice to you or to the person responsible for payment.
Uses and Disclosures for the Operation of Health Care Services: We may disclose your personal health information to the extent necessary and permitted by law for the operation of our health care services; this may include clinical quality improvement, professional peer review, administrative management, accreditation, licensing, and permits, etc.
Business Associates: Certain aspects and components of our services are provided on a contractual basis by external individuals or organizations, such as the review of accreditation results, data collection, legal services, etc. From time to time, it may be necessary for us to share your personal health information with one or more of these external individuals or organizations that assist us in the operation of our healthcare services. In all cases, we require these business associates to adequately protect the confidentiality of your data.
Appointments and Services: We may contact you to remind you of appointments or to provide you with information about your treatment or other health-related services and offers that may be of interest to you. You have the right to request that we provide you with communications regarding your personal health information through other means or at other locations; we will comply with reasonable requests. For example, if you do not want appointment reminders left on your voicemail or sent to a specific address, we will comply with reasonable requests. You have the right to request that we no longer send you promotional materials in the future, and we will make every effort to comply with this request. You may submit such requests, including your name and address, to the Privacy Officer at 345 Park Avenue S, New York, NY 10010, or to privacy@wandercraft.health.
Research: Under certain, limited circumstances, we may use and disclose your personal health information for research purposes. In all cases where your express consent is not obtained, your privacy is protected by strict confidentiality requirements imposed by an Institutional Review Board overseeing the research, or by obligations on the part of the researchers that restrict their use and disclosure of patient data.
Other Uses and Disclosures: In the following cases, we are permitted and/or required by law to use and disclose your personal health information without your consent or authorization:
Individuals Involved in Your Care: Unless you object, we may from time to time disclose your personal health information to family members, designated friends, and other individuals involved in your care or its payment, in order to facilitate their participation in your care or its payment. If you are unreachable or incapacitated, or if there is a medical emergency and we determine that limited disclosure is in your best interest, we may disclose limited personal health information to such individuals without your consent. We may also disclose limited personal health information to a public or private entity authorized to participate in disaster relief efforts so that the entity can locate a family member or other individuals who may be involved in some aspect of your care.
Marketing: For most marketing purposes, we must obtain your written consent to use and disclose your personal health information.
Sale of Personal Health Information: For any disclosure of your personal health information that constitutes a sale of personal health information, we must obtain your written consent.
Other Uses: Any uses or disclosures of your personal health information other than those described above will be made only with your written consent. You may revoke your consent in writing at any time, except to the extent that we have already acted in reliance on it.
Access to Your Personal Health Information: You have the right to copy and/or view most of the personal health information we maintain about you. All requests for access must be submitted in writing and signed by you or your legal representative. You can obtain the “Patient Access to Health Information Form” from the reception staff.
Changes to Your Personal Health Information: You have the right to request in writing that the personal health information we maintain about you be changed or corrected. We are not obligated to make all requested changes, but we will carefully review each request. All requests for changes must be submitted in writing, signed by you or your legal representative, and state the reasons for the request for change or correction. If a change or correction is requested, we may notify other organizations with which we collaborate if we deem it necessary. You can obtain the “Amendment Request Form” from the reception staff or the person responsible for patient records.
Restrictions on the Use and Disclosure of Your Personal Health Information: You have the right to request restrictions on the use and disclosure of your personal health information for treatment, payment, or health care operations. We are not required to agree to your request for a restriction, but we will make an effort to accommodate reasonable requests where appropriate. However, we must agree not to disclose your personal health information to your health insurance provider if the disclosure relates to payment or the operation of health care and concerns a health care service for which you paid in full out of pocket. We reserve the right to terminate an agreed-upon restriction if we deem it appropriate. If we terminate a restriction, we will notify you. You also have the right to terminate any agreed-upon restriction in writing or verbally by submitting a notice to the person responsible for patient records.
Receiving confidential communications from us through other means or at other locations: You have the right to request that we communicate with you in a specific manner or at a specific location. Your request must be made in writing and must specify how and where you would like to be contacted. We will comply with all reasonable requests.
Paper copy: You have the right to receive a paper copy of this notice from us.
Breaches of the security of unsecured personal health information: You have the right to be notified if you are affected by a breach of the security of unsecured personal health information.
Workers’ Compensation: For patients whose medical treatment is covered by a state workers’ compensation program, the following applies: The disclosure of your protected health information for the purposes of treatment and payment under the state workers’ compensation program is governed by the rules and procedures applicable to that program. Accordingly, we are not required to obtain written authorization, as would otherwise be required under HIPAA, to disclose your PHI for workers’ compensation purposes; nor can you restrict our use or disclosure of your PHI for these purposes. Under our internal policies and the rules of the state workers’ compensation program, written consent may be required for the use or disclosure of your PHI to process your claims. If required written consent is not provided, you may be responsible for paying for medical services and supplies out of pocket.
Complaints: If you believe your privacy rights have been violated, you may file a written complaint with the Privacy Officer at: WANDERCRAFT, 345 Park Avenue S, New York, NY 10010. You may also file a written complaint with the Secretary of the U.S. Department of Health and Human Services in Washington, D.C., within 180 days of the violation of your rights. You will not face any adverse consequences for filing a complaint.
ADDITIONAL INFORMATION: If you have any questions or need further assistance regarding this notice, please contact the Privacy Officer at privacy@wandercraft.health.
☐ * I consent to Wandercraft collecting, using, and processing the health data listed in this form (diagnosis, date of the accident or diagnosis, height, weight, details regarding my rehabilitation, and, if applicable, the name of my doctor or physical therapist), including disclosure to Wandercraft employees, for the purpose of providing the services of the Eve by Wandercraft app (to assist users in viewing information and managing personal records related to their use of the exoskeleton). This consent/authorization is valid for the duration of my use of the Eve by Wandercraft app or until it is revoked, whichever occurs first. I may withdraw or revoke it at any time by sending a notice to privacy@wandercraft.health, without affecting the lawfulness of the processing carried out prior to the revocation.
