Tenpace Health Privacy Notice

Effective September 10, 2026 · Beta version 2026-09-10

This notice supplements the general Tenpace Privacy Policy for Tenpace Health (“Health”). Health handles information that may reveal details about your health, body, diet, and activity. We designed the beta around explicit consent, member-controlled Household sharing, export, and deletion.

Information Health processes

Account details from Tenpace, including your user ID, email, display name, profile image, and timezone.
Goals, schedule, available equipment, dietary preferences, limitations, and coaching preferences.
Workouts, exercises, loads, repetitions, nutrition entries, recipes, body measurements, notes, and files you upload.
A packaged-food barcode you scan or enter when you ask Health to look up its label data, together with the source record selected for your editable review.
Agent conversations and the context needed to answer or carry out your request when you opt into AI processing, including transcripts created from voice notes you choose to send.
An optional good or bad rating you give a completed Bel conversation, its revision and timestamp, and the private conversation link needed to review a bad rating.
Security and reliability data such as a hashed IP address, browser information, consent history, timestamps, and model usage totals.
For the native app, limited crash diagnostics such as app and build version, device model and Android version, exception type, message and stack, and the operating system’s process-exit reason. Credential and email patterns are redacted on the device before an authenticated upload on the next launch.
Historical body measurements and completed activities previously imported from Android Health Connect, including their timestamps, source-app name and package, and source record identifiers used to preserve provenance and prevent duplicate records.
If you create a Pantry, its name, foods, optional private address label, optional recognition coordinates and range, active-Pantry selection, and optional Household association. If you enable nearby suggestions, your device also sends its current coordinates and reported accuracy when it checks for a match.
If you use activity profiles, your section-by-section audience choices, public-profile setting and link identifier, support preference, and the aggregate activity used to assemble the profile.

How we use it

We use this information only to authenticate you, operate and improve the features you request, maintain your history and plan, provide optional AI assistance, prevent abuse, secure the service, respond to support requests, and comply with law. We do not sell Health data, use it for targeted advertising, or permit data brokers to use it.

Pantry location recognition

Pantry location is optional and nearby suggestions begin off. An address is a private label and does not itself grant location permission. You choose whether to capture a recognition point from a device and whether Health may check the device’s location. Health compares a location on the server, suggests a matching Pantry, and waits for you to switch; it does not switch automatically. You can turn suggestions off, clear a Pantry’s recognition point, remove its address label, or delete the Pantry.

A Pantry shared with a Household exposes its name, owner, food assignments, and whether recognition is available to active members. Its address label and exact stored coordinates are not returned to visiting members. A visitor’s current coordinates are used to find a visible match and are not added to their Health history. Removing or leaving the Household ends future access under the same membership checks as other Household data.

Historical Android Health Connect data

Tenpace no longer connects to or imports new records from Android Health Connect. The native app asks for no Health Connect permissions and schedules no connected-health work.

If you used this feature previously, imported body measurements and completed activities remain in your private Health account with their source and time metadata. They remain readable, exportable, and available to normal history, trend, recap, and rhythm calculations. Historical imported records are read-only. Tenpace never imported GPS tracks, route points, or live location.

Historical imported activities remain private in each Circle unless you explicitly share a source summary. You can review or revoke that visibility in Circle Settings. You can export historical imported data or delete your Tenpace Health account through its account controls. It is not sold, used for advertising, or shared with data brokers.

AI processing

AI-assisted guidance is part of the initial Health setup and requires a separate acknowledgement before setup can be completed. Relevant messages, attachments, profile context, and recent Health records may be sent through Tenpace’s server-side account to its contracted AI provider to answer your request. We do not ask you to provide a personal API key or third-party login. After setup, you can withdraw AI processing in Settings; manual tracking remains available when it is off.

When you send an Agent voice note, its audio is sent through Tenpace to the contracted AI provider for transcription. Tenpace processes the raw recording in memory and does not add it to your Health records, Agent attachments, or private media storage. The native app deletes its temporary recording file immediately after reading it for upload. The resulting transcript becomes the user message in your Agent conversation and is retained, exported, and deleted under the same rules as other Agent messages.

