Privacy Policy

This Privacy Policy applies to the Tidewell mobile application (available on iOS and Android) and the Tidewell website at tidewellapp.com (collectively, the "Service"). It explains what information we collect, why we collect it, how we use and protect it, and what rights you have.

It also applies when you use the Tidewell provider directory at tidewellapp.com/providers, including when you book an appointment with a practice through it. Booking does not need a Tidewell account, and different information is involved. Section 14 describes it, and the other sections say where booking differs.

Tidewell is operated by TARA VEDA MARCENTILE COMPANY, doing business as Black Belt Code Labs, owned by Rahul Bhattacharya ("we", "us", "our"). We are the data controller for all personal data processed through the Service.

1. Information We Collect

Information you provide directly

When you use Tidewell, you choose to provide:

• Account credentials (email address and password, if you create an account)
• Injection logs — date, dose, medication name, and injection site
• Daily check-in responses — mood, energy levels, hunger, nausea, and other side-effect ratings
• Body weight and measurement entries
• Personal journal notes and milestone entries (Private Journey Record, if you use that feature)
• Any information you include when contacting our support team
• If you book an appointment through the provider directory: your name, your email address and the details of your booking. You do not need an account for this. See section 14

Health and wellness data

The health and wellness data you log directly within Tidewell — medication records, symptom scores, weight entries — constitutes special category health data under GDPR and equivalent laws. We process this data on the legal basis of your explicit consent, which you provide when you create an account and begin logging. You may withdraw consent at any time by deleting your account.

This paragraph is about what you log in the Tidewell app with an account. Booking an appointment through the provider directory does not use an account, and we do not ask for clinical or health information when you book. See section 14.

Apple Health (HealthKit) — iOS only

With your explicit permission, Tidewell may read health data from Apple Health (HealthKit), which may include steps, active energy, sleep data, and heart rate. This integration is entirely optional. HealthKit data is used only to provide contextual display within your Tidewell experience.

• HealthKit data is never uploaded to Tidewell's servers. It is read and processed locally on your device only.
• HealthKit data is never used for advertising, sold, or shared with any third party for any commercial purpose. This is an Apple requirement we strictly observe.
• You can revoke Tidewell's access to Apple Health at any time via Settings > Privacy & Security > Health > Tidewell on your iPhone.

Android Health Connect — Android only

On Android, Tidewell may request access to Android Health Connect to read health data such as steps, sleep, and heart rate. The same principles apply: Health Connect data is processed locally on your device, never uploaded to our servers, never used for advertising, and never shared with third parties. You can revoke access via Settings > Apps > Health Connect > App permissions > Tidewell.

Device and technical information

To operate and improve the Service, we automatically collect:

• Device type, model, and operating system version
• App version and installation identifier
• General app usage patterns and feature interactions (anonymised — not linked to your identity)
• Crash reports and diagnostic error logs
• IP address (used for security and fraud prevention; not used to build advertising profiles)

We do not use Apple's Advertising Identifier (IDFA) or Google's Advertising ID (GAID) for advertising purposes. We request App Tracking Transparency permission on iOS only if we adopt advertising-based tracking in the future — which we do not do today.

Permissions requested on your device

Depending on your device and the features you use, Tidewell may request the following permissions:

• Notifications — to send you optional reminders (injection reminders, check-in prompts). You can manage or disable these in your device Settings at any time.
• Apple Health / Health Connect — as described above. Optional.
• Camera or Photo Library — only if you choose to add a profile photo or attach an image to a log entry. We do not access your camera or photos without your action.

We do not request access to your contacts, location, microphone, or any other sensor not listed here.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your Tidewell account
• Deliver core app features — check-in tracking, medication logs, pattern insights, and doctor visit briefings
• Display your trends, patterns, and history across sessions and devices
• Sync your data securely across your devices (where you are signed in)
• Send you push notifications you have opted into (reminders, check-in prompts)
• Respond to support requests and resolve issues
• Arrange and manage appointments you book through the provider directory, share them with the practice you book with, and send the emails needed for them
• Send important notices about the Service — such as policy updates or security alerts (not marketing emails without your consent)
• Improve app features, diagnose bugs, and fix crashes using anonymised analytics
• Comply with legal obligations

We do not use your personal data to build advertising profiles, serve targeted advertisements, or train third-party AI or machine learning models.

3. Data Storage and Security

Your Tidewell account data — including your health logs and check-in history — is stored securely using Supabase, a cloud database platform. Supabase encrypts all data at rest (AES-256) and in transit (TLS 1.2+). Supabase infrastructure is hosted on AWS and operates in accordance with relevant security and data protection standards.

