Last updated: July 31, 2026
This Privacy Policy explains how Wandercraft S.A.S. and its subsidiaries, affiliates, and any entity managed or controlled by it (“Wandercraft,” “we,” or “our”) collect, use, disclose, store, and otherwise process personal information in connection with your use of Wandercraft’s websites, social media channels, platforms, and applications (the “Platforms”). This Privacy Policy should be read in conjunction with our Terms of Use. In the event of a conflict regarding the processing of personal data, this Privacy Policy shall prevail.
It does not govern the practices of independent third parties, including Apple, Google, mobile network operators, healthcare professionals acting independently of Wandercraft, or other entities to which you navigate from our services, except to the extent that Wandercraft directly controls the processing in question.
The purpose of this Privacy Policy is to clearly inform users about the processing of their personal data and their rights, in accordance with applicable data protection laws and regulations, including, where applicable, the GDPR, the CCPA/CPRA, and HIPAA.
When Wandercraft acts as a “covered entity” as defined by HIPAA, the HIPAA Privacy Notice set forth in Appendix 1 governs Wandercraft’s use and disclosure of protected health information (PHI).
Wandercraft is headquartered at23 avenue d’Italie, 75013 Paris,France, and is the data controller for your personal data. For any questions regarding privacy or to exercise your applicable rights, you can contact us at privacy@wandercraft.health.
We collect personal information, when necessary, through the following channels:
Personal information, or personal data, refers to any information or data that identifies you, either directly or indirectly, or that can be used to identify you.
We may collect the following categories of personal information, depending on the Platform you use.
First and last name, email address, mailing address, phone number, country of residence, date of birth, language spoken.
If you use Apple Sign-In or Google Sign-In, we may receive limited information from these providers related to authentication, such as an email address, a name, or an authentication ID, depending on the provider’s settings and your choices.
The capacity in which you are contacting Wandercraft (for example, as a potential user, a friend or family member of a potential user, or a professional).
IP address, device ID, information about the mobile operating system, app version, crash information, and app logs.
Browser type, operating system, Internet service provider, device language.
Browsing data, personal settings.
Information about your use of the Eve exoskeleton, including the number of steps, time spent standing, time spent walking, weekly and monthly statistics, progress tracking, and the goals you set.
When you interact with Wandercraft via Facebook, Instagram, LinkedIn, Twitter, or other social media platforms, we receive the information you choose to share with us. The privacy policies of these third parties apply.
Information that may be considered special categories of personal data or protected health information under certain state or local laws. This data is handled accordingly.
For example, the health metrics and wellness information you choose to enter or record through our Platforms, including mood, pain, digestion, sleep, and optional free-text wellness notes.
For more information about cookies, please visit Wandercraft's Cookies page.
Eve by Wandercraft and Follow Eve use session cookies solely to store your login credentials:
Unless otherwise specified, Wandercraft does not collect the following through its apps:
For individuals located in the European Economic Area and in other jurisdictions that require a legal basis for processing, we use personal information for the following purposes and on the following legal bases:
When we rely on consent, you may withdraw it at any time. Withdrawal does not affect the processing that was lawfully carried out prior to the withdrawal. Withdrawing consent may also affect our ability to provide certain features.
We may disclose personal information to the following categories of recipients, subject to appropriate contractual and confidentiality obligations:
Cloud providers (for example, AWS for data from the Eve by Wandercraft app) and infrastructure providers
Service providers and subcontractors. They help us host, secure, manage, maintain, analyze, or improve our platforms and applications.
Internal systems and personnel. Authorized Wandercraft personnel and internal analytics environments can access information on a need-to-know basis.
Authorized physicians. For example, we may disclose limited usage data—such as the number of steps, walking time, and time spent standing—to physicians when you approve this access through the Eve Follow access procedure: a physician submits an Eve user’s email address, and that user then receives a confirmation request to approve the physician’s access. Healthcare providers or healthcare organizations that receive information from Eve users are also subject to their own professional, confidentiality, and data protection obligations.
Legal and compliance recipients. For example, regulators, courts, law enforcement agencies, auditors, insurers, or advisors, where required by law, legal process, safety obligations, or the protection of rights and interests.
Parties to corporate transactions. We may disclose information in connection with a merger, acquisition, reorganization, financing, asset sale, or similar transaction, subject to applicable confidentiality and legal requirements.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not allow advertising partners to collect data for their own purposes.