You can optionally rate a completed Bel conversation as good or bad and change that rating later. A current bad rating queues a private quality review. An authorized Tenpace automation may inspect that conversation locally, decide that no change is justified, or make and deploy a narrow, tested product improvement. The review notification does not include your identity, transcript, attachments, or Health records. Health sends the central Tenpace feedback system only the rating, selected date, opaque feedback reference, and revision; the transcript remains in Health.

Packaged-food barcode lookup

When you choose barcode lookup, Health sends the barcode and only the bounded query fields needed to find an exact branded-food record to USDA FoodData Central. Health does not send USDA your Tenpace account, selected date or meal, nutrition history, search history, or AI conversation. This lookup does not use the AI provider or your AI allowance.

Results are labeled as USDA FoodData Central brand-supplied label data, not as USDA-verified nutrition. Providers remain responsible for their label information, missing nutrients do not mean zero, and label rounding can vary. Health freezes the selected source record for an editable review and asks you to compare it with the package before confirmation. The shared source cache contains no account, date, meal, scan-history, or request identifiers.

Circles feed and following

You may choose a unique public-facing @username and follow other Health members who have claimed one. Your profile stores follower and following relationships and counts. Following alone never grants access to meals, nutrition, measurements, limitations, routes, GPS, private notes, or Household data. Completed-workout summaries enter followers' Circles feeds only when you explicitly choose follower activity-feed visibility; the default is Private. You can unfollow someone or turn feed visibility off at any time.

Households, automatic support, and deliberate sharing

A Health Household is a private collaboration space for adults you invite. When you join, your recipes, saved ingredients, and meal entries are fully visible to active Household members by default. Workouts begin private. You can change each category to private, summary, or full visibility. You can also override the setting for one item. Body measurements, general health profile details, limitations, and Agent conversations are never shared through these item-sharing controls. The separate activity-profile controls described below govern only the aggregate profile sections you deliberately choose.

Household Highlights are built from completed workouts currently visible to that Household and completed support open loops. They do not include meal or nutrition logs, measurements, missed days, skipped plans, or cancelled plans. Highlights appear only when qualifying activity exists, with older highlights available on demand. A member can leave or remove one Cheer on another member’s shared workout; the Cheer count and Household member identity are visible inside that Household. Health can notify the workout owner about a Cheer under the separate Cheer notification preference.

When you save a Weekly Split, Health automatically creates or updates a private support relationship between you and each active member of every Household you belong to. Each member sees only their own pairwise support relationship with you. Health may notify those members that you updated your split and surface dated active-day open loops when a check-in can help. Joining a Household is the consent boundary for this automation; leaving or being removed ends future support in that Household.

Automatic support stores the relevant Weekly Split schedule, local time and timezone, the owner and Household member, and generated dated open loops. Changing a future split day to Rest cancels generated future loops for that day; moving one loop changes only that occurrence. Completing a matching workout can close its linked open loop automatically. The owner may mark a dated loop starting, moved, skipped, completed, or in need of help. A Household member may check in or add a note but cannot change the owner’s health record. Prior events remain in the support history.

The current-week Household recap is calculated automatically from active members’ current Weekly Splits and matching meaningful completed workouts. A manually completed support loop may also confirm completion. Pairwise support rows are not counted as separate planned sessions. The recap shows collective planned, completed, and remaining totals and may identify members who completed their planned week. A separate “Your rhythm” result is visible only to you and compares your week-to-date meaningful-workout count with the same elapsed days in your four prior weeks. Neither feature creates a leaderboard, health score, or public challenge.

You can invite your Household to an upcoming activity already in your Weekly Split. A shared session stores the Household, activity title and category, scheduled date and optional time, leader, members who join or leave, and matching workout completion references. It does not collect a route, live location, chat, or participant ranking. Only active Household members can see or join it; the leader can cancel it, and each other participant can leave independently. Removing or leaving the Household ends access.

Active Household members can see only items that are currently visible. Full sharing lets a member copy an item into their own log. The copy keeps the source owner’s name. Later edits do not change that copy. Removing or leaving a Household stops future access immediately.

