Tiven

Privacy Policy

Updated October 30, 2026

Tiven (the "App") is a tool for organizing and recording personal and family health information and medical expenses. It helps you keep lab reports, medical records, exam reports, imaging, medical receipts and bills, and other materials in one place, structure them, and view them over time.

The App does not provide any medical diagnosis, interpretation, treatment, or medication advice. All values and information come from original materials you upload or from Apple Health or Health Connect data sources you explicitly connect; rely on those original sources and your doctor's judgment.

This policy explains what information we collect, how we use and protect it, and the rights you have.

Who we are

The App is provided and operated by TIVEN LIMITED, a company incorporated in Hong Kong.

If you have any questions about this policy, email us at support@tiven.ai.

What information we collect

We collect only the information needed to provide the features:

• Account information: the email address you provide when registering, or the identifier and (if you authorize it) name and email returned by Sign in with Apple / Google.
• Health and medical-expense records (sensitive personal information): the lab reports, medical records, exam and imaging reports, medical receipts, bills, insurance statements, and other files and images you choose to upload, along with the structured information such as metrics, medications, visits, printed monetary amounts and payment status extracted from them.
• Forwarded report emails: for emails sent to a member's private forwarding address, we keep only the PDF and image attachments and the sender's address (shown as the source in the file inbox). The subject, body and original message are not kept after processing. You can change the address in the App at any time, and the old one stops working at once.
• Family member profiles: the profiles you create for yourself or family members (name, relationship, sex, date of birth, etc.).
• Shared-profile access and device health data: a profile manager can invite another person under a specific role. After accepting, the profile subject may authorize read-only access to selected Apple Health vitals on iOS or to activity, vital signs, sleep, weight, and height categories in Health Connect on Android. Imported structured records are uploaded to Tiven's active cloud database so they can be organized, used across devices, and viewed by the profile manager and other authorized participants. Cloud storage is used only for original files that users upload, not for these Apple Health or Health Connect structured records. The App never writes data to Apple Health or Health Connect. You can disconnect Apple Health or Health Connect in system settings and delete an individual imported record, a member profile your account manages, or your account and its data. We request only the health-data categories needed for features you choose, do not sell your data, and do not use health data for advertising.
• Device permissions: the camera and photo library are used only when you choose to take a photo or pick an image to upload; Apple Health or Health Connect is accessed only after the profile subject explicitly authorizes it. On Android, importing Health Connect history from more than 30 days ago requires the user to separately authorize READ_HEALTH_DATA_HISTORY; declining that permission only limits the historical depth and does not prevent import of the more recent categories already authorized. Push notifications can be turned off in system settings at any time. Add to Calendar opens the system's new-event screen only when you tap it; the App does not read your calendar.
• Usage and diagnostics: after sign-in, first-party usage analytics is limited to a field allow-list of product-usage events, is associated with your account identifier, and does not include the contents of your health or expense records. Crash, security, and operational diagnostics may contain account or object identifiers or exception or network context. We process those diagnostics only as needed for security, troubleshooting, and operations. Usage analytics can be turned off in Settings → Data & Privacy.
• Apple Ads attribution (iOS): when you are signed in and usage analytics is on, the App asks Apple once per installation whether the download came from one of our Apple Ads campaigns. The token used for this request is sent only to Apple. If Apple attributes the installation to our ad, we record the campaign, ad group, keyword and ad identifiers, the App Store country or region, whether it was a first download or a redownload, and whether it followed a tap or a view; otherwise we record only that there was no attribution. This record is linked to your account like other usage analytics and does not use the advertising identifier.
• Network and location: our first-party receiver records the full public IPv4/IPv6 address and time of each accepted upload. A VPN or proxy may expose only its exit address. Country analytics use the region selected in your device’s system settings; an unavailable region remains unknown. This setting does not establish your actual location or store-account country; we do not collect GPS or precise location. A delayed upload address does not establish where an earlier event occurred.
• Feedback diagnostics: when you send in-app feedback, we store its text and attachments, the app version, build number and update channel, and the request IP address so we can investigate and respond.
• Website statistics: when you visit tiven.ai, we count page views and clicks on the download buttons, together with the page language, the referring site's domain, the device platform (iOS, Android or other) and the country or region. The website uses no cookies, and these statistics record no IP address or device identifier and are not linked to any account.

