1. Who we are
tendwell is provided by Nousattva Pty Ltd, a company registered in Australia ("we", "us"). We are responsible for the personal data described in this policy. For the purposes of data protection laws, we are the "data controller", "organisation" or "data fiduciary" for it.
This policy covers the tendwell apps for iPhone and Android, this website and our support channels. It is written to meet the Australian Privacy Act 1988 and the Australian Privacy Principles, Singapore's Personal Data Protection Act 2012, India's Digital Personal Data Protection Act 2023, and applicable US state health privacy laws.
How we treat health data specifically, including data from Apple Health and Health Connect, is set out in more detail in our health data and usage policy, which forms part of this policy.
2. The short version
- We collect what we need to run tendwell: your account, the health data you allow, what you add, and what you share.
- We never sell personal data, and we never use health data for advertising.
- You decide what your followers and family see.
- Data is stored in Singapore, encrypted, with an extra layer of encryption for health data.
- You can see, correct, download and delete your data at any time.
3. What we collect
Information you give us
- Account: your name, email address, username, profile photo, country and date of birth or age range. If you sign in with Apple or Google, we receive your name and email (or Apple's private relay address) from them.
- Profile settings: whether your account is private, your sharing choices and your notification settings.
- Things you add: medicines and doses, reminders, doctor visits and the questions you plan to ask, symptoms, temperatures, cycle information, notes, and entries you make for family members you look after. When you add a medicine by speaking or scanning, the recording or picture is turned into text on your phone, and only the text is saved.
- Social content: posts, photos, comments, cheers, follows, blocks, reports, challenges you create or join, and Circles you belong to.
- Family: family members you invite or add, including children's profiles, and what each person agrees to share.
- Support: what you tell us when you email us or send feedback.
Health data you allow us to read
With your permission, tendwell reads data from Apple Health on iPhone or Health Connect on Android. You choose each type. Depending on what you allow, this can include sleep, steps, distance, heart rate, resting heart rate, heart rate variability, workouts and their routes, cardio fitness (VO2 max), blood oxygen, respiratory rate, blood glucose, body measurements and cycle tracking. The health data policy lists each type and why we use it.
Information collected automatically
- Device and app: device model, operating system, app version, language, time zone, and a push notification token so we can send you notifications.
- Server logs: IP address, the time of each request and error details, used to keep tendwell running and secure.
- Crash and usage information: if you agree, we collect crash reports and anonymous records of which screens are used. These never include health readings or the text of your posts, and are linked to a random ID rather than your account.
Location
tendwell doesn't track your location in the background. Workout routes from Apple Health or Health Connect contain location, and are used only to show your route to you and to people you share that workout with. A clinic address you type for a doctor visit is stored with that visit.
Contacts
If you choose to find friends from your contacts, the app checks the phone numbers and email addresses in your contacts against tendwell accounts. We use them only for that match and don't keep the contact details of people who aren't on tendwell.
Payments
Paid plans are bought through the App Store or Google Play. We receive confirmation of what you bought and when it renews, but never your card or bank details.
From other people
Other users may mention you, invite you, add you to a Circle, or, if they are your parent or guardian, create a profile for you. If someone gives us your details to invite you, we use them only to send that invite.
4. How we use it
| What we do | Data used | Our legal basis |
|---|---|---|
| Create and run your account, sign you in, keep it secure | Account, device, logs | Needed to provide tendwell (contract) |
| Show your readiness, signals, trends and Care features | Health data, things you add | Your explicit consent |
| Share posts, family data and challenge scores with the people you choose | Social content, the health data you choose to share | Your explicit consent, given by each share or setting |
| Work out challenge scores and leaderboards | Activity and heart rate data for the challenge days | Your explicit consent, given when you join |
| Send reminders and notifications | Reminders, push token, notification settings | Needed to provide tendwell; your consent to notifications |
| Keep the community safe: review reports, check photos, stop spam and abuse | Social content, reports, account, logs | Legitimate interests in a safe service; legal obligations |
| Fix problems and improve tendwell | Crash reports and anonymous usage (if you agree), support messages | Your consent; legitimate interests |
| Answer your questions | Support messages, account | Needed to provide tendwell |
| Process paid plans | Purchase records from Apple or Google | Needed to provide tendwell; tax and legal obligations |
| Tell you about important changes | Email, push token | Legal obligations; needed to provide tendwell |
We'll only send you marketing emails if you ask for them, and every one has a way to stop them.
We don't make decisions about you that have legal or similarly significant effects based only on automated processing. Insights in the app are suggestions for you to consider.
5. What we never do
- We don't sell or rent personal data, and we don't share it with data brokers.
- We don't use health data, or data from Apple Health or Health Connect, for advertising, marketing or audience building.
- We don't share health data with insurers, employers, lenders or anyone making decisions about your eligibility for something.