We may de-identify, pseudonymize, or aggregate information for internal analytics, product improvement, usage insights, device support and maintenance, quality management, and strategic analysis. When we do so, we take steps designed to reduce the likelihood that the information can be linked back to an individual.
Where data is de-identified, aggregated, or otherwise rendered non-identifiable in accordance with applicable law, we may use it for lawful business purposes without further notice to you, subject to applicable legal restrictions.
We retain personal information for as long as is reasonably necessary to provide our platforms and applications, maintain your accounts, support the Eve exoskeleton service environment, comply with legal and regulatory obligations, resolve disputes, enforce agreements, and protect security and integrity.
In practice, retention periods depend on the category of information and the purpose for which it was collected. Account information is retained for the duration of your account. Usage data, logs, and analytics may be retained for support, maintenance, security, and product improvement. Wellness data and notes may be retained until you delete them, close your account, or request deletion, unless retention is required by law or needed for legitimate operational, safety, or claims-related reasons. When we no longer need personal information, we will delete, anonymize, or securely isolate it as appropriate.
We use administrative, technical, and organizational safeguards designed to protect personal information. These measures include access controls, authentication safeguards, role-based restrictions, monitoring, and secure hosting practices.
Wandercraft uses healthcare-focused infrastructure controls, including HIPAA-compliant cloud configurations and healthcare-compliant hosting environments, such as HDS (Health Data Hosting or “Hébergeur de données de santé”) where applicable.
No method of transmission or storage is completely secure. While we are committed to protecting your data and take steps to do so, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for promptly notifying us at support@wandercraft.health if you suspect unauthorized access to your account.
Because Wandercraft operates internationally and uses service providers that may operate in multiple jurisdictions, personal information may be processed in countries other than the country in which you reside. When personal information subject to the GDPR is transferred outside the EEA, the UK, or Switzerland, Wandercraft will use a legally recognized transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, along with supplementary measures where appropriate. You may contact us to request additional information about the safeguards relevant to your data.
Certain information processed through the Platforms may qualify as Protected Health Information (PHI) under HIPAA.
HIPAA applies to covered entities, including certain health plans, healthcare clearinghouses, and healthcare providers that conduct standard electronic transactions, as well as their business associates. To the extent that Wandercraft acts as a covered entity or business associate with respect to specific information or activities, Wandercraft will use and disclose applicable PHI as permitted by you or required by HIPAA, including for treatment, payment, healthcare operations, support of the Platforms and exoskeleton service environment, compliance, and other legally permitted purposes.
Where the HIPAA Notice of Privacy Practices applies and conflicts with this Policy regarding PHI, the HIPAA NPP will govern that PHI.
Nothing in this Privacy Policy limits any rights you may have under HIPAA where HIPAA applies, including applicable rights of access.
You have the right to request access to your personal information, obtain a copy of certain information, request the correction of inaccurate data, request deletion, request restriction of processing, object to certain processing, withdraw consent where consent is the basis for processing, and request the portability of data you provided to us where technically feasible.
You also have the right to file a complaint with your local supervisory authority, including the CNIL in France.
Wandercraft does not use personal information to make fully automated individual decisions that significantly affect you.
To the extent that the CCPA/CPRA applies to our processing, California residents may have the right to know what categories of personal information we collect, use, disclose, and retain; request access to specific pieces of personal information under certain circumstances; request correction of inaccurate personal information; request deletion of personal information, subject to exceptions; opt out of the sale or sharing of personal information; and receive non-discriminatory treatment for exercising their privacy rights.
Because Wandercraft does not sell personal information and does not share personal information for cross-context behavioral advertising, we do not currently offer a “Do Not Sell or Share My Personal Information” option. We also do not use personal information for advertising purposes.
If you access our products or services from a jurisdiction other than those mentioned above, your use is governed by this Privacy Policy to the extent permitted by applicable local law. Where local law grants you rights regarding your personal data that are not addressed elsewhere in this Policy—including the rights to access, correct, delete, or object—you may exercise those rights by contacting us at privacy@wandercraft.com. We will respond in accordance with applicable law.
To exercise your privacy rights, please contact privacy@wandercraft.health. We may need to verify your identity before acting on a request. You may also authorize another person to submit certain requests on your behalf where permitted by law, subject to appropriate verification. If we cannot fully comply with a request, we will explain the reasons, subject to legal limitations.
