Last updated: July 31, 2026
This Privacy Policy explains how Wandercraft S.A.S. and its subsidiaries, affiliates, and all entities managed or controlled by it (“Wandercraft,” “we,” “us,” or “our”) collect, use, disclose, store, and otherwise process personal information in connection with your use of Wandercraft’s websites, social media channels, platforms, and applications (the “Platforms”). This Privacy Policy should be read in conjunction with our Terms of Use. In the event of a conflict regarding the processing of personal data, this Privacy Policy shall prevail.
We do not govern the practices of independent third parties, including Apple, Google, mobile network operators, healthcare professionals acting independently of Wandercraft, or other entities you access through our services, except to the extent that Wandercraft directly controls the relevant processing.
The purpose of this Privacy Policy is to provide users with clear information about the processing of their personal data and their rights, in accordance with applicable privacy laws and regulations, including, but not limited to, and where applicable, the GDPR, the CCPA/CPRA, and HIPAA.
When Wandercraft acts as a covered entity under HIPAA, the HIPAA Notice of Privacy Practices set forth in Appendix 1 shall govern Wandercraft’s use and disclosure of protected health information (PHI).
Wandercraft is headquartered at23 avenue d'Italie, 75013 Paris,France, and is the data controller for your personal data. For any privacy-related questions or to exercise your applicable rights, please contact us at privacy@wandercraft.health.
We collect personal information, when necessary, through the following channels:
Personal information or personal data refers to any information or data that, directly or indirectly, identifies you or can be used to identify you.
We may collect the following categories of personal information depending on which Platform you use.
First and last name, email address, mailing address, phone number, country of residence, date of birth, language spoken.
If you use Apple or Google Sign-In, we may receive limited information from those providers related to authentication, such as an email address, a name, or an authentication ID, depending on the provider’s settings and your selections.
In what capacity are you contacting Wandercraft (e.g., potential user, friend or family member of a potential user, professional)?
IP address, device identifier, mobile operating system information, app version, crash information, and app logs.
Browser type, operating system, internet service provider, device language.
Browsing data, personal settings.
Information regarding your use of the Eve exoskeleton, including the number of steps, time spent standing, time spent walking, weekly and monthly analyses, progress tracking, and user-defined goals.
When you interact with Wandercraft via Facebook, Instagram, LinkedIn, Twitter, or other social media platforms, we receive the information you choose to share with us. The privacy policies of those third parties apply.
Information that may be considered a special category of personal data or protected health information under certain state or local laws. Such data is handled accordingly.
For example, the health metrics and wellness information that you choose to enter or record through our Platforms, including mood, pain, digestion, sleep, and optional free-text wellness notes.
For more information about cookies, please visit Wandercraft's cookies page.
Eve by Wandercraft and Follow Eve use session cookies solely to store your login information:
Unless otherwise specified, Wandercraft does not collect the following through its apps:
For individuals located in the European Economic Area and in other jurisdictions that require a legal basis for processing, we use personal information for the following purposes and on the following legal bases:
When we rely on consent, you may withdraw it at any time. Withdrawal will not affect the processing that was lawfully carried out prior to the withdrawal. Withdrawing your consent may also affect our ability to provide certain features.
We may disclose personal information to the following categories of recipients, subject to appropriate contractual and confidentiality obligations:
Cloud service providers (e.g., AWS for data from the Eve by Wandercraft app) and infrastructure providers
Service providers and data processors. They help us host, protect, maintain, support, analyze, or improve our platforms and applications.
Internal systems and personnel. Authorized Wandercraft personnel and internal analytics environments can access the information on a need-to-know basis.
Authorized healthcare providers. For example, we may disclose limited usage data—such as the number of steps, walking time, and time spent standing—to healthcare providers when you approve that access through the Eve Follow access process: a healthcare provider provides the email address of an Eve user, and the Eve user then receives a confirmation request to approve the healthcare provider’s access. Healthcare providers or healthcare organizations that receive information from Eve users are also subject to their own professional, confidentiality, and privacy obligations.
Recipients in legal and regulatory compliance matters. For example, regulatory authorities, courts, law enforcement agencies, auditors, insurers, or advisors, when required by law, legal proceedings, security obligations, or the protection of rights and interests.
Parties to corporate transactions. We may disclose information in connection with a merger, acquisition, reorganization, financing, sale of assets, or similar transaction, subject to applicable legal and confidentiality requirements.
