Legal

Privacy policy

Last updated: October 17, 2026

Be Well Passport is operated as part of Be Well Asheville (“we” or “us”). This policy explains what we collect when you use the Be Well Passport website, how we use it, and the choices you have. It works alongside our Terms of Use.

What we collect

Your account

Your email address, which is how you sign in and how we reach you.
Your password, if you choose one, is handled by our sign-in provider and stored only in protected (hashed) form. We never see or store your password ourselves.
Your name or phone number, if you give them to us.
Basic sign-in records, such as when your email address was confirmed.

Your Passport

Any Passport issued to you: which Passport it is, when it is active, and its status.
Your Passport code and QR code, which Passport Stops use to check you in.
Your check-ins: which business and location checked you in, which experience you used, when, and which staff account recorded it.
The stamps you collect from those visits.
If you choose to share your Passport, the share link and whether you chose to show your first name on it.

Photos you add to your Passport (Passport memories)

Adding a photo is optional. If you add one to an experience you completed, we keep:

The photo, saved as a resized copy. We remove the location (GPS) and camera details stored inside the image file where practical, and we don't keep the original file.
The completed experience it belongs to: the participating business, the experience, the visit it records, and that experience's location.
When you added, replaced, or removed the photo, and your answer about who appears in it.
Whether our team has reviewed the photo or hidden it because it didn't follow our guidelines.
Whether you gave permission for us to use that photo in our promotional materials, when you gave it, which version of our Photo Usage Terms it was given under, and whether and when you withdrew it.
If a promotion is running when you add a photo, whether the photo counts as an entry and the status of any request you make, such as asking us to check that your physical Passport appears in it.
If you use the share or copy buttons, anonymous usage events (for example, that a share button was used). We don't see or keep what you post elsewhere.

Experience locations

Check-ins and Passport memories are linked to the location of the participating business, retreat, event, or experience — not to your own location. We don't track your device's location, and we don't ask for it when you add a photo.

Forms you send us

Founding Access and waitlist sign-ups: for example your name, email, ZIP code or area, the kinds of wellness you are interested in, and whether you agreed to hear from us.
Email updates you sign up for on our pop-up: your email address, the city page you signed up on, the updates you chose (new offers, new Passport seasons, new cities, or general Passport updates if you choose none), that you ticked the box agreeing to receive them, when you agreed, and which campaign you signed up from.
Concierge requests: the details you choose to give us, your contact information, and your preferences.

If you work with a participating business

Partner applications: the business and contact details you submit.
Business team access: your email address and your role at the business.
Change requests and notes that businesses send us about their Passport listing or offers.
If you accept the Partner Agreement for a business: the name and title you type, your email address, the version of the agreement you accepted, and when you accepted it. We keep this as the business's record of the agreement.

How you found us, and how the site is used

One first-party cookie that remembers how you first arrived (for example a campaign link or the site that referred you, and the page you landed on). It lasts up to 90 days.
Privacy-respecting page analytics that do not track you across other websites.

Security and operations

Cookies that keep you signed in.
Technical logs of requests and events (such as a sign-in or an email being sent) so we can keep the service working and secure. We design these logs not to include your email address, phone number, or what you type into forms.
Records of changes our team makes in our admin tools, such as issuing a Passport.
Records of the service emails we send you.

What we don't collect

We don't ask for, and ask you not to share, medical or health information. Be Well Passport is not designed to collect or maintain medical or clinical records, diagnoses, treatment information, patient charts, insurance information, or protected health information (PHI), and participants and partners should not submit that information through the service. We don't take payments on this site, so we don't collect card details.

How we use it

To run your account and sign you in.
To show you your Passport, and to let Passport Stops check you in and record your stamps.
To show your Passport memories and connect each photo to the experience you completed.
To review photos and requests, hide photos that don't follow our guidelines, and protect the service against misuse and fraud.
To run drawings, giveaways, or other promotions we offer from time to time, under the rules published for each one.
To use one of your photos in our promotional materials — only if you separately gave permission for that photo under our Photo Usage Terms, which are shown with that permission when you add a photo.
To show participating businesses and experience locations on maps and in discovery features, such as city maps, a map of your own Passport journey, and maps of overall Passport activity shown as totals by place. These use experience locations, not your location, and they don't make your photos public.
To give businesses that work with us access to their own dashboard and requests.
To respond to your requests and messages.
To send you emails you need, such as sign-in links, confirmations, and notices about your account or Passport.
To send Founding Access and launch news, and the updates you chose, only if you agreed. We send one short confirmation when you sign up. You can unsubscribe at any time, and we keep a record of unsubscribes so we don't email you again.
To send text messages, only if you have agreed to receive them.
To keep the service secure and prevent misuse.
To understand what is working and where there is demand for the Passport.

How we use AI

We use artificial intelligence (AI) in two separate ways: Ask Be Well, an assistant inside accounts, and AI-assisted research that our team uses to prepare public listings for participating businesses. Here is what each one does with information.

Who processes it

Vercel, which hosts this site, sends our AI requests through its AI Gateway service.
Anthropic makes the Claude AI model that writes the answers and suggestions. Vercel may send a request to Anthropic directly or to a cloud provider that runs Anthropic's models for Vercel, such as Amazon Web Services or Google Cloud.
Perplexity ran web searches, through Vercel, for the business listing research described below until we turned that search off in October 2026. It doesn't receive anything from us now. Ask Be Well has never searched the web, and nothing from Ask Be Well goes to Perplexity.

