Trust, privacy &
data governance

This page is maintained by Wakefully to answer the questions luxury wellness resorts, longevity clinics and executive retreat sponsors ask before a pilot. It describes current practices – it is not a certification.

Ask a governance question

The short answer

Individual reads belong to the individual. Operator reports are aggregated at the cohort level. Consent is collected at intake, in plain language, and is revocable. Nothing about a single guest is disclosed to an operator without explicit consent.

Consent by design

Wakefully collects intake language, reflections, mood check-ins and – where a guest opts in – dream content. Every field is explained in intake: what it is, why it is read, who sees the resulting brief, and how to withdraw. Consent can be narrowed (for example, opting out of the individual archive while keeping the practitioner brief) or fully withdrawn at any point.

Who sees what

The disclosure boundary is the most important line in the product:

Individual (guest / client / executive): sees their own full read – brief, transformation matrix, durability check-ins, and any archived reflections they opted to keep.
Practitioner: sees the Intelligence Brief for guests they are working with, for the duration of the engagement.
Operator / sponsor: sees aggregated cohort reads only. Individual identity is not disclosed. No cohort report is issued below the minimum cohort size that preserves anonymity.

Psychometric and biometric handling

Wakefully processes psychometric signal (language, reflections, self-report). Biometric data – sleep architecture, HRV, activity – is used only when the operator's stack supplies it and only for the purposes the guest consented to at intake. Wakefully does not sell data, does not train foundation models on identifiable guest content, and does not use guest content to serve third-party advertising.

Retention, portability, deletion

Active engagement data is retained for the pilot or contract term. Individual archives (where the guest opted in) are retained until the guest deletes them. Guests can export their own reads and request deletion at any time – deletion removes identifiable content from active systems on request; aggregated, non-identifying cohort statistics may persist.

Integrations posture

Wakefully is designed to sit beside the operator's existing stack – PMS, CRM, practitioner tools, wearable feeds – without replacing them. Integrations use the operator's authenticated interfaces; we do not require broad-scope exports. Data flowing between systems is scoped to what each side needs to deliver the guest's stay.

What this page is not

This page describes Wakefully's current practices. It is not a certification, an audit report, or a legal agreement. Pilot contracts include the specific Data Processing Addendum for the deployment.

If the boundary is not obvious, it is not trustworthy. Ours is deliberately obvious.