Privacy Policy · Heart Monitor

1. General information

Shen.AI OÜ (hereinafter: “Shen.AI”, “we”, “us” or “our”) respects the privacy of the users of its application (hereinafter: “users” or “you”). This Privacy Policy (hereinafter: “Policy”) explains how we process the data that you provide to us or that we collect in connection with your use of our application (hereinafter: “Application”) and related Services. All data and other information that you provide to us or that we collect are referred to as “Data”.

Where Data relate to an identified or identifiable natural person, they constitute personal data and are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “GDPR”), and other applicable data protection laws.

Because the Application uses the camera of your device to analyse your face, section 6 (Face Data) describes in detail what Face Data we collect and how we use, share, store, retain and delete them.

If you do not agree with this Policy, please do not install or use the Application.

2. Definitions

For the purposes of this Policy:

Services – all products and services provided by Shen.AI, including our website, software, the Application and related functionalities.
Face Data – any information relating to your face that the Application obtains through the camera of your device, namely the Live Video Stream, the signals obtained through Facial Texture Analysis, the face-position information used to locate your face in the video, and Facial Images. Face Data are never used for biometric identification, authentication or verification of users, and no biometric templates are created.
Live Video Stream – the real-time video from the front camera of your device during a measurement. It is processed entirely on your device and is never stored or transmitted.
Facial Image – a single low-resolution still image of your face captured from the Live Video Stream during a measurement. A Facial Image is uploaded to our servers only if you give your separate, explicit consent (section 6.2).
Facial Texture Analysis – temporary, on-device detection of skin colour changes and micro-movements in the Live Video Stream, used solely to calculate Biosignal Data.
Biosignal Data – numerical wellness measurements (e.g. heart rate, breathing rate per minute) derived on your device from the Live Video Stream. Biosignal Data cannot be used to recreate your face. Biosignal Data linked to you (e.g. to your account, if you have one, or to a pseudonymous identifier) are personal data concerning health.
Personal Data – any information relating to an identified or identifiable natural person, as defined in the GDPR.
Affiliates – companies controlled by Shen.AI OÜ.
Processors – service providers that process personal data on our behalf, only on our documented instructions and under a data processing agreement concluded in accordance with Article 28 of the GDPR.

3. Who is the controller of your personal data?

Shen.AI OÜ is the sole controller of your personal data. Our contact details:

Estonia: Lõõtsa tn 8a, 11415 Tallinn;
Poland: ul. Gwiaździsta 66, 54-413 Wrocław;
e-mail: office@shen.ai.

To maintain the highest level of privacy, we are supported by a professional Data Protection Specialist, Jarosław Wojcieszek, who can be contacted at dpo@shen.ai.

4. Why do we process your Data and on what legal basis?

We process your personal data only for the purposes listed below. For each purpose we indicate the applicable legal basis under the GDPR.

a) Provision of the Application’s wellness features

On-device, real-time analysis of the Live Video Stream (including Facial Texture Analysis) in order to calculate Biosignal Data and general wellness insights (see section 6).
Storing and displaying your measurements, wellness insights, BMI and hydration calculations, medication reminders and test results you enter, and synchronising data with Google Health Connect at your request.

Legal basis: for account data (if you choose to create an account) – performance of the contract (Article 6(1)(b) GDPR); for Face Data, Biosignal Data and other health and wellness data – your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR).

b) Registration and performance of the contract

Creating and maintaining your account, if you choose to register one, and delivering the Services in accordance with the applicable terms and conditions, including handling your subscription.
Taking steps at your request before entering into a contract and handling your inquiries, comments and questions (pre-sales and customer service).

Legal basis: performance of the contract or taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

c) Maintenance, security and improvement of the Services

Ensuring access to the Services and their stability and security, including diagnosing errors and crashes.
Statistical analysis of how the Application is used, including analysis of wellness measurement values (e.g. breathing rate per minute), in order to understand user preferences, assess the quality of measurements and improve the user experience.

