Login / Privacy Notice

PRIVACY NOTICE

EFFECTIVE JUNE 23, 2026

For the purpose of this Privacy Notice the following definitions apply:

  • “MedMutual WELL” ‘we’, ‘us’, or ‘our’ means Medical Mutual of Ohio, the company that provides the Program to Members.
  • ‘Program/s’ means the MedMutual WELL wellness and rewards program powered by Vitality, including the Website and Application, tools, content, rewards, and related services made available to Members by the Program Provider.
  • ‘Vitality’ means The Vitality Group, LLC, including its affiliates and group companies, which provides the underlying technology and wellness model that powers the Program. Vitality does not provide the Program directly to Members.
  • ‘Program Provider’ means the employer, scheme, insurer, fund, or other organisation that has contracted with MEDMUTUAL WELL to offer the Program to its eligible Members.
  • ‘Member’, ‘you’, or ‘your’ means an individual who is eligible, through a Program Provider or otherwise, to access and use the Program.

MedMutual WELL’ makes the Program available to you on the website MedMutualWELLPowerofVitality.com (“Website”); and the MedMutual WELL mobile application (“Application”) The Program is provided on Vitality’s platform.

By accessing or using the Programs, you are aware of the collection, receipt, use, disclosure and retention of your information as described in this Privacy Notice and accept the terms of this Privacy Notice and Our Terms of Use.

Should you require that this Privacy Notice be read to you please contact the Customer Care Team on 1-866-953-4187. In terms of the California Privacy Rights Act of 2020 ( the CPRA), if you are a California resident, this notice also constitutes a Notice at Collection.

This Privacy Notice will address the following:

  1. From whom or where is Personal Information collected about me?
  2. What types of Personal Information does the Program collect about me?
  3. Are Special Categories of Personal Information Processed?
  4. How will the Personal Information be used that is collected about me?
  5. How is my Personal Information being protected?
  6. Who can access my Personal Information at MedMutual WELL?
  7. Outside of MedMutual WELL, with whom would my Personal Information be shared?
  8. Does the Program contain links to third-party websites or apps?
  9. Will my Personal Information be sold or use it for Cross Context Behavioral Advertising?
  10. How long will my Personal Information be retained?
  11. How will I know if this Privacy Notice changes?
  12. Will MedMutual WELL communicate with me directly?
  13. I receive the Program in the USA– What are my rights?
  14. Artificial Intelligence (AI) Use & Automated Decision Making
  15. Information for Google Fit Users
  16. Information for Fitbit Users
  17. How can I contact MedMutual WELL with my privacy concerns or inquiries?

1. FROM WHOM OR WHERE IS PERSONAL INFORMATION COLLECTED ABOUT ME?

  • From your Program Provider: As part of your eligibility for the Program, your Program Provider will provide the information necessary to verify your identity when you register for the Program and to manage your account on an ongoing basis. If you do not want MedMutual WELL to receive this information, please contact your Program Provider and ask them to stop sending MedMutual WELL any information about you. Please note that this will make you ineligible to participate in the Program.
  • Directly from You, including from your devices: By engaging with the Program, information linked to you and your interactions with the Program (e.g. your physical activity, reward earning events and redemption, and form submission) will be collected or created by MedMutual WELL. You can also choose to allow certain devices and mobile applications, such as Garmin, to sync data to the Application you use. Once you consent and link your device, 90 days of historical fitness device data will be collected by MedMutual WELL from date of linking. You can delink your device at any time, through the settings menu of the applicable application. Note such action may impact your ability to earn rewards and our ability to administer the Program for your full benefit. Should you wish to no longer use the Program ensure you delink your device.
  • From authorized Third-Party Service Providers on behalf of you or your Program Provider: When you or your Program Provider grant authorization MedMutual WELL may receive information about your participation with Third-Parties Service Providers. The authorization from your Program Provider is based on the service agreement, or related agreement, it has in place with MedMutual WELL.

Additionally, if you engage with MedMutual WELL on a social media platform MedMutual WELL may respond or contact you through the applicable social media platform.

