Privacy Policy for Wellora Smart Service Booking System

Effective Date: July 7, 2026

Wellora ("we," "our," "us," or the "Platform") is committed to protecting the privacy and security of our users. This Privacy Policy explains how we collect, use, process, and safeguard your data when you use the Wellora Mobile Application and Web Portal (collectively, the "System").

The platform operates as a centralized digital Healthcare Services and Management system in Sri Lanka. By downloading, installing, or using the Wellora application, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Information We Collect

Wellora collects and processes different types of information depending on your user role (Client/Relative or Service Provider):

• a. For Clients / Relatives:

  • Personal Identification Data: Full name, mobile phone number, email address, and account password.

  • Loved-One Profiles: Information regarding relatives or loved ones for whom services are booked (essential for overseas clients managing care remotely in Sri Lanka).

  • Service and Booking Preferences: Selected service categories (Medical, Personal Support Workers, Physiotherapy, Nursing, etc.), booking modes (On-site visit or Online consultation), and time slots.

  • Transaction Data: Chosen payment model (Annual Subscription or Pay-Per-Booking), itemized billing breakdown, and digital invoice logs.

• b. For Service Providers (Individual Professionals):

  • Onboarding and Profile Data: Full name, mobile number, email address, password, high-quality profile photo, service areas, and real-time working schedules.

  • Mandatory Verification Documents: National Identity Card (NIC) or Passport copies, professional resumes (CVs), and industry-specific professional certificates (e.g., Sri Lanka Medical Council - SLMC certificates for Doctors, Technical Certifications for Nurses/Physiotherapists/Caregivers).

  • Financial & Earnings Data: Total calculated earnings, and completed booking financial records.

• c. Automatically Collected Data (All Users):

  • Real-Time Geolocation Data: Precise GPS coordinates collected during active bookings to facilitate provider dispatch, live tracking, and geo-fenced operations.

  • Service Evidence Data: On-site verification photos uploaded by providers at the service location (Medical Professionals/Doctors are exempt from image validation checks).

  • System Logs: Timestamps of user login, check-in, check-out, and booking status transformations.

2. How We Use Your Information

We process your personal and professional data strictly to maintain core product functions under the Healthcare Services and Management framework, ensuring operational efficiency and compliance:

• Account & Authentication Management: Creating accounts, restricting duplicate profiles, managing role-based access controls, and facilitating secure password resets via OTP authentication.

• Booking Operations & Smart Dispatch: Using real-time GPS proximity mapping to broadcast and automatically match local service requests to nearby providers using an Uber-style notification system or managing multi-step fallback reassignments.

• Real-Time Tracking & Trust Verification: Enforcing location-based geo-fenced check-in and check-out to record exact arrival/departure times, validating provider presence, and creating immutable audit trails to prevent fraudulent service claims.

• Financial Processing: Executed automated base pricing, platform commission models, processing annual subscriptions, and executing monthly financial payouts.

• Remote Care and Teleconsultation: Automatically generating and distributing third-party video conferencing links (e.g., Google Meet) for secure remote audio/video healthcare consultations.

• Communications: Delivering near real-time transactional push notifications regarding booking statuses and managing a secure in-app text messaging layer (restricted from sharing external personal contact information).

• Reputation Management: Aggregating provider scores based on client-submitted post-service reviews and ratings to guarantee platform quality assurance.

3. Permissions Requested by the App

To ensure complete transparency and functionality, Wellora will prompt you for explicit device-level permissions. These features can be toggled off at any point in device settings, though doing so will degrade core app workflows:

• Location Permission (GPS): Required continuously for providers during active bookings to allow live client tracking, distance pricing calculations, and geo-fenced check-in confirmation. Required for clients to pinpoint booking addresses.

• Storage & Media Permission (Photos/Files): Necessary for Service Providers and Clients to upload profile images, verification documents (such as NIC, SLMC certificates, CVs), and select on-site service verification photos from the device gallery.

• Notification Permission: Essential to deliver instantaneous push alerts regarding emergency dispatches, job assignments, chat updates, payment confirmations, and automated multi-step fallback escalations.

• Microphone & Camera (Audio/Video): Utilized during active third-party virtual telehealth consultation links (Google Meet integrations).

4. Data Sharing and Disclosure

Wellora does not sell, rent, or trade your personal information to third parties. We only share restricted data under the following conditions:

• With Other Users: We share provider profiles, photos, and live GPS locations with clients who book them. We share client names, locations, and service preferences with assigned service providers.

• With Service Providers / Third-Party Vendors: Encrypted communication occurs via trusted third-party providers including cloud infrastructure hosting (AWS/DigitalOcean), certified payment gateways (PayHere), SMS messaging aggregators for OTP processing, and integrated virtual meeting rooms (Google Meet).

• For Legal and Compliance Mandates: We will disclose data if required by Sri Lankan digital payment regulations, data protection standards, or law enforcement audits.

5. Data Security & Storage Architecture

• Encryption Protocols: All operational network communications are encrypted end-to-end using HTTPS secure channels (SSL/TLS). User passwords are secure against unauthorized exposure using industry-standard hashing algorithms (bcrypt). Sensitive verification paperwork is encrypted at rest.

• Immutable Audits: Critical platform operations (bookings, legal updates, check-ins, financial data) are logged in secure, non-editable audit registries to provide compliance and transparency.

• Redundancy and Backups: Automated comprehensive data backups are securely created on a weekly basis, stored in redundancy locations, and retained under a strict 30-day lifecycle window before erasure.

6. User Rights & Data Deletion Flow

Users retain comprehensive sovereignty over their personal data. You may update your profile specifics, available regions, or notification setups directly through the user interface.

If you choose to permanently terminate your account or wish to invoke a complete deletion request for your historical data assets, you can do so by contacting our support desk at tech.ceylonx@gmail.com or by submitting an official request via our Wellora Account Deletion Form.  Upon administrative validation, your account data will be safely removed, unless retaining specified data components is legally mandated for unresolved transaction disputes or compliance logging.

7. Age Restrictions & Target Audience

Wellora is an adult-focused platform designed strictly for users aged 18 and older. The application does not knowingly interact with, market to, or collect personal data points from individuals under the age of 18. If you recognize that a minor has provisioned an unauthorized account or shared personal identifiers with us, please reach out to our administration console immediately so we can enforce immediate data purge protocols.

8. Changes to this Privacy Policy

We reserve the right to revise this document to reflect software upgrades, framework enhancements, or legal iterations. Any shifts in policies will be appended directly to this URL, marked with a freshly stamped Effective Date.

9. Contact Us

For clarifications, privacy feedback, or data governance requests, please connect with our administrative and developer operations via:

• Corporate Entity: Wellora (Pvt) Ltd

• Software Development Partner: CeylonX Corporation (Pvt) Ltd

• Email Communication: tech.ceylonx@gmail.com

• Official Address: Level 37, West Tower, World Trade Center, Colombo 01, Sri Lanka