Legal basis: for technical and usage data – our legitimate interest in ensuring the availability, quality, functionality and security of the Services (Article 6(1)(f) GDPR); for wellness measurement values – your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR). Face Data are never used for this purpose.

d) Research and development of our measurement technology

If you give your separate, optional consent, we use Facial Images, together with the Biosignal Data from the same measurement, to research and improve the accuracy and reliability of the Application’s camera-based measurements (e.g. to test and develop Shen.AI’s own measurement algorithms). This research is non-biomedical and is carried out exclusively by Shen.AI.

Legal basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR), which you may withdraw at any time.

e) Communication and marketing

Informing you about our promotions, rewards and upcoming events.
Sending you news about our products and Services.

For communication and marketing we use only your e-mail address (and, where applicable, your name), if you have provided them. Face Data, Biosignal Data and other health data are never used for marketing or advertising purposes. We do not send you offers of third parties.

Legal basis: our legitimate interest in direct marketing of our own products and Services (Article 6(1)(f) GDPR) or, where the law on electronic communications requires prior consent, your consent (Article 6(1)(a) GDPR). You may unsubscribe at any time using the link included in each message or by contacting us.

f) Legal claims and legal obligations

Establishment, exercise or defence of legal claims.
Compliance with legal obligations, e.g. handling your requests concerning your rights or responding to requests from public authorities.

Legal basis: our legitimate interest in protecting our rights (Article 6(1)(f) GDPR) and compliance with a legal obligation to which we are subject (Article 6(1)(c) GDPR).

g) Optional features based on external AI services

If you choose to use an optional feature of the Application that relies on an external artificial intelligence provider, we share with that provider only the data necessary for that feature, solely to provide that feature to you (see section 8(f)).

Legal basis: your explicit consent (Article 6(1)(a) GDPR and, where health data are concerned, Article 9(2)(a) GDPR), which you may withdraw at any time.

5. What Data do we process and how do we collect them?

5.1 Account data

You can use the Application without creating an account. Registration is optional. If you choose to register, you provide your e-mail address, first name and surname, which we use to create and maintain your account and to provide the features that require one. If you use the Application without an account, we do not collect your e-mail address or name.

5.2 Subscription data

If you purchase a paid subscription through an app store (e.g. Apple App Store, Google Play) or another payment provider, we receive from that provider information about your subscription: its variant, period, status and cancellation. We do not receive or store your full payment card details. The payment itself is processed by the relevant app store or payment provider as an independent controller, in accordance with its own privacy policy.

5.3 Face Data

During a measurement the Application uses the front camera of your device. The collection, use, sharing, storage, retention and deletion of Face Data are described in section 6.

5.4 Health and wellness data

When you use the Application, we process your wellness-related data, including Biosignal Data, in order to provide general wellness insights related to your lifestyle, cardiovascular fitness, breathing, stress and sleep, as well as BMI and hydration calculations, medication reminders and test results you enter, and data imported from Google Health Connect (section 7). These insights are provided for general wellness purposes only and do not constitute a medical diagnosis or treatment advice.

Providing these data is voluntary, but necessary to use the relevant functionalities of the Application.

5.5 Technical and usage data

When you use the Services, we automatically collect standard technical data from your device, in particular: device type and hardware components, operating system, data about your use of the Application (analytics), crash reports and diagnostic data, quality and performance indicators of the Services on your device, and your approximate location (country or city level) derived from your IP address.

These data are necessary for us to provide and maintain the Services. If you do not want such data to be collected, you should not install or use the Application; if you have already done so, see section 12.

5.6 Cookies

Our website may use cookies and similar technologies, as described in a separate cookie policy. Where such data, alone or combined with other information, allow you to be identified, we apply to them all the principles set out in this Policy.

6. Face Data

6.1 What Face Data we collect

During a measurement, the Application accesses the front camera of your device and processes the following Face Data:

Live Video Stream – analysed in real time entirely on your device. It is never stored and never leaves your device.
Facial Texture Analysis signals and face-position information (the area of the video in which your face is located) – computed on your device only to calculate Biosignal Data. They are never stored and never leave your device.
Facial Image – one low-resolution still image of your face per measurement. It is uploaded to our servers only if you have given your separate, explicit consent described in section 6.2.