We do not sell personal information. We do not share personal information for behavioral advertising purposes across different contexts. We do not allow advertising partners to collect data for their own purposes.
We may de-identify, pseudonymize, or aggregate information for internal analysis, product improvement, understanding device usage, device support and maintenance, quality management, and strategic analysis. When we do so, we take steps to reduce the likelihood that the information can be re-linked to an individual.
Once the data has been de-identified, aggregated, or has otherwise become non-identifiable in accordance with applicable law, we may use it for legitimate business purposes without needing to notify you again, subject to applicable legal restrictions.
We retain personal information for as long as is reasonably necessary to provide our platforms and applications, maintain your accounts, support the Eve exoskeleton service environment, comply with legal and regulatory obligations, resolve disputes, enforce agreements, and protect security and integrity.
In practice, retention periods depend on the category of information and the purpose for which it was collected. Account information is retained for the entire duration of your account. Usage data, logs, and analytics may be retained for support, maintenance, security, and product improvement purposes. Well-being data and notes may be retained until you delete them, close your account, or request their deletion, unless retention is required by law or is necessary for legitimate operational, security, or claims-related reasons. When we no longer need the personal information, we will delete it, anonymize it, or securely isolate it, as appropriate.
We implement administrative, technical, and organizational safeguards designed to protect personal information. These measures include access controls, authentication safeguards, role-based restrictions, monitoring, and secure hosting practices.
Wandercraft uses healthcare-focused infrastructure controls, including HIPAA-compliant cloud configurations and healthcare-compliant hosting environments, such as Health Data Hosting (HDS) where applicable.
No method of transmission or storage is completely secure. Although we are committed to protecting your data and work to do so, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials and for notifying us immediately at support@wandercraft.health if you suspect that your account has been accessed without authorization.
Since Wandercraft operates internationally and uses service providers that may operate in various jurisdictions, personal information may be processed in countries other than the one in which you reside. When personal information subject to the GDPR is transferred outside the EEA, the United Kingdom, or Switzerland, Wandercraft will use a legally recognized transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, along with supplementary measures where appropriate. You may contact us to request more information about the safeguards applicable to your data.
Certain information processed through the Platforms may be considered Protected Health Information (PHI) under HIPAA.
HIPAA applies to covered entities—including certain health plans, health information clearinghouses, and health care providers that conduct standardized electronic transactions—as well as their business associates. To the extent that Wandercraft acts as a covered entity or business associate with respect to specific information or activities, Wandercraft will use and disclose applicable PHI as authorized by you or required by HIPAA, including for treatment, payment, health care operations, support of the Platforms and the exoskeleton service environment, regulatory compliance, and other legally permitted purposes.
When the HIPAA Notice of Privacy Practices applies and conflicts with this Policy with respect to PHI, that Notice shall prevail with respect to such PHI.
Nothing in this Privacy Policy limits the rights you may have under HIPAA, where applicable, including your rights of access.
You have the right to request access to your personal information, to obtain a copy of certain information, to request the correction of inaccurate data, to request its deletion, to request a restriction on processing, to object to certain processing activities, to withdraw your consent when it is the basis for processing, and to request the portability of the data you have provided to us, when technically possible.
You also have the right to file a complaint with your local data protection authority, including the CNIL in France.
Wandercraft does not use personal information to make fully automated individual decisions that significantly affect you.
To the extent that the CCPA/CPRA applies to our processing, California residents may have the right to know what categories of personal information we collect, use, disclose, and retain; to request access to specific pieces of personal information under certain circumstances; to request the correction of inaccurate personal information; to request the deletion of personal information, subject to exceptions; to object to the sale or sharing of personal information; and to be treated without discrimination for exercising their privacy rights.
Since Wandercraft does not sell personal information or share it for behavioral advertising purposes in various contexts, we do not currently offer a “Do Not Sell or Share My Personal Information” option. We also do not use personal information for advertising purposes.
If you access our products or services from a jurisdiction other than those mentioned above, your use is governed by this Privacy Policy to the extent permitted by applicable local law. Where local law grants you rights regarding your personal data that are not addressed elsewhere in this Policy—including the rights of access, rectification, erasure, or objection—you may exercise those rights by contacting us at privacy@wandercraft.com. We will respond in accordance with applicable law.
To exercise your privacy rights, please contact privacy@wandercraft.health. We may need to verify your identity before processing a request. You may also authorize another person to submit certain requests on your behalf where permitted by law, subject to appropriate verification. If we are unable to fully accommodate a request, we will explain the reasons, subject to legal limitations.