We do not collect GPS or precise location, contacts, or advertising identifiers, and we do not perform cross-app behavioral tracking. The country code described above is account-linked analytics based on your device’s region setting.

If you enable the optional biometric app lock (such as Face ID or fingerprint), verification is performed entirely on your device; the App does not obtain, transmit, or store your biometric data.

How we use this information

Your information is used only for the following purposes:

• Providing account registration and sign-in;
• When push notifications are off, reminding you of important follow-up items by email to your account address (the email only says that something needs attention, contains no health details and is sent at most once a week; you can turn these emails off in Settings → Notifications or with the unsubscribe link in any of them);
• Storing, automatically recognizing, structuring, and displaying your health and medical-expense records;
• Providing role-based shared-profile access and collaboration, including importing selected Apple Health or Health Connect records into the active cloud database only after the profile subject grants permission;
• Producing aggregate product-usage and active-user country statistics when usage analytics is enabled;
• Measuring which of our Apple Ads campaigns bring people who go on to use the App (such as signing up, uploading records, asking the AI assistant or subscribing) when usage analytics is enabled;
• Necessary security safeguards and troubleshooting;
• Producing aggregate statistics of visits to our website and clicks on its download buttons, to learn how people find the App.

Automatically recognized and extracted results may be saved in an unreviewed state so you can verify them against the originals. Unreviewed medical-expense records are excluded from confirmed totals. Recognition and extraction may contain errors, so rely on the original files.

We do not sell your data, do not use it to target or personalize advertising, and do not use your health data to train automated processing systems operated by us or any third party. Measuring our own Apple Ads campaigns, as described above, is the only advertising-related use.

Third-party processors (sub-processors)

To deliver the features above, some data is processed by the following contractually bound service providers. They process data only on our instructions and may not use it for any other purpose:

• Cloud hosting: Alibaba Cloud in US East hosts the infrastructure running Supabase that stores your account, records, and uploaded files.
• Document recognition and AI assistance: Mistral AI receives document contents for text recognition. OpenRouter and the model inference providers it routes requests to receive relevant document text, images of charts and other figures in documents (never photos of people), questions, conversation history, and health-record context to extract information, read the values printed in those figures, and provide retrieval and summaries. These requests pass through Tiven's backend and are processed outside your device. Questions and completed answers are also saved in Tiven for conversation history.
• Diagnostics and product analytics: limited crash diagnostics and account-linked usage and country-level activity signals are processed to maintain and improve the App. Usage and country-level activity analytics do not contain the contents of your health records. When the App selects the mainland China network ingress, crash diagnostics are processed by Alibaba Cloud (mainland China). Crash diagnostics may contain account or object identifiers and exception or network context; processing is limited to security, troubleshooting, and operational needs.
• Network and email services: Cloudflare provides network delivery and security protection for the App's API, so data sent to and from the App passes through its network; it also receives emails sent to members' forwarding addresses and passes them to the App for processing. Alibaba Cloud DirectMail sends account verification emails and reminder emails.

Analytics and crash reporting

To keep the App reliable and understand how its features are used, we process technical and usage signals such as screen names with record identifiers removed, app version, device model, and crash stack traces. After sign-in, usage events are linked to your account identifier, not anonymous, but we do not send your name or contact details with them. Collection also starts before sign-in, using a separate anonymous usage identity; that history is linked to your account when you sign in. You can turn collection off from Usage analytics on the sign-in screen. Defined operation timings, outcomes, committed record changes and provider usage are included; Sentry receives exception diagnostics and ClickHouse stores custom app observations. No input values or record content are included in usage events.

