Privacy Policy

01What we collect

You decide how much of this exists. Every module can be switched off, and a module that is off collects nothing.

• Account data: your email address, and — if you use a password — only a salted PBKDF2 hash of it, never the password itself. If you sign in with a passkey we store its public key and credential identifier. If you sign in with Google we store the account identifier Google returns and your email address.

• Two-step verification: when you enable it, we store hashed recovery codes and the shared secret your authenticator app uses.

• Blood pressure: systolic, diastolic, pulse, arm, body position, tags, times and notes.

• Medications and GLP-1 therapy: what you take, doses, schedules, the times you tick each dose off, injection sites, side effects and how a dose felt.

• Laboratory results and sleep: markers, values, units, reference ranges and dates, whether typed in or extracted from a PDF or a photo you share; and CPAP nightly summaries (usage, AHI, leak, pressure).

• Body and weight: weight, waist, body-fat entries, goals, food entries and hydration counts.

• Wellness check-ins and assessments: daily ratings for appetite, energy, nausea, gut comfort and mood, and — if you choose to take them — the PHQ-9 (depression), GAD-7 (anxiety), SCOFF (eating disorder) and AUDIT-C (alcohol) questionnaires, together with their scores and dates. These are among the most sensitive categories of personal health information, and they are optional.

• Progress photos, if you add them.

• Family members: if you track for somebody else, whatever you enter about them — name or label, birth date, target range, readings, medications and notes. See “Tracking for someone else” below.

• Operational data: reminder and notification settings, report email address, share links you create, push subscription endpoints if you enable notifications, consent timestamps, and security logs including IP address, approximate time and session activity.

• Support: the question you send us, your email address, and our reply.

02Why we collect it, and our legal basis

We process your data to provide the service you asked for: to store and display your entries, calculate trends and averages, run reminders and alerts you switched on, produce exports and reports, serve share links you created, and answer Tensi questions you ask.

Our basis is your express consent, given when you create an account and again — separately — for each optional feature that goes beyond core tracking. We also process a limited amount of data on the basis of legitimate interest in keeping the service secure and available: rate limiting, abuse prevention and security logging.

We do not sell personal information. We do not use your health data for advertising, we do not build advertising profiles, and we run no third-party analytics or tracking scripts in the app or on this website.

03Encryption, and its honest limits

Health values are encrypted with AES-256-GCM under a data key belonging to your account, before they are written to the database. Opening the database console shows ciphertext for blood pressure and the other health fields, not your numbers. Sessions use HttpOnly cookies, and the raw data key is not kept in browser storage.

This is server-recoverable encryption, not end-to-end encryption. Your data key is itself wrapped with a key we hold, so that our Workers can decrypt your data after you authenticate — which is what makes it possible to show your journal on a new device, run the Tensi features you opt into, send an alert you asked for, and serve a share link you created. It also means that, in principle, we hold the means to decrypt. We are telling you this rather than describing the system as end-to-end encrypted, which it is not.

Passwords are never stored, only a salted PBKDF2 hash. Passkeys never transmit a secret at all.

04Tensi, and what artificial intelligence sees

Tensi is off until you turn it on. Nothing is sent to a model because you opened a page.

Two consents govern it, and they are separate and independently revocable: one for educational answers about the note or reading in front of you, and a second, explicit one before Tensi may read your stored history. You can withdraw either at any time in Profile.

When you ask Tensi something, your authenticated session decrypts the relevant data in memory and sends it to Cloudflare Workers AI. The models in use are gpt-oss-120b (with gpt-oss-20b as a fallback) for text, and Mistral Small 3.1 for the vision features that read a blood-pressure monitor from a photo and pull markers out of a lab report. Inference may run on Cloudflare infrastructure outside Canada.

We do not use your personal health information to train models, and Cloudflare does not train its models on Workers AI inputs. Daily per-user limits apply. Tensi is educational and triage-oriented only: it does not diagnose, does not give a prognosis, and does not recommend medication changes. The safety thresholds that decide when it must refuse are implemented in our code, not left to the model.

05Where your data is, and who processes it

The service runs on Cloudflare. Our database is Cloudflare D1, currently located in Eastern North America. Cloudflare D1 does not presently offer a Canada-only jurisdiction lock, so your data is stored outside Canada and may be processed outside Canada. We use application-layer encryption, access controls and explicit consent to reduce the risk while that limitation exists, and we will move to Canada-restricted storage if and when Cloudflare supports it.