You can request the deletion of your account from the App and any associated personal information using the deletion tools we provide in the App or by contacting support@wandercraft.health if you are unable to access those tools. Please note that deletion may be subject to legal, security, operational, fraud prevention, complaint management, or medical record retention requirements.
The Platforms are intended solely for adults eighteen (18) years of age or older. They are not intended for minors, particularly those under thirteen (13) years of age, or under sixteen (16) years of age in the EU. We do not knowingly collect personal information from children under the age of thirteen. If we become aware that a child under the age of thirteen in the U.S. or sixteen in the EU has provided us with personal information, we will take steps to delete that information as required by law.
We may update this Privacy Policy from time to time to reflect changes to our website, platforms, or applications; our data practices; legal requirements; or operational needs.
When we make substantial changes, we will update the “Last Updated” date and provide additional notice when required or appropriate, such as via email, a notice on the website, or a notice in the app. Your continued use of our Platforms after the effective date of an updated Privacy Policy is subject to the revised Policy.
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact: privacy@wandercraft.health
IMPORTANT: THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE READ IT CAREFULLY.
The provisions of this Privacy Notice apply to WANDERCRAFT (“WANDERCRAFT”) and each of its subsidiaries, affiliates, and all entities managed or controlled by WANDERCRAFT, including its headquarters and employees. All of these entities will share patients’ personal health information to the extent necessary to carry out treatment, payment, and health care operations, within the limits permitted by law. Use or disclosure under this notice may include the electronic transmission or disclosure of your personal health information.
We are required by law to maintain the confidentiality of our patients’ personal health information and to provide them with a notice regarding our legal obligations and privacy practices concerning personal health information. We are required to comply with the terms of this notice as long as it remains in effect. We reserve the right to modify the terms of this Privacy Notice as necessary and to apply the new notice to all personal health information held by WANDERCRAFT. In the event of a change, you may obtain a revised copy at the location where you receive treatment. We are also required to inform you that there may be a provision in state law regarding the privacy of your health information that is stricter than a rule or requirement under the U.S. federal Health Insurance Portability and Accountability Act (HIPAA). You may obtain a copy of any revised Privacy Practices Notice, or information regarding a specific state law, by mailing your request to WANDERCRAFT’s Privacy Officer.
Uses and Disclosures for Treatment: We may use and disclose your personal health information to the extent necessary for your treatment. Physical therapists and other professionals involved in your care will use the information in your medical record, as well as the information you provide about your symptoms and your responses to your treatment, which may include procedures, medications, tests, medical history, etc.
Uses and Disclosures for Payment: We may use and disclose your personal health information as necessary for payment purposes. In the normal course of our business, we may send your insurance company information about your medical procedures and treatment in order to process payment for the services provided to you. We may use your information to prepare a bill addressed to you or to the person responsible for your payment.
Uses and Disclosures for Healthcare Operations: We may disclose your personal health information to the extent necessary and permitted by law for our healthcare operations, which may include clinical improvement, peer review among professionals, administrative management, accreditation, licensing, etc.
Business Associates: Certain aspects and components of our services are provided through contracts with external individuals or organizations, such as the auditing of accreditation results, data collection, legal services, etc. On occasion, it may be necessary for us to disclose your personal health information to one or more of these external individuals or organizations that assist us in our healthcare operations. In all cases, we require these business associates to adequately protect the confidentiality of your information.
Appointments and Services: We may contact you to remind you of your appointments or to provide you with information about your treatment or other health-related services and benefits that may be of interest to you. You have the right to request that communications regarding your personal health information be sent via alternative means or to alternative locations, and we will accommodate reasonable requests. For example, if you prefer that appointment reminders not be left on your voicemail or sent to a specific address, we will accommodate reasonable requests. You have the right to request that we not send you promotional materials in the future, and we will make every effort to honor that request. You may submit these requests by sending your name and address to the Privacy Officer, 345 Park Avenue S, New York, NY 10010, or to privacy@wandercraft.health.
Research: Under limited circumstances, we may use and disclose your personal health information for research purposes. In all cases where your specific authorization is not obtained, your privacy will be protected by the strict confidentiality requirements enforced by an Institutional Review Board (IRB), which oversees the research, or by the researchers’ commitments to limit the use and disclosure of patient information.