- We don't store data from Apple Health in iCloud.
- We don't use your health data or your posts to train artificial intelligence models offered to anyone else.
7. Where your data is stored
Insights such as readiness and health signals are calculated on your phone. The data tendwell keeps on its servers is stored in Singapore.
If you use tendwell from outside Singapore, including from Australia or India, your data is transferred to Singapore. We protect it there to the standard required by the law of your country, through contracts with our providers and the security measures in section 8. Some providers, such as Apple and Google, may process limited data (for example, a push notification) in other countries.
8. How we protect it
- All data is encrypted in transit and at rest.
- Health data and other sensitive records are encrypted again by tendwell before they're saved, using keys held in a separate key management service.
- Access to production systems is limited to the few people who need it, protected by multi-factor authentication, and logged.
- Data for testing is kept separate from real user data.
No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll tell you and the relevant regulators as the law requires, including under Australia's Notifiable Data Breaches scheme, Singapore's PDPA and India's DPDP Act.
9. How long we keep it
- While your account is open, we keep your data so tendwell works. You can delete individual posts, entries and records at any time.
- When you delete your account, it's removed straight away from view and permanently erased within 30 days, and from encrypted backups within a further 35 days.
- Server logs are kept for up to 90 days.
- Reports about content that broke our rules are kept for up to one year, to deal with repeated abuse.
- Purchase records are kept for as long as tax law requires (in Australia, five years).
- If your account is inactive for three years, we'll email you, and delete it if you don't reply within 30 days.
10. Your choices and rights
Wherever you live, you can:
- See and correct your data. Most of it is visible and editable in the app.
- Get a copy of your data in a common, machine-readable format.
- Delete individual items or your whole account.
- Withdraw consent at any time: change what tendwell can read in Apple Health or Health Connect settings, change sharing settings, or turn off analytics. This doesn't affect anything done before you withdrew it, but some features may stop working.
- Object to or ask us to limit some uses of your data.
- Nominate someone to exercise your rights if you die or become unable to (a right under India's DPDP Act, which we offer to everyone).
- Complain to us, and then to a regulator (section 13).
To use any of these rights, email it.dev@nousattva.com from the address on your account. We'll reply within 30 days, and won't charge you. We may need to confirm it's you first.
11. Children
- Children under 13 (or the minimum age where they live) can't create their own account. In India, anyone under 18 needs a parent or guardian's verifiable consent.
- A parent or guardian can add a child as a family profile they manage. The parent controls that profile's data and can delete it at any time.
- Children's profiles can't post publicly, appear in public challenges, or be found by search.
- We don't track children's behaviour for advertising, and never show children targeted ads.
- If you think a child has given us personal data without the right consent, email it.dev@nousattva.com and we'll delete it.
12. Advertising
tendwell does not currently show ads. If we introduce them, these rules will apply:
- Personalised ads will be opt-in, and off unless you turn them on.
- Advertisers will choose a general audience, and tendwell will do any matching itself. Advertisers will only get totals, such as how many people saw an ad, never who saw it or any health data.
- Data from Apple Health and Health Connect will never be used for ads.
- Cycle and fertility data will never be used for ads or audiences.
- Paid plans will be ad-free.
We'll update this policy and ask for your choice in the app before any ads appear.
13. Information for your country
We follow the privacy and health data laws of every country where tendwell is available. When a law changes, or a new one applies, we update tendwell and this policy to meet it. Where a local law gives you more rights than this policy describes, you have those rights too.
Australia
We handle personal information under the Australian Privacy Principles. Health information is sensitive information, and we collect it only with your consent. If you're not satisfied with our response to a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. You may use tendwell under a pseudonym (your username) where it's practical.
Singapore
Our Data Protection Officer can be reached at it.dev@nousattva.com. If you're not satisfied with our response, you can contact the Personal Data Protection Commission at pdpc.gov.sg.
India
For any grievance about your personal data, contact our grievance officer at it.dev@nousattva.com. We'll respond within the time the law sets. If you're not satisfied, you can complain to the Data Protection Board of India.
United States
We treat health data as "consumer health data" under state laws such as Washington's My Health My Data Act and Nevada's SB 370. We collect it only with your consent, use it only to provide tendwell, never sell it, and share it only with the people and providers described in this policy. You can confirm, access, delete and withdraw consent as described in section 10. If we deny a request, you can appeal by replying to our answer, and contact your state attorney general if you're not satisfied with the outcome.
European Union and United Kingdom
tendwell is not yet offered in the EU or UK. We'll update this policy before it is.
14. Changes to this policy
We'll update this policy when tendwell or the law changes. If a change matters, we'll tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it. The date at the top shows when it was last changed.
15. Contact us
Nousattva Pty Ltd
it.dev@nousattva.com