While data is outside Canada it is subject to the laws of the country it is in, including lawful access by that country’s authorities.

• Cloudflare — hosting, database, compute and Workers AI inference.

• Google — only if you choose Google Sign-In, and only to verify who you are. Google learns that you signed in to Tenssify; it does not receive your health data.

• Resend — transactional email: verification, password reset, reminders, alerts you enabled, and support replies. Email is not encrypted in transit end-to-end, so we keep health detail in emails to a minimum.

• jsDelivr — a public CDN. If, and only if, you import a lab report, your browser fetches the PDF and OCR libraries from it, which discloses your IP address to that CDN. The libraries are pinned by cryptographic hash so a compromised CDN cannot substitute different code. The document itself is read in your browser.

06What stays on your device

A CPAP SD card is read entirely in your browser. The nightly summary that results is saved to your account; the raw recordings on the card are never uploaded.

Photographs of a lab report and of a blood-pressure monitor are sent for processing only at the moment you ask for them to be read, and only so the values can be extracted for you to check before anything is saved.

07Consent, and withdrawing it

Creating an account gives express consent to process your information for the core purposes above. Optional processing requires its own consent: educational Tensi, Tensi history access, push notifications, email alerts, and each module you switch on.

You may withdraw any optional consent at any time in Profile, and switching a module off stops its collection. Withdrawing consent for core processing means closing your account, because there is no way to run a health journal without processing what you put in it.

08Tracking for someone else

You can add family members and keep separate records for them. Doing so makes you responsible for having the right to enter that person’s health information — their consent if they are capable of giving it, or your legal authority if they are not. Please tell them their data is here and that you can share it.

Anything you record about another person is treated with the same protections as your own. If that person contacts us directly to ask what is held about them or to have it removed, we will act on their request, and we may need to contact you to do so.

09Sharing and share links

We disclose your data only to the processors named above, to the recipient of a share link you created, to the email address you nominated for reports and alerts, and where the law requires it of us.

A share link is created by you, carries only the subject and sections you selected, and expires on the date you set. Anyone holding the link can open it until it expires, so treat it like the document it is. You can revoke a link before its expiry.

10Who at Tenssify can see your data

Staff access is limited to what is needed to run the service and answer support requests. Administrative access is protected by single sign-on and an IP allowlist, and administrative actions are written to an audit log. Staff answering a support ticket see what you wrote in it; they do not browse your health records to do so.

11Your rights

We answer requests within 30 days. We may ask you to verify who you are before acting on one, so that somebody else cannot make it in your name.

• Access — see everything in the app, and export it in full as CSV or PDF at any time.

• Correction — edit or delete any individual entry, and correct your profile.

• Deletion — delete your account and its health records from Profile. This is immediate and cannot be undone.

• Withdraw consent — turn off Tensi, notifications or any module, without losing the rest.

• Portability — your export is machine-readable and yours to take anywhere.

• Complain — write to us first, and if we do not resolve it you may contact the Office of the Privacy Commissioner of Canada, or the Information and Privacy Commissioner of Ontario if you are in Ontario.

12Retention

We keep your account and its encrypted health data for as long as your account is open. When you delete your account, its personal health information is removed from production storage immediately and from routine backups within 30 days.

Limited security and abuse-prevention logs may be kept for up to 12 months, and records of consent and of deletion requests are kept as long as we may need them to show we honoured them. Neither contains your health values.

13Cookies and similar technologies

We use a single HttpOnly session cookie to keep you signed in, and browser storage for your own settings such as theme and which modules you use. There are no advertising cookies, no tracking pixels and no third-party analytics, which is why this site shows you no cookie banner — there is nothing to ask you to accept.

14Children

Tenssify is not intended for people under 16, and we do not knowingly create accounts for them. An adult may record a child’s readings as a family member, under that adult’s account and responsibility. If you believe a child has created their own account, tell us and we will remove it.

15If something goes wrong

If a breach creates a real risk of significant harm, we will report it to the Privacy Commissioner and notify the people affected as soon as feasible, as PIPEDA requires, and tell you plainly what happened, what was exposed and what to do about it. We keep records of breaches whether or not they meet that threshold.

16Changes to this policy

If we change how we handle your information in a way that matters, we will tell you in the app before the change takes effect, and — where consent is required — ask for it again rather than assume it. Older versions are available on request. The effective date at the top always reflects the current version.

17Contact

Tenssify is operated from Ontario, Canada. Write to us about anything in this policy, including to exercise a right above, and we will answer.

Privacy inquiries: support@tenssify.com