T-TensorAI thyroid trackingJoin the waitlist

Privacy

Privacy Policy

Effective October 18, 2026. This policy covers the T-Tensor waitlist at thyratensor.com. The short version: we collect only what you type into the form, use it to run the waitlist and decide what to build, never sell it, and delete it when you ask.

Who we are

T-Tensor is an early-stage project building an app for people with hypothyroidism. The data controller for this waitlist is the operator of thyratensor.com (Croatia). We will add the controller's legal name here before public launch. For anything privacy-related, contact privacy@thyratensor.com.

What we collect

When you join the waitlist, we collect what you enter:

  • Email address, so we can contact you about early access.
  • Which describes you best (for example hypothyroidism or Hashimoto's). This is health data, called "special category data" under the GDPR and "consumer health data" or "sensitive data" under U.S. state laws. You can choose "Prefer not to say".
  • Where you live (U.S. state or country), so we know which regions to launch in.
  • Whether you would pay $9.99/month, to help us decide on pricing.
  • Your consent record: the date and time you agreed and which version of this policy you agreed to.

Like every website, our hosting provider processes technical data such as your IP address, browser type and request time to deliver the page, stop abuse and keep short-lived server logs. We use your IP address only in memory to limit repeated signups, and we do not store it with your answers.

We don't use cookies, analytics, advertising pixels, session recording or third-party trackers. Our fonts are served from our own domain, so no data goes to font providers either.

Why we use it and our legal basis

  • To run the waitlist and contact you about early access, and to understand who needs T-Tensor (for example how many people have Hashimoto's, or where they live). Legal basis: your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)).
  • To keep the site secure and prevent abuse using technical data. Legal basis: our legitimate interest in running a safe service (GDPR Art. 6(1)(f)).

We do not use your data for advertising, profiling, automated decisions about you, or training AI models. We will only email you about T-Tensor.

Who we share it with

We do not sell your personal data or consumer health data, and we do not share it for targeted advertising. We use these service providers ("processors") who handle data only on our instructions under data processing agreements:

  • Vercel Inc. (USA), which hosts the website and processes requests.
  • Supabase Inc. (USA), which hosts the database where your answers are stored.

These providers may process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses in their data processing agreements and, where applicable, the EU-U.S. Data Privacy Framework.

We may disclose data if the law requires it, for example a valid court order. If T-Tensor is ever acquired, we will ask for your consent again before your health data is transferred.

How long we keep it

We keep your waitlist answers until you withdraw consent or ask us to delete them, and in any case no longer than 24 months after you sign up or 6 months after T-Tensor launches, whichever comes first. Then we delete them. Hosting logs are kept only briefly under our provider's standard retention.

Your rights

Email privacy@thyratensor.com from the address you signed up with, and we will respond within 30 days (and within the deadlines of the laws below). We may ask you to confirm the request comes from that email address. Making a request is free, and we will never treat you differently for using your rights.

Everyone, including EU, EEA and UK residents (GDPR)

  • Access your data and get a copy in a portable format.
  • Correct it, or delete it.
  • Restrict or object to how we use it.
  • Withdraw your consent at any time. This doesn't affect anything we did before you withdrew, but we will delete your answers.
  • Complain to a data protection authority. In Croatia that is the Personal Data Protection Agency (AZOP), or you can contact the authority where you live.

U.S. residents

Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and others), you have the right to know what personal data we hold, to access, correct and delete it, to get a portable copy, and to opt out of the sale of personal data, targeted advertising and profiling. We don't do any of those, so there is nothing to opt out of, and we treat Global Privacy Control signals as an opt-out anyway. We use sensitive data only with your consent and only for the purposes above. You can use an authorized agent. If we deny a request, you can appeal by replying with the subject "Appeal". If you are not satisfied with the outcome, you can contact your state Attorney General.

Consumer Health Data Privacy Policy

This section is for residents of Washington (My Health My Data Act), Nevada, Connecticut and other states with consumer health data laws.

  • Consumer health data we collect: the thyroid condition you choose on the waitlist form (or "Prefer not to say"). Because you share it with your email, all your waitlist answers are treated as consumer health data.
  • Source: only you, through the form.
  • Purpose: to run the waitlist, contact you about early access and understand who needs T-Tensor. We collect it only with your consent.
  • Who we share it with: only our processors Vercel and Supabase (listed above), to host the site and database. We share it with no other third parties or affiliates.
  • We never sell consumer health data, and we don't use geofencing.
  • Your rights: to confirm whether we hold your data and see it, to see the list of everyone we have shared it with, to withdraw consent, and to have it deleted, including from our processors. Email privacy@thyratensor.com. If we decline, you can appeal by replying with the subject "Appeal". If your appeal is denied, you can contact the Washington State Attorney General or your own state Attorney General.

Security

Data is encrypted in transit (HTTPS) and at rest by our database provider. The database is locked against public access and can only be reached by our server with a secret key. Only the T-Tensor team can see signups. If a breach ever affects your data, we will notify you and the relevant authorities as the law requires, including under the GDPR and the U.S. Federal Trade Commission's Health Breach Notification Rule.

Children, HIPAA and changes

Children. The waitlist is for adults 18 and over. If we learn we have data from someone under 18, we delete it.

HIPAA. T-Tensor is not a healthcare provider, health plan or business associate, so HIPAA does not apply to this waitlist. We still protect your data as described here.

Not medical advice. T-Tensor is not a medical device and doesn't diagnose, treat or give dosing advice.

Changes. If we change this policy, we will update the date above. If we want to use your health data in a new way, we will ask for your consent first.

Back to the waitlist