2. WHAT TYPES OF PERSONAL INFORMATION DOES THE PROGRAM COLLECT ABOUT ME?

For the purposes of this Privacy Notice, MedMutual WELL’s definition of Personal Information is any information relating to an identified or identifiable natural person.

The following is a list of the types of information that MedMutual WELL may collect through its Program(s). Please note that the types of information collected about you will depend on the particular Program you are using and the activities in which you participate:

  • Name
  • Gender
  • Address
  • Contact details
  • Date of birth
  • Program enrollment or Program registration date
  • Reporting classifications (e.g. at which branch location you are employed)
  • A unique ID (e.g. your employee ID or SSN)
  • Dependents / Spouse / Partner (if applicable)
  • Eligibility start and end date data (if relevant)
  • Cookies
  • Log data including IP address
  • Answers to questionnaires about your health and well-being
  • Program engagement information
  • Survey responses, commentary, or feedback you give when engaging with the Program otherwise provide to MedMutual WELL
  • Reward partner engagement if authorized
  • Devices’ information such as
    • the type of device
    • operating system
    • data that you have synched, which may include health and fitness related information (which can include physical activity data, body measurements, heart rate data, sleep data, meditation data) and location data if you have consented to this data synching for example where you have consented to data synching from Polar.
  • Details of rewards you have earned and your reward redemptions
  • Limited financial information such as transactions and payment details
  • Health information including biometrics and medical conditions
  • Additional information provided by you through online form submission or by otherwise contacting MedMutual WELL

3. ARE SPECIAL CATEGORIES OF PERSONAL INFORMATION PROCESSED?

MedMutual WELL may receive the below Special Categories of Personal Information from your Program Provider or authorized third parties, or directly from you, depending on the particular Program you are using and the activities in which you participate

  • Health Data including but not limited to: information which includes your answers to questions about your health and well-being; annual biometric screening results; preventative screening proof; vaccination proof; proof of participation in a qualifying event; activity information collected from a personal device; smoking status.

MedMutual WELL receives the above, based on the consent you provided to your Program Provider or authorized third party/ies. If you wish to revoke such consent, please contact your Program Provider or authorized third parties. Please note that such revocation will make you ineligible to participate in the Program. Please redeem your rewards prior to withdrawing your consent.

In relation to Special Categories of Personal Information which you submit to MedMutual WELL on your own, MedMutual WELL may request your consent to process such information. If you wish to revoke such consent, please refer to your rights in terms of section 13, as applicable. Please note that such revocation will make you ineligible to participate in the Program. Please redeem your rewards prior to withdrawing your consent. We do not collect Special Categories of Personal Information without your consent and we will only use such information in accordance with this Privacy Notice.

4. HOW WILL THE PERSONAL INFORMATION BE USED THAT IS COLLECTED ABOUT ME?

MedMutual WELL will use the Personal Information that it collects about you, to facilitate the Program which may include the use cases specified below. MedMutual WELL will only use Personal Information in accordance with this Privacy Notice and applicable laws.

  • To administer and manage your account
    • Creating and maintaining your profile
    • Generating goals, activities, and/or targets
    • Recommending activities and engagements
    • Applying rewards earned
    • Making Program features available to you
    • Fulfilling purchase orders you make through the Program
    • Tracking your progress through the Program
  • To resolve any complaints or inquiries you may have
    • Registering complaints and inquiries
    • Managing and resolving complaints and inquiries
  • For management of any debts owed to MedMutual WELL , if applicable
    • ¬Tracking and administration of payment installments (if any)
    • ¬Recovery of unpaid debts or reimbursement of damages under a contract
  • To prevent, detect, and investigate fraud or security incidents
    • Investigating suspicions of fraud
    • Prosecuting fraud
    • Investigating security incidents
  • For company and management information purposes and internal analysis of products and services
    • Accounting and financial records; analysis and reporting
    • Audit requirements
    • System security and effective operation
    • Program quality assessments, improvements, and developments
    • Conduct internal research to develop or improve the Program
  • For training purposes: to improve your customer experience
    • ¬Assessing customer experiences
    • ¬Developing and improving your customer experience
  • To fulfill legal obligations
    • ¬Reporting necessary information to your Program Provider for benefit administration
    • ¬Complying with any applicable law, regulation, subpoena, or legal process, or responding to any governmental requests and cooperating with law enforcement, if we believe such action is required or permitted by law
    • Enforcing our Terms
  • Creating De-identified or Aggregated Data Sets
    • ¬De-identified data sets are data sets that contain member-level information, without identifiers that can be used to link the information back to a particular individual.
    • ¬Aggregated Data Sets are data sets that contain only aggregated information which cannot be decompiled or reverse engineered to identify any individual whose data may be included. De-identified and Aggregated Data Sets are not Personal Information; subject to any applicable laws or other restrictions, MedMutual WELL may use and disclose De-identified and Aggregated data sets for any purpose. De-identified data will be used for AI model training purposes.
    • MedMutual WELL will not attempt to re-identify De-identified data or Aggregated Data Sets

