Effective October 17, 2026
Who we are and what this covers
137Foundry LLC owns and operates WellStay and wellstayapp.com. This notice explains how we handle information on our public website and in operating the WellStay service. Organizations using WellStay manage their own resident and staff records and determine the permitted purposes for those records. Their notices and agreements may also apply. For privacy questions, email support@wellstaycare.com or use our contact form.
Information we receive
When you contact us, we receive the name, email address, organization details, and other information you choose to include. When you use the application, we process account and authentication information, authorized organization records, uploaded files, and activity needed to operate the service. These records may contain sensitive personal or health information entered by an authorized organization. Our servers also process technical information such as IP addresses, request details, and security events.
How we use information
We use information to respond to inquiries, provide and support the service, authenticate users, enforce access permissions, maintain records and activity history, deliver requested communications, investigate errors or misuse, and meet applicable contractual or legal obligations. Public inquiries should not include resident records, medical information, passwords, or access credentials.
Cookies and public website tools
WellStay uses cookies for sessions, request security, and optional remembered-device sign-in. Our public website uses Google Tag Manager to manage website measurement tags. Loading these tools sends technical information, such as your IP address and browser request details, to Google. Tags configured through this service may measure visits and interactions with our public website. Google Tag Manager is not installed on our sign-in pages or within the secure WellStay application. Our website integration does not add contact form contents, resident records, or account information to the tracking data layer. Fonts, branding, and presentation assets are hosted with WellStay. See Google’s Privacy Policy for information about Google’s practices.
Contact form spam protection
We use Google reCAPTCHA to help protect our contact form from spam and automated abuse. It assesses browser, device, and interaction signals to evaluate a request. We send the verification token to Google for this check; we do not include your message or contact fields in that verification request. reCAPTCHA may use a necessary cookie for this purpose.
Service providers and disclosures
We use service providers for infrastructure, storage and backups, email, and messaging. They may process the information needed to provide those services. Within the application, records are made available according to the organization’s access permissions and authorized workflows. Information may also be disclosed where required by law or necessary to address fraud, security incidents, or the protection of rights.
SMS privacy
For optional SMS communications, we process the recipient’s mobile number, consent or withdrawal record, message content, and delivery information. We use this information to administer the messaging program and deliver the operational messages the recipient agreed to receive. We do not sell or share mobile numbers, SMS opt-in data, or consent records with third parties or affiliates for their marketing or promotional purposes. Providers that deliver or support the SMS service may process this information solely for that service.
Creating a user or resident record does not itself grant SMS consent. See SMS communications and SMS terms for consent, opt-out, and support details. Delivery requires enabled messaging, recorded consent and any required number verification.
Staff and Resident mobile apps
The WellStay Staff and WellStay Resident apps request device permissions when you use the corresponding feature. You may decline or revoke them in your device settings; features requiring that permission will be unavailable. A device-use notice is available in each app before sign-in.
Microphone and dictation
WellStay’s Dictate control uses on-device speech recognition only, on supported devices and languages. WellStay does not save or upload raw dictation audio or use a cloud fallback. You review the transcript before inserting it into a field; it becomes part of a service record when you save or send that record. Recording stops when canceled, interrupted, or the app enters the background. Your operating system keyboard’s dictation is separate and follows its provider’s settings and policies.
Camera and NFC
Staff can scan medication barcodes or take evidence photos they choose to attach. Attached images are processed as protected organization records. Temporary capture files are cleared after use or sign-out and are not added to the photo library. Residents can scan a property QR code or read a property NFC tag to submit a check-in token. The Resident app does not save QR images or write to NFC tags. These apps do not request access to your contacts or photo library.
Location
Neither app continuously tracks location or requests background location. When staff choose location evidence at visit start or end, coordinates, capture time and accuracy are stored in the organization’s restricted visit record. Resident property and meeting checks transmit a chosen foreground location to verify proximity. Raw check-in coordinates are not retained in those check-in records; the result, method and time are retained, with distance and accuracy in meeting evidence. Nearby meeting search uses the location you choose to find results. Location is used for these service functions, not advertising.
Notifications and device security
If you enable push notifications, WellStay registers your device token and uses Apple or Google’s delivery service to send generic alerts. Protected details remain behind sign-in. Notification previews are controlled by your device settings. We process account, installation and device identifiers, app/build versions, session activity and security events to authenticate access and manage device revocation. These native apps do not include advertising tracking. Optional device permissions are separate from consent to SMS messages.
Retention and protection
We retain information as needed for the service, organizational record requirements, contractual and legal obligations, dispute resolution, and security. Retention depends on the type of record and the applicable organization’s requirements; some histories and backups are retained beyond a record’s active use. Access controls, two-step verification, and security monitoring help protect information. No system can guarantee absolute security.
Your questions and requests
Contact your care organization about access to or correction of records it manages. For account information, account deletion, website inquiries, or other privacy requests, use our contact form. We may need to verify your identity and the authority for a request. Applicable rights and retention restrictions depend on your location and the records involved.
Updates
We may update this notice as the service or its practices change. The effective date above identifies the current version. Material changes will be communicated as required by applicable law or our agreements.
Website inquiries
When you submit our contact form, we collect your name, email address, optional organization and phone number, inquiry reason, and message. We use these details to respond and send you an acknowledgment through our email service provider. Inquiry content is encrypted in our application and retained there for 90 days; correspondence in our support mailbox may be retained as needed to resolve and document your request. Contacting us does not enroll you in marketing or SMS.