Security and Trust Center
Wellhub is a SaaS platform that enables organizations to provide a fitness and wellness program. We hold the PCI-DSS and the ISO 27001 certifications and comply with applicable Data Privacy Regulations in our operating regions. Wellhub takes data protection seriously and has several security measures to ensure data safety through a strong information security management system.
- Does the organization ensure personnel receive recurring familiarization with the organization’s cybersecurity & data privacy policies and provide acknowledgement?
- Does the organization identify and document the purpose(s) for which Personal Data (PD) is collected, used, maintained and shared in its data privacy notices?
- Does the organization test for the presence of Wireless Access Points (WAPs) and identify all authorized and unauthorized WAPs within the facility(ies)?
- Does the organization define acceptable and unacceptable rules of behavior for the use of technologies, including consequences for unacceptable behavior?
- Does the organization monitor, regularly review and audit External Service Providers (ESPs) for compliance with established contractual requirements for cybersecurity & data privacy controls?
Security and Trust Center Updates
PHP2Shell - Remote code execution vulnerabilities
Wellhub has reviewed its environment regarding the recently disclosed “PHP2Shell” remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Wellhub’s platform, including our member and partner applications, client portals, APIs and supporting cloud infrastructure, does not use PHP.
Wellhub services and customer data are therefore not affected by these vulnerabilities. Our Information Security team continues to monitor for new information and will publish an update here if anything changes.