MedMutual WELL may also seek to use your Personal Information in a way not described above, such as in using a testimonial you have written on our website or in our marketing materials. Before using your Personal Information in this way, MedMutual WELL will first seek your voluntary and explicit consent.

5. HOW IS MY PERSONAL INFORMATION BEING PROTECTED?

Personal Information that you share on the Website is kept strictly confidential and fully secure. Your encrypted (encoded) Personal Information is protected using "Secure Socket Layers (SSL)" as it passes between your browser and this Website. We follow generally accepted industry standards to protect the Personal Information we receive, both during transmission and upon receipt. Personal Information collected by the Program, for example Personal Information received from Apple Health, will be stored securely in accordance with accepted industry standards.

No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee absolute security.

6. WHO CAN ACCESS MY PERSONAL INFORMATION AT MEDMUTUAL WELL ?

Your Personal Information is accessible by MedMutual WELL employees, including employees of MedMutual WELL affiliates, only on a need-to-know basis for the provision of services and support. Only such authorized persons are permitted to access your Personal Information. All authorized persons must abide by security, privacy, and confidentiality agreements, rules and laws.

7. OUTSIDE OF MEDMUTUAL WELL , WITH WHOM WOULD MY PERSONAL INFORMATION BE SHARED?

Your Program Provider: MedMutual WELL may share with your Program Provider (or a third party that assists and is authorized by your Program Provider) only the necessary information to enable them to administer your incentives, general administration, and for analytics purposes. Administration can include: calculation of health plan premium discounts, health club dues subsidies, applicable taxation, reward redemption, or other arrangements for which such information is relevant. Such information may be shared via the employer portal.

Your Program Provider’s authorized Third-Party Service Providers: Your Program Provider may make additional incentives available to you that are provided by Third-Party Service Providers, this could include your Program Provider’s inhouse service provider such as your Program Provider’s in house coaching service In order to administer this benefit, MedMutual WELL relies on the service agreement in place with your Program Provider, and/or any related agreement, to share your Personal Information with the Third-Party Service Provider to the extent necessary to make the offering available to you.

Service Providers to MedMutual WELL uses Vitality to make the Program available to you. Vitality will process your Personal Information based on the contractual agreement in place with MedMutual WELL and in accordance with this Privacy Notice. MedMutual WELL will also use other third-party partners to enable them to perform functions or provide services on our behalf. These service providers are only permitted to share, store and/or use the minimum amount of information for contracted business purposes.

Peer: where you sign up for a challenge limited Personal Information may be shared with a peer who is also participating in a challenge

Additionally, we may share your Personal Information when we believe that such action is necessary to:

  • Fulfill an enforceable government request;
  • Conform with the requirements of the law or legal process;
  • Protect or defend Our legal rights or property, Our Websites or Applications, or other users; or
  • Protect your health and safety or the health and safety of this Website's users or the general public.
  • Respond to lawful request by public authorities, including to meet national security or law enforcement requirements.