Usage analytics links defined screen views, control interactions and review-prompt stages with your account, installation identifier, app and system versions, device model, language, time zone and subscription state available at the time. It excludes input values, health and expense content, file names and advertising identifiers. On iOS, it also includes the Apple Ads attribution described above, recorded once per installation.

The encrypted device queue retains unsent events for up to 7 days. New event and context details are retained without a fixed expiry; raw IP addresses are stored separately with restricted access for 14 days, then excluded from analytics and removed by cleanup. Turning usage analytics off stops device collection and clears its queue immediately; server collection stops when the account preference reaches us, with offline changes synchronized later. Previously collected analytics are not retracted. Account deletion removes active analytics and IP records; minimal deletion receipts prevent old events from returning. Older country-activity aggregates remain until account deletion. Necessary security and operational logs have separate retention controls. Logs we control are deleted when no longer needed; service-provider logs are subject to applicable retention and deletion controls.

Cross-border data transfers

The App stores your account, records, and files with Supabase in US East. Uploaded file contents may also be processed outside your country or region solely to provide automated organization features. Forwarded emails and data sent to and from the App travel through Cloudflare's network, and verification and reminder emails are sent through Alibaba Cloud DirectMail; these services may also process data outside your country or region.

As a result, your data may be transferred across borders. If you are in the EU or UK, this may constitute a transfer to a third country under GDPR Articles 44–49. By using the App and uploading files, you acknowledge this processing. If you do not accept it, do not upload files.

Data storage and security

We take the following measures to protect your data:

• All data is encrypted with HTTPS in transit;
• The database uses row-level security (RLS) and role checks so data is accessible only to the account owner and participants explicitly authorized for a profile, within their granted roles;
• Files are kept in private storage buckets with per-user access isolation.

Data retention and deletion

Data owned by your account is retained until you delete it or close your account.

You can permanently delete your account and the data owned by it (including its members, records, lab reports, medical expenses, imaging, and account-linked country-activity records) under "Settings → Delete account." This action cannot be undone; that data is removed from our active database and active storage.

Disconnecting Apple Health or Health Connect stops future imports or syncing but does not delete records already imported into the App. You can delete imported records from profiles your account manages in the App. If you access a profile managed by another account, leaving that access or deleting your own account stops future access and health-platform imports or syncing but does not delete records already imported into the manager's profile. The profile manager controls and can delete those records in the App.

Limited security, crash, and operational logs are retained only while needed for security, fraud prevention, troubleshooting, or legal obligations. Logs we control are then deleted; service-provider logs are subject to applicable retention and deletion controls. Limited residual copies in system or provider backups, if any, are used only for disaster recovery, are not available for routine product access, and remain until overwritten or retired under the applicable lifecycle. Deletion obligations continue to apply after a recovery. To prevent an old JWT or background task from recreating deleted storage, deletion temporarily stores a safety marker containing only the raw account UUID. It does not contain your email address or health-record content. The marker is removed immediately after a normal successful deletion; if cleanup is interrupted, an automated cleanup removes it within 24 hours. Store transaction records remain with Google Play, Apple, or their payment processors under their policies.

Your rights

You have the following rights regarding your data:

• Access and correction: view and modify information and records that you own or are authorized to manage, anytime in the app;
• Export: obtain a structured data export (JSON / CSV, with capabilities expanding over time) via "Settings → Export my data";
• Deletion: delete individual records or members that your account owns, or close your account to delete the data owned by it.

Depending on the laws of your region (such as China's PIPL, the EU's GDPR, or California's CCPA), you may have additional rights. For assistance, contact support@tiven.ai.

Children

The App is intended for adults. If you, as a guardian, enter health records for a minor family member, you must ensure you are entitled to do so. We do not knowingly collect information submitted by children under 13 themselves.

Changes to this policy

When this policy is updated, we will revise the date at the top; significant changes will be announced prominently in the app.

Contact us

TIVEN LIMITED

Company registration number: 81341300

Registered address: Room D07, 8/F, Kai Tak Factory Building Stage 2, 99 King Fuk Street, San Po Kong, Kowloon, Hong Kong

support@tiven.ai