The following data leave your device in connection with a measurement:

numerical Biosignal Data (e.g. heart rate, breathing rate per minute), which cannot be used to recreate your face; and
only if you have given your consent under section 6.2 – one low-resolution Facial Image per measurement.

No other Face Data leave your device.

Before the first measurement, the Application asks for permission to access the camera and explains how Face Data are processed. Before any Facial Image is uploaded, the Application asks for your separate, explicit consent, explaining what is sent (a low-resolution still image of your face), to whom and for what purpose. This consent is optional: if you do not give it, no Facial Image leaves your device and you can still use all measurement features. You can withdraw your consent at any time in the Application settings or by contacting us at data@shen.ai; from that moment no further Facial Images are uploaded.

6.3 How we use Face Data

The Live Video Stream, Facial Texture Analysis signals and face-position information are used solely to calculate Biosignal Data and display your wellness results in the Application.
Facial Images are used solely for research and development aimed at improving the accuracy and reliability of the Application’s camera-based measurements, as described in section 4(d).
We do not use Face Data for identification, authentication or verification of users, for advertising or marketing, to build user profiles, or for any purpose unrelated to the Application’s measurement function. We never sell Face Data.

We do not share, transfer, sell or otherwise provide Face Data to any third party, including advertising platforms, analytics providers, data brokers, information resellers or any external artificial intelligence or machine learning provider. Facial Images are accessible only to authorised Shen.AI research and development personnel who are bound by confidentiality obligations.

6.5 Storage of Face Data

The Live Video Stream, Facial Texture Analysis signals and face-position information exist only temporarily in your device’s memory during a measurement. Facial Images uploaded with your consent are stored in encrypted form on secure servers located in the European Economic Area and used exclusively by Shen.AI.

6.6 Retention and deletion of Face Data

The Live Video Stream, Facial Texture Analysis signals and face-position information are not retained – they are discarded as soon as the measurement ends.
Facial Images are retained until you delete your account (if you have one) or withdraw your consent, whichever happens first. They are then permanently deleted from our servers and from all our research and development datasets within 30 days.
You may also request deletion of your Facial Images at any time, without deleting your account, by contacting us at data@shen.ai.

7. Google Health Connect

At your request, the Application may connect to Google Health Connect in order to read health and activity data that you choose to synchronise. We request only the permissions we need, and you can revoke them at any time in the Health Connect settings.

Imported data may include, in particular: active calories burned, blood glucose, blood pressure, distance, floors climbed, heart rate, heart rate variability (RMSSD), height, hydration, oxygen saturation, respiratory rate, sleep sessions, sleep stages, steps, weight and other health records.

We process data obtained from Health Connect on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR) and only to provide or improve the Application’s features. We do not use these data for any other purpose and we never transfer them to advertising platforms, data brokers, information resellers or any of the Processors listed in section 8(c). Our use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

8. Who may access your Data?

We do not sell your personal data and we do not share them with third parties for their own marketing or advertising purposes. Your personal data may be accessed only by the following categories of recipients, and only to the extent necessary for the purposes described in section 4:

a) Our personnel – employees and associates who need access to perform their duties and who are bound by confidentiality obligations.
b) Our Affiliates – companies controlled by Shen.AI OÜ and their personnel, who process the data under the same rules as set out in this Policy. Face Data are not disclosed to Affiliates.
c) Processors – service providers acting on our behalf and only on our instructions: (i) Product analytics, with data stored in the EU, which receives technical and usage data (section 5.5) and wellness measurement values (e.g. heart rate, breathing rate per minute) linked to a pseudonymous identifier, but not your name or e-mail address; and (ii) e-mail delivery and marketing communication providers, which receive only your e-mail address and name in order to send you messages. Processors may not use your data for their own purposes. Processors never receive Face Data or data imported from Health Connect.
d) App stores and payment providers – as independent controllers, to the extent necessary to handle your subscription and payments (section 5.2).
e) Public authorities – where we are obliged to disclose data under applicable law.
f) External AI providers – only if you choose to use an optional feature that relies on an external AI service. Before you use such a feature, the Application will clearly inform you which specific data will be shared, with which specific provider and for what purpose, and will ask for your explicit consent to that processing. The provider receives only the data necessary for that feature and only to provide that feature to you. If you do not give your consent, that feature will not be available, but you can continue to use all other features of the Application. You can withdraw your consent at any time in the Application settings or by contacting us at data@shen.ai.

Shen.AI’s own technology. All analysis of Face Data, Biosignal Data and other health and wellness data within the Application’s core features is performed by Shen.AI’s own technology. Except as described in point (f) above, and only with your consent, we do not send your data to any external artificial intelligence or machine learning provider.

9. Transfers outside the European Economic Area

We store and process your personal data within the European Economic Area (EEA), and our Processors store your data in the EEA. If a Processor’s personnel located outside the EEA could access personal data (e.g. for technical support), such access is permitted only with appropriate safeguards required by Chapter V of the GDPR, such as an adequacy decision (including the EU-U.S. Data Privacy Framework) or standard contractual clauses. If an external AI provider referred to in section 8(f) is located outside the EEA, we will inform you about this before asking for your consent, and the transfer will take place only with appropriate safeguards required by Chapter V of the GDPR. Face Data are never transferred outside the EEA.

10. How long do we store your personal data?

We store personal data no longer than necessary for the purposes for which they were collected, in particular:

Face Data – as described in section 6.6.
Account data, health and wellness data – for as long as you have an account (or, if you use the Application without an account, for as long as you use the Application), unless you withdraw your consent earlier, in which case the data processed on the basis of that consent are deleted.
Technical and usage data – for as long as necessary for the purposes described in section 4(c), after which they are deleted.
Marketing data – until you unsubscribe or object to processing for marketing purposes.
Data shared with an external AI provider (section 8(f)) – only for as long as necessary to provide the relevant feature, or until you withdraw your consent.
Data necessary for legal claims or legal obligations – for the period required by law or until the expiry of the limitation period for claims.

When you delete your account, we permanently delete all personal data linked to you, including your e-mail address, name, Facial Images and health and wellness data.

11. Security

We have implemented appropriate technical and organisational measures to protect personal data, in particular Face Data and health data, against unauthorised or unlawful access, destruction, loss, alteration or disclosure, and we require the same from our Processors. In the event of a personal data breach affecting your data, we will notify you and the competent supervisory authority in accordance with applicable law.

12. Your rights

You have the right to:

access your personal data;
have your personal data rectified;
have your personal data erased;
data portability;
restriction of processing;
object to processing based on our legitimate interests – and, at any time, to processing for direct marketing purposes;
withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not make such decisions – wellness insights are generated automatically but have no legal or similarly significant effects;
lodge a complaint with a supervisory authority.

To exercise your rights, please contact us at data@shen.ai. To speed up the handling of your request, you may specify it, e.g. by indicating which data you wish to have erased or changed, or that you do not want to receive marketing communications. If the scope of your request is unclear, we may contact you to confirm the details.

We will respond without undue delay and in any event within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months; in such a case we will inform you of the extension and the reasons for it.

Please note that the Application requires certain Data to be processed as described in this Policy. If you object to processing, withdraw your consent or request erasure of your data, you may not be able to use the full functionality of the Services, or the Services at all, depending on the type of data concerned. Withdrawing your consent to the upload of Facial Images does not limit any functionality of the Application. Withdrawing your consent to the use of an external AI-based feature only makes that feature unavailable.

If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with a supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

13. Changes to this Policy

We may update this Policy from time to time. We will inform you about material changes in the Application or by e-mail before they take effect. The date of the latest update is indicated at the top of this Policy.