Privacy policy

General information

Shen.AI OÜ (“Shen.AI”, “us”, “our” or “we”) protects the privacy rights of our users (“you”). This Privacy Policy (“Policy”) lays out the general rules for processing the data you provide or we collect when you use BP Diary and its website at bdiary.app (“Services”).

Information relating to an identified or identifiable person is personal data. We process personal data in accordance with the General Data Protection Regulation (GDPR), applicable Estonian data protection law and other applicable data protection laws. Additional information or consent requests for a particular feature explain any rules specific to that feature.

Who is processing your personal data?

Shen.AI OÜ is the data controller responsible for the Services.

Address: Lõõtsa tn 8a, 11415 Tallinn, Estonia

Privacy requests: data@shen.ai

Data Protection Officer: dpo@shen.ai

Why are we processing your data?

Your data is processed for the following purposes:

• Providing the diary, measurements, calibration, reports and other features you request.
• Maintaining and protecting the Services, diagnosing problems and understanding how the Services are used.
• Responding to your questions and requests, fulfilling our legal obligations and establishing, exercising or defending legal claims.
• Where you separately agree, conducting non-medical research to develop and improve Shen.AI measurement technology.

Participation in research is voluntary. Declining research participation does not prevent you from using the diary or measurement features. BP Diary carries no advertising or sponsored health recommendations.

What data are we processing and how do we collect it?

Your diary, profile and account

BP Diary processes the blood pressure and pulse readings you record, their dates and sources, your notes and related calibration information. You may also provide optional profile information, including your name, age, sex, ethnicity, country, body measurements, lifestyle and relevant medical history or laboratory results.

You can use the diary without an account, with your diary and profile stored on your device. Signing in enables cloud synchronization of your diary, profile and preferences. Account information includes your email address, account identifiers and information supplied by your chosen sign-in service. Signing out or uninstalling the app does not delete your cloud account.

Reports and exports contain the information you select. When you share them, the recipients or applications you choose receive that information. Previously shared copies cannot be recalled. Measurement reminders are scheduled on your device. Website calculators process the values you enter in your browser.

Camera measurements and cuff photographs

Shen.AI technology analyzes facial skin signals to estimate blood pressure, heart rate and other physiological measurements. The purpose of this analysis is to obtain health measurements, not to identify you. Physiological analysis takes place on the device; the SDK also communicates with Shen.AI services for authorization, analysis, calibration and technical operation.

Depending on the feature and applicable consent, this processing can involve health measurements, calibration readings, blood-flow signals, low-resolution facial textures and technical information. Any collection of a facial photograph for research or product development must be explained as part of the relevant consent.

When you photograph or select an image of a cuff display, its encoded image is passed to the Shen.AI service for recognition. You review the recognized numbers before saving them. The diary stores the confirmed readings rather than the cuff photograph.

Participation in non-medical research

Research aims to develop Shen.AI technology for measuring cardiovascular parameters. Where you choose to participate, the separate research explanation identifies the data involved and how it will be used. This may include physiological signals, camera-derived information, cuff measurements and relevant profile information. Research participation requires separate consent; permission to use your camera does not by itself authorize research.

Automatically collected information

The Services also process technical and usage information, such as device and browser details, app versions, interactions, timestamps, identifiers, approximate location derived from an IP address and diagnostic records. Some of this information may be associated with your account.

We use PostHog for app and website analytics and Sentry for diagnostics. Cookies and similar storage also support sign-in, local data and preferences. The applicable notice and choices distinguish optional analytics from processing needed to provide the Services. Where consent is required, it must be obtained before the processing concerned begins.

Legal basis for personal data processing

We process health information and optional ethnicity on the basis of explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR. A separate consent covers participation in research.

We process ordinary personal data necessary to provide the Services you request under Article 6(1)(b). Proportionate security, maintenance and essential diagnostics rely on our legitimate interests under Article 6(1)(f), subject to your rights. Optional analytics relies on consent where required. Processing required by law relies on Article 6(1)(c).

Providing data is voluntary, but some information is necessary for the feature you request. Withdrawing consent necessary for that feature may make it unavailable. The Services do not make decisions about you that produce legal or similarly significant effects solely through automated processing.

Who may access your data?

Within Shen.AI, access is limited to personnel who need the information for their work. Our service providers process information needed to operate the Services, including Cloudflare for hosting and cloud storage, the analytics and diagnostic providers named above, and Apple or Google when you use their sign-in services. Data may also be disclosed where required by law or necessary to address legal claims.

Providers may process data outside the European Economic Area. Where international-transfer rules apply, appropriate safeguards are required, such as an adequacy decision or standard contractual clauses. Contact data@shen.ai for information about the safeguards applicable to your data and how to obtain a copy.

How long do we store your personal data?

We keep diary and account information for the period you use the Services, until you delete the records or your account. Your diary history does not expire simply because readings become old. Local records remain until you delete them or clear the app’s storage.

Other information is retained for the period needed for its purpose, including resolving a support request, investigating a technical or security incident, or completing the research described when you consent. Backup copies follow the applicable backup retention cycle. Legal obligations or the establishment, exercise or defence of legal claims may require limited information to be retained longer.

When information is no longer needed and there is no lawful reason to retain it, it must be erased or anonymized. Withdrawal does not affect the lawfulness of processing carried out before it.

Information about your rights

Under applicable law, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent at any time.

You can delete readings, clear your diary or delete your account through the app’s Settings. To request account and data deletion without using the app, email data@shen.ai with the subject “BP Diary account and data deletion”. Where possible, use the email address associated with your account. We may ask for information needed to verify your identity; you do not need to send your health readings with the request.

Send other privacy requests to data@shen.ai. You may also complain to the Estonian Data Protection Inspectorate at info@aki.ee, or another competent data protection authority.

Age restriction and changes to this Policy

The Services are for adults aged 18 or older. If we learn that we have inadvertently collected personal data from a younger user, we will take reasonable measures to erase it.

We may update this Policy when the Services or data-processing arrangements change. Changes will be communicated through the website and, where appropriate, directly to you. Where a new use requires consent, we will request it before that use begins.