Privacy Policy

Effective Date: 2026-08-06

This Privacy Policy describes how Wave Life, Inc. (“Wave,” “we,” “us,” or “our”) handles personal information we collect through our website and mobile application (collectively, the “Service”), as well as through social media, our marketing activities, and other activities described here. This policy covers personal information that is not protected health information (PHI). PHI that Wave processes on behalf of a covered-entity partner is governed by our HIPAA / Business Associate Privacy Statement and the applicable Business Associate Agreement. Please review that Statement to learn how such health information is handled.

Personal information we collect

Information you provide includes contact data, demographic data, profile data, communications, marketing data, job application data, payment and transactional data, and promotional data. We also collect information from third-party sources, and we automatically collect device data and online-activity data through cookies, local storage, and web beacons. Information relating to your participation in Wave’s services that constitutes PHI is addressed in our HIPAA / Business Associate Privacy Statement, not here.

Session recordings and transcriptions

Information from your coaching sessions, including any recordings and transcriptions, is health information addressed in our HIPAA / Business Associate Privacy Statement. Please see that Statement for how it is used, disclosed, and de-identified, and for your choices regarding it.

How we use your personal information

We use personal information for service delivery, research and development, marketing, recruiting and processing job applications, and compliance and protection; with your consent where required; and to create anonymous, aggregated, or de-identified data that we may use and share for lawful business purposes. Uses of PHI are addressed in the HIPAA / Business Associate Privacy Statement.

How we share your personal information

We may share personal information with coaches, affiliates, service providers, payment processors, linked third-party services, parties you designate, professional advisors, authorities as required by law, and acquirers in a business transaction. We make commercially reasonable efforts to confirm recipients protect information consistent with this policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We also do not share personal information with developers of artificial intelligence or large language models for the improvement of their own models or for their own purposes.

Data retention

We retain personal information for as long as your account is active or as needed to provide the Service. We may retain certain information after your account closes where we have an ongoing legitimate business or legal need to do so — for example, to comply with legal, regulatory, or professional obligations (including record-retention requirements that apply to health information), to resolve disputes, to maintain security records, or to enforce our agreements. Health information that we maintain on behalf of our healthcare partners is retained in accordance with our obligations under HIPAA and our agreements with those partners.

When personal information is no longer needed for these purposes, we delete it or de-identify it. You may request deletion of your information or closure of your account at any time as described in "Your choices." If you do, we will delete your personal information except where retention is required or permitted by law.

Your choices

You may access or update account information, opt out of marketing emails and texts, and request that content be removed, anonymized, or deleted, or that your account be closed, by contacting privacy@wavelife.io. Because we do not sell or share personal information for advertising, we do not respond to browser “Do Not Track” or opt-out preference signals; if our practices change, we will update this policy and honor signals as required by law.

Other sites, security, international transfer

The Service may link to third-party sites we do not control. We employ technical, organizational, and physical safeguards designed to protect personal information but cannot guarantee security; if a breach affecting your information occurs, we will notify you as required by law. We are headquartered in the United States and may transfer personal information to the U.S. or other locations. The Service is intended for users in the United States.

Children

The Service is intended for individuals 18 years of age and older. If we learn we collected personal information from someone under 18 without required parental consent, we will comply with applicable legal requirements to delete it.

Changes; How to contact us

We may modify this Privacy Policy at any time; material changes will be indicated by updating the date and posting. Contact us at privacy@wavelife.io or by mail at:

Wave Life, Inc.

700 El Camino Real, Suite 120

Menlo Park, CA 94025, United States