Ask Be Well, the assistant in your account

Ask Be Well is optional. It is labelled as an AI assistant, and it only runs when you ask it something.
It answers questions about your own account. For a Passport holder, that means your Passport, your access, stamps, milestones, physical Passport, gifts, and the experiences available to you. For someone who works with a participating business, it means that business's own listing, offers, and check-ins, with guests shown by first name and last initial only. It can't look up anyone else's account or another business's information.
It can only look things up. It can't change your account or your Passport, check anyone in, send emails, or take payments.
When you ask a question, we send it to Vercel and the model provider with the earlier messages from that conversation and the account details Ask Be Well looked up to answer it.
Our team also has a version of Ask Be Well in our admin tools. When we use it to help with an account, a purchase, or a gift, it can send that person's name, email address, and the status of their Passport, purchases, gifts, or physical Passport to Vercel and the model provider. It can suggest a change, but nothing changes unless a team member approves it.

AI-assisted research for business listings

This is separate from Ask Be Well and is used only by our team, only for businesses that apply to take part. To help draft a public listing, such as a short description, we send details from the business's application to Vercel and the model provider. The application's separate contact, license, and insurance fields are not included, but other text in the application, such as the business description, is. The AI drafts only from that application text. It doesn't search the web. A member of our team reviews and edits every suggestion before anything is published.

Until October 2026, this research could also search the web about the business through Perplexity. The AI wrote those search queries itself from the application text. We instructed it to search only for the business and never for people, but we couldn't check each query before it was sent, so a name or other detail from the application text could have appeared in a search. We turned web search off for this reason.

What is kept, and where

In your browser. In your account, an Ask Be Well conversation is kept only in the open page's memory and is cleared when you reload or close the page. The version our team uses in our admin tools keeps the conversation in that browser tab's session storage, so it stays through reloads and moving between admin pages. The browser clears it when the tab is closed, although some browsers bring it back if a closed tab is reopened.
On our servers. Be Well Passport doesn't save the text of Ask Be Well questions or answers. We keep a daily count of questions per account, to apply a daily limit, and technical log entries that record your account ID, which lookups ran, how long the answer took, and whether it worked. These records don't include what was asked or what the answer said.
With Vercel and the model provider. They handle these requests under Vercel's terms and their own. Every AI request we send asks Vercel to use only model providers that, according to Vercel, have agreed with Vercel not to use what we send to train their models. If no such provider is available, the request fails and is not sent anywhere else. We can't see those agreements ourselves, so we rely on Vercel's description of them. We don't ask for zero data retention. Vercel also offers team-wide AI Gateway settings, and we haven't verified how ours are set. So we don't promise that these providers keep nothing, or that they never use what they receive to improve their services.
With Perplexity. Perplexity's published terms for its search service allow it to keep search queries and results and to use them to develop its products. We haven't been able to confirm whether Vercel's arrangement with Perplexity changes that, so assume those terms apply to the earlier searches described above.
We don't sell your information to AI companies.

Your choices and AI

You don't have to use Ask Be Well. The information it uses is also on your account pages.
Please don't enter health or medical information, or anyone else's personal details, into Ask Be Well.
AI answers can be wrong or incomplete. Your account pages are the official record. If something doesn't match, trust the page and let us know.

What AI doesn't do here

AI doesn't make decisions about your account, your Passport, or your eligibility. A person approves every change.
We don't send your Passport photos to AI, and we don't use AI to analyze them.

Who can see it

Passport Stops see what they need to check you in and record your visit at their business.
A provider we match you with through a concierge request receives only what they need to help you.
Your Passport memories are seen by you and by authorized members of our team (for review and support). The businesses you visit don't receive your photos. A photo is used publicly only if you gave permission for that photo, or if you share it yourself.
Where you share is up to you. If you choose to share a memory, we create a link to that photo: anyone with the link can see the photo, the business, and the date of your visit, never your name or anything else about you. The link stops working if you turn it off, remove or replace the photo, or if we hide it after review. Where you post it, that platform handles it under its own terms and privacy policy.
Anyone with your share link, if you create one, sees the Passport and city and, only if you chose, your first name. It never shows your email, your code, or your visits.
Service providers who host the site and its data, handle sign-in, and deliver our email do so on our behalf. Our email is sent through Resend, which receives your email address and the message we send you in order to deliver it. For AI features, Vercel and Anthropic (or a cloud provider running its models for Vercel) process information, and Perplexity did until October 2026, as described in How we use AI.
We may disclose information if the law requires it.

We do not sell your information.

Your choices

Email hello@bewellpassport.com to see, correct, or delete your information, or to close your account.
Use the unsubscribe link in any marketing email, or email us, to stop receiving them. Unsubscribing works straight away and stays in place even if you later sign up again on a pop-up; email us if you want to start receiving updates again.
Remove a photo from your Passport at any time. We delete the stored image and keep only a basic record that it existed and was removed.
Withdraw promotional permission for a photo at any time. We will stop new uses of it; material already published before you withdrew may not be recallable.
You can clear or block cookies in your browser, though you will then need to sign in again.

Children

Be Well Passport accounts are for people 18 and older. A photo you add that shows a child stays private in your Passport and is never used in our promotional materials.

Changes to this policy

If we change this policy, we will update the date above and, where appropriate, let account holders know by email.

Contact

Questions about your privacy: hello@bewellpassport.com