With your express authorization and consent, we may share your Personal Information for a specific purpose not provided above. Agreeing to the Terms and privacy notice is not your express authorization for any unspecified uses. When appropriate, while you are logged into the Program, you will be presented with a specific electronic authorization form on which you may or may not provide your consent. You may revoke such authorization at any time by navigating to your My Accounts page within the Program.

The Program may contain links to other websites that are not owned or controlled by Us or our clients (i.e., your Program Provider). We provide these links to other websites or mobile applications for your convenience to participate. If you choose to submit Personal Information while visiting these websites or using these mobile applications, please be aware your rights will be governed by the third parties’ privacy policies. We strongly encourage you to carefully read the privacy policies of any website or mobile application you visit or use.

9. WILL MY PERSONAL INFORMATION BE SOLD OR USE IT FOR CROSS CONTEXT BEHAVIORAL ADVERTISING?

No. MedMutual Well will never sell, rent, lease, disclose, disseminate, make available transfer or otherwise communicate your Personal Information to a third party for monetary or other valuable consideration.

MedMutual Well does not use your Personal Information for targeted advertising/cross context behavioral advertising based on personal information obtained from your activity across businesses, distinctly branded internet websites, applications, or services.

10. HOW LONG WILL MY PERSONAL INFORMATION BE RETAINED?

We retain each category of Personal Information, including Special Categories of Personal Information only for as long as necessary to provide the Program, comply with legal or regulatory requirements, maintain business and financial records, prevent fraud and security incidents, or as otherwise required by our Program Provider agreement. After this period, Personal Information is either deleted, de identified, or archived in accordance with our retention policies.

11. HOW WILL I KNOW IF THIS PRIVACY NOTICE CHANGES?

MedMutual WELL reserves the right to update this Privacy Notice from time to time. If we decide to change this Website's privacy policies, we will post those changes to this Privacy Notice, on the Program’s homepage, and other places that we deem appropriate. You should therefore refer to this Privacy Notice each time you make use of the Program.

12. WILL MEDMUTUAL WELL COMMUNICATE WITH ME DIRECTLY?

As a MedMutual WELL member, we aim to provide you with a fully invested experience and dedication to your wellness journey. we may deliver marketing, status updates, or other informational emails to you via the email address you provide on your My Account page. If you choose, you may opt out of receiving these emails at any time by adjusting the settings on your account when using the Program. If you use the Application, push notifications and triggered communication may be sent to you through the Application. These notifications can be turned off at any time by adjusting the application’s settings on your device.

Certain communications are necessary and cannot be turned off; these include; transactional emails, such as order confirmations, emails relating to payment processing activities, and reward redemptions; communications from our Customer Care team in response to contacts initiated by you; or other important updates like security and fraud notices or change in services.

If you send questions or comments to an email address listed within the Program or via a contact form provided within the Program, we will share your correspondence with a MedMutual WELL associate most capable of addressing your questions and concerns. We will retain your communications until we have done our very best to provide you with a complete and satisfactory response. Ultimately, we will either discard your communication or, in some cases, archive it. We will not keep your email address for secondary purposes. All information and correspondence you share with us will be handled in the strictest confidence.

We may agree that email has become a standard communication tool used by many different parties. Unfortunately, by design standard Internet email is not secure. For that reason, please do not use unsecured email to communicate information to us that you may consider to be confidential.

13. I RECEIVE THE PROGRAM IN THE US– WHAT ARE MY RIGHTS?

You have certain rights regarding your Personal Information under applicable U.S. state privacy laws. These rights may vary depending on your state of residence, but generally include the following:

A. Right to know

You have the right to request information about: i) the categories of Personal Information we collect, use, disclose, and retain; ii) the source from where such Personal Information was collected from; iii) the business or commercial purpose for collecting or sharing your Personal Information; iv) the specific pieces of Personal Information we have collected; and v) the third parties with whom such information is shared.

B. Right to access

You may request access to the Personal Information we hold about you. The right of access includes the rights to receive a copy of the Personal Information we hold about you.

C. Right to correct

You have the right to request that we correct inaccurate or incomplete Personal Information.