Activity profiles and public sharing

Activity-profile sections are visible to active members who share a Household with you by default. You can hide any section from your Household or make it public from Profile sharing settings. Sections can include a 365-day activity map, this week’s planned-versus-completed Weekly Split summary, 90-day activity mix, recent activity and personal-record highlights, support preferences and an aggregate “support helped” count, and Household information. A Household viewer sees only Household names you both share. A public Household section shows only a count and never member or supporter names.

The public profile itself is off until you enable it. When enabled, its stable link can expose your Tenpace display name, profile image, and only sections set to Public to anyone with the link and potentially to search engines. Turning the public profile off makes that link unavailable; changing a section to a narrower audience removes it from later public responses. Public profiles do not include email, meals, food names, macros, weight, measurements, limitations, detailed workout notes, skipped commitments, or supporter identities.

Agent access to visible household items is enabled by default. You can turn it off for all your visible items or block one item. The Agent receives an item only when that item is visible to the member. A separate setting, enabled by default and available to turn off at any time, allows Bel on another active member’s account to add nutrition entries to your log when that member explicitly requests it. Those entries identify their creator. Membership, invitation, sharing changes, item changes, Agent-created entries, and reuse create a bounded Household audit record that does not store the item’s contents.

Reminders and notifications

Health can show in-app or device notifications for Household encouragement, Cheers, legacy reactions, unfinished workouts, and reminders you enable. Household encouragement, Cheers, and workout reminders begin enabled and can be turned off separately. Macro reminders are off by default and require you to opt in. You can also turn off all Health reminders, choose quiet hours, revoke Android notification permission, or change a device’s operating-system settings. Notification text is intentionally brief and does not include measurements, limitations, Agent conversations, or a detailed meal record.

Storage, access, and security

Health data is separated by account in the application database. Uploaded files are held in private object storage and are served only after an ownership check. We use encrypted transport, access controls, expiring sessions, dependency and deployment checks, and encrypted backups. No security program can guarantee zero risk.

Service providers and disclosures

We disclose data only to providers needed to host, secure, back up, and operate Health; to the AI provider when you enable AI; when you direct us to; or when law or safety requires it. Providers receive only the data needed for their role and are expected to protect it. We do not share Health data with employers, insurers, advertisers, or social networks unless you explicitly direct us to.

Retention and deletion

We retain Health data while your Health account is active. You can download a machine-readable export and permanently delete the Health account in the product. Deletion removes live account data and private media promptly. Encrypted backup copies expire on the backup schedule and are purged within 30 days. We retain a minimal, non-reversible deletion audit containing a hashed Tenpace identifier and purge deadline so we can verify the request was honored.

If you own a Household when deleting your account, ownership transfers to the longest-standing remaining active member; a Household with no other active member is deleted. Source snapshots attached to another member’s reused item are purged and marked as deleted, while the independent item that member intentionally added to their own log remains theirs.

Health sends the central Tenpace billing service your Tenpace user ID and an account-deletion lifecycle event so dependent access can be revoked and an owner’s next Health renewal can be canceled. This event contains no measurements, meals, workouts, profile details, or Agent content. Central subscription, invoice, credit, tax, refund, and dispute records follow the retention described in the general Tenpace Privacy Policy.

Your choices

Review and correct profile or tracking information.
Export your Health data.
Withdraw or later re-enable AI processing after setup.
Rate a Bel conversation and change that rating later.
Control Household membership and visibility, activity-profile audiences, public-profile availability, and reminder preferences.
Manage Pantry addresses and recognition points, disable nearby suggestions, or deny device location permission.
Review or revoke Circle visibility for historical imported activity.
Delete the Health account without deleting your Tenpace account.
Contact us about access, correction, or privacy questions.

Health and legal status

Health is a consumer wellness product, not a healthcare provider, medical record system, or emergency service. Depending on where you live, consumer-health privacy or breach-notification laws may apply even when medical privacy laws designed for healthcare providers do not. We will provide notices and honor rights required by applicable law.

Age limit

The beta is for adults 18 and older. We do not knowingly collect Health data from children.

Changes and contact

Material changes will be shown in the product and may require renewed consent. Questions or requests can be sent to [email protected].

← Back to Tenpace Health