You may request the deletion of your App account and associated personal information using any deletion tools we make available in the App or by contacting support@wandercraft.health if you are unable to access those tools. Please note that deletion may be subject to legal, safety, operational, fraud prevention, claims-handling, or healthcare recordkeeping obligations.
The Platforms are intended solely for adults aged eighteen (18) and older. They are not directed at children, specifically children under thirteen (13), or sixteen (16) in the EU. We do not knowingly collect personal information from children under thirteen. If we learn that a child under thirteen in the U.S. or sixteen in the EU has provided us with personal information, we will take steps to delete that information as required by law.
We may update this Privacy Policy from time to time to reflect changes to our website, platforms, or applications; our data practices; legal requirements; or operational needs.
When we make material changes, we will update the “Last Updated” date and provide additional notice where required or appropriate, such as via email, a website notice, or an in-app notice. Your continued use of our Platforms after the effective date of an updated Privacy Policy is subject to the revised Policy.
If you have questions about this Privacy Policy or would like to exercise your privacy rights, please contact: privacy@wandercraft.health
IMPORTANT: THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
The terms of this Notice of Privacy Practices apply to WANDERCRAFT (WANDERCRAFT) and each of its subsidiaries, affiliates, and all entities managed or controlled by WANDERCRAFT, including the corporate office and its employees. All of these entities will share patients’ personal health information as necessary to carry out treatment, payment, and healthcare operations, as permitted by law. Use or disclosure pursuant to this notice may include the electronic transmission or disclosure of your personal health information.
We are required by law to protect the privacy of our patients’ personal health information and to provide patients with notice of our legal obligations and privacy practices regarding personal health information. We are required to comply with the terms of this notice for as long as it remains in effect. We reserve the right to change the terms of this notice of privacy practices as necessary and to issue a new notice that applies to all personal health information maintained by WANDERCRAFT. Should we make a change, you may obtain a revised copy from the facility providing your care. We are also required to inform you that there may be a provision of state law relating to the privacy of your health information that may be more stringent than a standard or requirement under the Federal Health Insurance Portability and Accountability Act. A copy of any revised notice of privacy practices or information pertaining to a specific state law may be obtained by mailing your request to the Privacy Officer at WANDERCRAFT.
Uses and Disclosures for Treatment: We may use and disclose your personal health information as necessary for your treatment. Physical therapists and other professionals involved in your care will use information in your medical record and information you provide about your symptoms and reactions to your course of treatment, which may include procedures, medications, tests, medical history, etc.
Uses and Disclosures for Payment: We may use and disclose your personal health information as necessary for payment purposes. In the normal course of business, we may forward information regarding your medical procedures and treatment to your insurance company to arrange payment for the services provided to you. We may use your information to prepare a bill to send to you or the person responsible for your payment.
Uses and Disclosures for Health Care Operations: We may disclose your personal health information as necessary and as permitted by law for our health care operations, which may include clinical improvement, professional peer review, business management, accreditation, licensing, etc.
Business Associates: Certain aspects and components of our services are provided through contracts with outside individuals or organizations, such as auditing accreditation results, data collection, legal services, etc. At times, it may be necessary for us to provide your personal health information to one or more of these outside individuals or organizations who assist us with our healthcare operations. In all cases, we require these business associates to appropriately safeguard the privacy of your information.
Appointments and Services: We may contact you to provide appointment reminders or information about your treatment or other health-related benefits and services that may interest you. You have the right to request—and we will accommodate reasonable requests from you—to receive communications regarding your personal health information from us through alternative means or at alternative locations. For example, if you do not want appointment reminders left on voicemail or sent to a specific address, we will accommodate reasonable requests. You have the right to request that we not send you any future marketing materials, and we will make every effort to honor such requests. You may submit requests by sending your name and address to the Privacy Officer at 345 Park Avenue S, New York, NY 10010, or to privacy@wandercraft.health.
Research: In limited circumstances, we may use and disclose your personal health information for research purposes. In all cases where your specific authorization is not obtained, your privacy will be protected by strict confidentiality requirements enforced by an Institutional Review Board, which oversees the research, or by assurances from the researchers that limit their use and disclosure of patient information.