D. Right to delete

You may request the deletion of your Personal Information, subject to certain legal exceptions.

E. Right to Limit Use of Special Categories of Personal Information or equivalent

Where required by law, you may request that we limit the use and disclosure of your Special Categories of Personal Information to only what is necessary to provide the requested services. Note: We use and disclose Special Categories of Personal Information only as necessary and proportionate to provide the Program; accordingly, the CPRA right to limit is not applicable to our Special Categories of Personal Information use in this context.

F. Right to opt out

Where required by applicable law, you have the right to opt out of your Personal Information being: i) used for targeted advertising; ii) sold; iii) used for in the furtherance of a decision that produces a legal or similarly significant effect concerning you. Note: we do not use your Personal Information in this way when providing the Program;

G. Right to opt out of the collection of Special Categories of Personal Information or equivalent

Where required by applicable law, the right to opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data

H. Right to Non-Discrimination and Non-Retaliation

You will not be discriminated against or retaliated against for exercising any of your privacy rights.

How to Exercise my Rights

In order to exercise rights enumerated above, please contact MedMutual WELL in one of the following ways.

  • please contact us through our Contact Us page when logged into the Program.
  • If you are not a current member or one of the above options does not work for you, please contact MedMutual WELL through the following link: support@medmutual.membercareteam.com
  • Alternatively, you may submit your request by calling Us at 1-866-953-4187

Note you may submit a reasonable number of requests per year, as permitted by applicable law. Such request will focus on Personal Information processed by MedMutual WELL in the 12 months preceding your request, unless a longer period is required by applicable law. If you reside in California, you may request the disclosure of Personal Information beyond the 12-month period, this shall only apply to Personal Information collected on or after January 1, 2022.

Once a request is submitted, MedMutual WELL may first contact your Program Provider to inform them of the request and then work with them to complete the request.

MedMutual WELL will attempt to verify your request by using information related to your account, but in some cases additional information may be required. Subject to certain exceptions that may apply, if we are able to verify your request, we will accoMedMutual WELL date your request in accordance within applicable laws.

14. ARTIFICIAL INTELLIGENCE (AI) USE & AUTOMATED DECISION MAKING

We use AI to enhance our Program offering while prioritizing data privacy and security. We are committed to fairness, transparency, and human oversight in all our use of AI.

Vitality uses automated tools to support Program functions such as generating personalized wellness insights (including Vitality Age), recommending activities, and setting individualized goals. These outputs are informational and are intended to enhance your Program experience. They do not constitute decisions that have legal or similarly significant effects on you.

Should you have any questions reach out to us as set out in section 17.

15. INFORMATION FOR GOOGLE FIT USERS

MedMutual Well complies with the Google API Services User Data Policy including the Limited Use requirements. MedMutual Well will only receive the below device data from Google Fit where you allow your mobile application to sync data to the Application. You can modify these permissions at any time through the settings menu of the Application.

If you have consented to data synching, the device data that MedMutual Well will collect through the Program includes:

  • physical activity data (including meditation data)
  • body measurements,
  • heart rate data,
  • sleep data

The above device data will only be used to facilitate the Program in accordance with section 4 above. MedMutual Well may disclose your device data, to our agents, service providers, third-party partners, affiliates and subsidiaries to enable them to perform functions or provide services on our behalf. These service providers are only permitted to share, store and/or use such data for contracted business purposes.

MedMutual Well will protect your device data in accordance with section 5 of this Privacy Notice.

16. INFORMATION FOR FITBIT USERS

The use of information received from Fitbit APIs and/or Developer Tools will adhere to the Fitbit Platform Developer and User Data Policy (https://dev.fitbit.com/legal/platform-developer-and-user-data-policy/), including the Limited Use requirements.

17. HOW CAN I CONTACT MEDMUTUAL WELL WITH MY PRIVACY CONCERNS OR INQUIRIES?

Individuals with inquiries or complaints regarding the privacy of their Personal Information or this Privacy Notice should first contact MedMutual WELL at:

Att: Privacy Officer

1-866-953-4187

support@medmutual.membercareteam.com