Consumer Health Data Privacy Policy
Applies to: Luemonora LLC ("we", "us"), operator of the Tendra app.
Covers: residents of Washington State, and anyone whose consumer health data we
collect in Washington. Nevada residents are covered by an equivalent law (SB 370); we apply this
policy to them too.
What this policy is
Tendra is a dating app for people living with sexually transmitted infections. Using it means telling us things about your health. Washington law treats that information as consumer health data and gives you specific rights over it. This page explains, in plain terms, what we collect, why, who sees it, and how to make us stop or delete it.
If you only want the short version: your health status is shown to other users you're matched with, because that is what the app is for. Nothing else about your health is sold, and no advertising is run against it. You can withdraw consent or delete everything at any time.
1. What consumer health data we collect, and why
| What | Why we collect it | Required? |
|---|---|---|
| Your STI status (the "living with" field on your profile) | To match you with people whose status and preferences are compatible. This is the core function of the app. | Only if you want a dating profile |
| Your community status — "New here" or "Veteran" | An optional badge on your posts and messages so people know whether you're looking for guidance or offering it. "New here" means newly diagnosed, so we treat it as health information. | No, always optional |
| The fact that you have a Tendra account | Having an account on an STI-focused app can itself indicate something about your health. We treat it as health data. | Yes, inherently |
| Health information you write yourself — your bio, community posts, chatroom messages, direct messages | To let you communicate. We do not analyze these for health content; they are shown to whoever you send them to. | You choose what to write |
| Your location — GPS location, or a city you pick manually | To show you people nearby. Location near a clinic could suggest you are seeking care, so we treat location as health data. | Only for distance-based matching |
| An age estimate derived from your photos | To keep minors off the app. An automated scan estimates your age from your face. We keep only the estimate — never the facial-geometry data itself. | Only if you upload photos |
We do not collect: test results, medical records, prescriptions, treatment history, provider names, insurance information, or anything from a health care provider. Everything above comes from you.
2. Where it comes from
We collect consumer health data from three sources, and no others:
- Directly from you — what you type or select in the app.
- From your device, with your permission — your location, if you grant location access.
- Derived by us — the age estimate produced by scanning a photo you uploaded.
We do not buy consumer health data, receive it from data brokers, or obtain it from any other app, platform, or public source.
3. Who sees it
Other users — the important one
Your STI status is displayed on your profile to other Tendra users who see you in browse or matching. That is the point of the app; it is not an accident or a leak. Anything you write in a community post or chatroom is visible to other users of that space. Direct messages are visible to the person you send them to.
You control this: you can change or remove your status, and you can use Tendra in community-only mode without a dating profile at all.
Service providers who process data for us
These companies handle data on our behalf, under written contracts that forbid them from using it for their own purposes. Under Washington law they are processors, not third parties, but we name them so you can see the full picture:
| Company | What it handles | Where |
|---|---|---|
| DigitalOcean | Hosts our servers and database — this is where your profile, including your status, is stored | United States |
| Backblaze B2 | Stores your photos | United States |
| Sightengine (Kozelo SAS) | Automated safety scanning of photos and message text. Images and text are deleted immediately after processing and are never used to train their models. | France; their infrastructure includes servers in the US, France and Germany |
| Microsoft (PhotoDNA) | Receives an irreversible mathematical hash of photos to detect child sexual abuse material. Never receives the image itself or any health data. | United States |
| Brevo | Sends sign-in emails. Receives your email address only — no health data. | European Union |
| OneSignal, Sentry, Firebase | Push notifications, crash reporting, app infrastructure. No health data. | United States |
Legally required disclosure
If our systems detect child sexual abuse material, we are required by federal law (18 U.S.C. §2258A) to report it to the National Center for Missing & Exploited Children, along with information identifying the account. This is a legal obligation, not a choice, and it is the one disclosure your consent does not control.
We will also disclose data if compelled by valid legal process.
4. What we never do
- We do not sell your consumer health data. Not to advertisers, data brokers, insurers, employers, or anyone else. Washington law requires a signed authorization before any sale of consumer health data; we have never sought one and do not intend to.
- We do not run advertising against your health data. Tendra shows no third-party ads. We are funded by optional subscriptions.
- We do not use geofencing. We do not build virtual boundaries around hospitals, clinics, pharmacies, testing centers, or any other health care facility, and we do not use your location to detect that you visited one.
- We do not use your data to train AI models, and our vendors are contractually barred from doing so with data we send them.
5. Your rights
You can exercise any of these by emailing privacy@luemonora.com or through the app's Settings screen.
Confirm and access. Ask whether we hold consumer health data about you, get a copy of it, and get the list of every third party and processor it has been shared with.
Withdraw consent. Withdraw your consent to collection or to sharing at any time. Withdrawing stops future collection and sharing; it does not undo what already happened. Your existing data stays until you ask us to delete it.
Delete. Have your consumer health data deleted. When you do, we delete it from our live systems, our backups and archives, and we notify every processor and third party that holds it, who must delete it too.
Appeal. If we refuse a request, we will tell you why and how to appeal. If we deny your appeal, we will give you a link to submit a complaint to the Washington Attorney General.
How long it takes. We respond within 45 days. If a request is complex we may take another 45 days, and we will tell you before doing so. There is no charge.
One limit on deletion
If your account is under a preservation hold arising from a child-safety report, federal law requires us to retain that material, and we cannot delete it until the hold ends. This is the only circumstance in which we will refuse a deletion request, and we will tell you plainly if it applies to you.
6. Changes
If we change what we collect, why, or who we share it with, we will update this policy and obtain fresh consent before the change takes effect for data we already hold. We will not apply new uses retroactively.
7. Contact
Luemonora LLC
Privacy: privacy@luemonora.com
Child safety: childsafety@luemonora.com
You may also contact the Washington State Attorney General's Office at atg.wa.gov/file-complaint.