Other Uses and Disclosures: We are permitted and/or required by law to make certain other uses and disclosures of your personal health information without your consent or authorization for the following:
Individuals Involved in Your Care: Unless you object, we may, from time to time, disclose your personal health information to designated family members, friends, and others who are involved in your care or in the payment for your care, in order to facilitate their involvement in caring for you or paying for your care. If you are unavailable, incapacitated, or facing a medical emergency, and we determine that a limited disclosure may be in your best interest, we may share limited personal health information with the individuals involved without your consent. We may also disclose limited personal health information to a public or private entity authorized to assist in disaster relief efforts so that the entity can locate a family member or other individuals who may be involved in some aspect of your care.
Marketing: We must obtain your written consent to use and disclose your personal health information for most marketing purposes.
Sale of Personal Health Information: We must obtain your written authorization for any disclosure of your personal health information that constitutes a sale of personal health information.
Other Uses: Other uses and disclosures of your personal health information not described above will be made only with your written authorization. You may revoke your authorization at any time in writing, except to the extent that we have taken action in reliance on the authorization.
Access to Your Personal Health Information: You have the right to copy and/or review much of the personal health information we maintain on your behalf. All access requests must be made in writing and signed by you or your legal representative. You may obtain a “Patient Access to Health Information Form” from the front desk staff.
Amendments to Your Personal Health Information: You have the right to request in writing that the personal health information we maintain about you be amended or corrected. We are not obligated to make all requested amendments, but we will give each request careful consideration. All amendment requests must be in writing, signed by you or your legal representative, and must state the reasons for the amendment or correction request. If an amendment or correction request is made, we may notify others who work with us if we believe such notification is necessary. You may obtain an “Amendment Request Form” from the front office staff or the person responsible for medical records.
Restrictions on the Use and Disclosure of Your Personal Health Information: You have the right to request restrictions on the use and disclosure of your personal health information for treatment, payment, or healthcare operations. We are not required to agree to your request for a restriction, but we will attempt to accommodate reasonable requests when appropriate. However, we must agree not to disclose your personal health information to your health plan if the disclosure is for payment or healthcare operations and relates to a healthcare item or service that you paid for in full out of pocket. We reserve the right to terminate an agreed-upon restriction if we believe such termination is appropriate. In the event of termination by us, we will notify you. You also have the right to terminate any agreed-upon restriction in writing or orally by sending such a notice of termination to the person responsible for medical records.
Receive Confidential Communications From Us By Alternative Means or at Alternative Locations: You have the right to request that we communicate with you in a certain way or at a certain location. Your request must be in writing and specify how and where you would like to be contacted. We will accommodate all reasonable requests.
Paper Copy: You have the right to obtain a paper copy of this notice from us.
Breaches of Unsecured Personal Health Information: You have the right to be notified if you are affected by a breach of unsecured personal health information.
Workers’ Compensation: For patients whose medical treatment is covered under a state workers’ compensation program, please note the following: The disclosure of your protected health information for the purposes of providing treatment and obtaining payment under the state workers’ compensation program is governed by state workers’ compensation regulations and procedures. Therefore, we are not required to obtain written authorization, as otherwise required by HIPAA, to disclose your PHI for workers’ compensation purposes, nor may you restrict our use or disclosure of your PHI for workers’ compensation purposes. Written consent to use or disclose your PHI may be required under our internal policies and state workers’ compensation program rules in order to process your claims. Failure to provide any required written consent may result in your financial liability for medical services and supplies.
Complaints: If you believe your privacy rights have been violated, you can file a written complaint with the Privacy Officer at WANDERCRAFT, 345 Park Avenue S, New York, NY 10010. You may also file a written complaint with the Secretary of the U.S. Department of Health and Human Services in Washington, D.C., within 180 days of a violation of your rights. There will be no retaliation for filing a complaint.
FOR FURTHER INFORMATION: If you have questions or need further assistance regarding this notice, you may contact the Privacy Officer at privacy@wandercraft.health.
☐ * I agree that Wandercraft may collect, use, and process the health data listed in this form (diagnosis, date of the accident or diagnosis, height, weight, information related to my rehabilitation, and, where applicable, the name of my physician or physical therapist), including disclosure to Wandercraft employees, for the purpose of providing the Eve by Wandercraft app services (helping users view information and manage personal records related to the use of their exoskeleton). This consent/authorization remains valid for the duration of my use of the Eve by Wandercraft app, or until revoked, whichever occurs first. I may withdraw or revoke it at any time by writing to privacy@wandercraft.health, without affecting the lawfulness of processing carried out prior to such withdrawal.