Other Uses and Disclosures: The law permits and/or requires us to make other uses and disclosures of your personal health information without your consent or authorization in the following cases:
People Involved in Your Care: Unless you object, we may occasionally disclose your personal health information to designated family members, friends, and other individuals involved in your care or the payment for your care, in order to facilitate their involvement in your care or the payment for such care. If you are unavailable, incapacitated, or in a medical emergency, and we determine that a limited disclosure is in your best interest, we may share limited personal health information with the individuals involved without your consent. We may also disclose limited personal health information to a public or private entity authorized to assist in disaster relief efforts, so that such an entity may locate a family member or other individuals who may be involved in some aspect of your care.
Marketing: We must obtain your written consent to use and disclose your personal health information for most marketing purposes.
Sale of Personal Health Information: We must obtain your written authorization for any disclosure of your personal health information that constitutes a sale of such information.
Other Uses: Any other uses or disclosures of your personal health information not described above will be made only with your written authorization. You may revoke your authorization at any time in writing, except to the extent that we have already acted based on it.
Access to Your Personal Health Information: You have the right to copy and/or review most of the personal health information we maintain on your behalf. All requests for access must be submitted in writing and signed by you or your legal representative. You may request the “Patient Access to Health Information Form” from the reception desk.
Changes to Your Personal Health Information: You have the right to request in writing that we change or correct the personal health information we maintain about you. We are not required to make all requested changes, but we will carefully review each request. All requests for changes must be submitted in writing, signed by you or your legal representative, and state the reasons for the requested change or correction. If a request for amendment or correction is submitted, we may notify others who work with us if we believe such notification is necessary. You may request the “Amendment Request Form” from the reception staff or the person in charge of medical records.
Restrictions on the Use and Disclosure of Your Personal Health Information: You have the right to request restrictions on the use and disclosure of your personal health information for treatment, payment, or health care operations. We are not required to grant your request for a restriction, but we will attempt to accommodate reasonable requests when appropriate. However, we must agree not to disclose your personal health information to your health plan when the disclosure relates to payment or health care operations and concerns a health care item or service for which you have paid in full out of pocket. We reserve the right to terminate an agreed-upon restriction if we determine that such termination is appropriate. If we terminate a restriction, we will notify you. You also have the right to terminate any agreed-upon restriction, either in writing or verbally, by providing such notice of termination to the person responsible for medical records.
Receipt of Confidential Communications Through Alternative Means or at Alternative Locations: You have the right to request that we communicate with you in a specific manner or at a specific location. Your request must be submitted in writing and specify how and where you wish to be contacted. We will accommodate all reasonable requests.
Paper copy: You have the right to obtain a paper copy of this notice from us.
Breaches of the security of unprotected personal health information: You have the right to be notified if you are affected by a breach of the security of unprotected personal health information.
Workers’ Compensation: For patients whose medical treatment is covered by a state workers’ compensation program, please note the following: The disclosure of your protected health information for the purpose of providing treatment and obtaining payment under the state workers’ compensation program is governed by the rules and procedures applicable to that program. Consequently, we are not required to obtain written authorization, as otherwise required by HIPAA, to disclose your protected health information for workers’ compensation purposes, nor may you restrict our use or disclosure of such information for those purposes. In accordance with our internal policies and the rules of the state workers’ compensation program, your written consent may be required for the use or disclosure of your protected health information to process your claims. Failure to provide the required written consent may result in you being financially responsible for medical services and supplies.
Complaints: If you believe your privacy rights have been violated, you may file a written complaint with the Privacy Officer at WANDERCRAFT, 345 Park Avenue S, New York, NY 10010. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services (US Department of Health and Human Services) in Washington, D.C., in writing, within 180 days of the violation of your rights. You will not face retaliation for filing a complaint.
FOR MORE INFORMATION: If you have any questions or need further assistance regarding this notice, please contact the Privacy Officer at privacy@wandercraft.health.
☐ * I agree that Wandercraft may collect, use, and process the health data listed on this form (diagnosis, date of the accident or diagnosis, height, weight, information regarding my rehabilitation, and, if applicable, the name of my doctor or physical therapist), including sharing this information with Wandercraft employees, for the purpose of providing the services of the Eve by Wandercraft app (to help users access information and manage personal records related to the use of their exoskeleton). This consent/authorization remains in effect for as long as I use the Eve by Wandercraft app or until it is revoked, whichever comes first. I may withdraw or revoke this consent at any time by writing to privacy@wandercraft.health, without this affecting the lawfulness of the processing carried out prior to such withdrawal.