Information about appointments booked through the provider directory is kept separately from Tidewell account data, in a separate Supabase project used only for the provider directory and booking. That project is located in Sydney, Australia.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse — including access controls, encrypted connections, and periodic security reviews.

Apple HealthKit and Android Health Connect data is processed locally on your device and is never stored on Tidewell's servers.

No method of transmission or storage over the internet is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

4. Third-Party Services

Tidewell uses a small number of trusted third-party services to operate:

• Supabase — cloud database and authentication. Supabase processes your account data as a data processor on our behalf. A separate Supabase project holds provider directory and booking information.
• Resend — sends the emails needed for booking an appointment. Resend receives the email address a message is sent to and the content of the message. It is used for booking emails only.
• Vercel — hosts and runs the provider directory and booking pages. Information you submit on those pages passes through Vercel, and Vercel processes the IP address of requests, including to limit excessive or automated requests.
• ImprovMX — forwards email sent to support@tidewellapp.com to our support inbox. It handles those messages while forwarding them and keeps a short-lived delivery log, such as the sender, the address written to and the subject.
• Apple App Store — app distribution and in-app subscription billing for iOS users.
• Google Play Store — app distribution and in-app subscription billing for Android users.
• Crash and diagnostics reporting — we may use a third-party crash reporting service to receive anonymised error reports. These reports do not include identifiable health data.
• Google Analytics — used on our website (tidewellapp.com) only, to understand aggregate visitor behaviour. It is not used inside the mobile app, and only runs after you accept our cookie banner. See “Website cookies and analytics” below.

Our mobile app does not use Facebook SDKs, Google Analytics, or any advertising SDKs. We do not use any advertising SDKs on the website either.

Website cookies and analytics

Our website (tidewellapp.com) uses Google Analytics 4, a service provided by Google, to understand how visitors find and use the site so we can improve it. When enabled, Google Analytics sets cookies and processes limited technical information — including your approximate location (derived from a truncated IP address), device and browser type, pages viewed, and referring links. This data is aggregated, is not used to identify you personally, and is never linked to the health data you log in the app.

Google Analytics runs on the website only after you accept our cookie banner. If you decline, no analytics cookies are set and the Google Analytics script is never loaded. Your choice is stored on your device; you can change it at any time by clearing your browser’s site data for tidewellapp.com, which brings the banner back.

Learn more about how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites, and install Google’s browser opt-out add-on at tools.google.com/dlpage/gaoptout.

Cookies used for booking

The provider directory and booking pages at tidewellapp.com/providers do not load Google Analytics or other analytics trackers, and the cookie banner does not apply to them.

Booking uses two cookies that are necessary for it to work. They are not used for analytics or advertising:

• a temporary cookie holding the email address you entered, kept for up to 10 minutes while you wait to enter your verification code;
• a booking session cookie, set after your email address is verified, which lets you make and manage your own bookings until the session ends.

Both are removed when they expire. They cannot be read by scripts on the page.

5. Data We Do Not Sell or Share

We do not sell, rent, trade, or otherwise disclose your personal data to any third party for their independent marketing or commercial purposes.

We do not share identifiable personal data with:

• Advertising networks or ad-tech companies
• Data brokers or data aggregators
• Social media platforms for targeting or retargeting purposes
• Insurance companies, employers, or any organisation that could use it adversely

When you book an appointment through the provider directory, we share your booking with the practice you book with, so that it can see you. This is described in section 14. It is not shared with other practices.

We may disclose information if required by law, regulation, legal process, or governmental request — and only to the extent strictly required. We will make reasonable efforts to notify you unless prohibited.

6. Push Notifications

Tidewell may send push notifications to your device for purposes such as injection reminders, check-in prompts, and important service updates. You will be asked for permission before we send any notifications.

You can opt out of push notifications at any time:

• iOS: Settings > Notifications > Tidewell
• Android: Settings > Apps > Tidewell > Notifications

Disabling notifications does not affect your ability to use the app.

7. Subscriptions and Payments

Tidewell Plus subscriptions are managed and billed exclusively by Apple (via the App Store) or Google (via Google Play). We do not collect, process, or store your payment card information at any point.

Subscription purchases, renewals, and refunds are governed by Apple's or Google's respective terms and privacy policies. To manage or cancel your subscription:

• iOS: Settings > [Your Name] > Subscriptions > Tidewell
• Android: Google Play app > Subscriptions > Tidewell

Payment for an appointment booked through the provider directory is different: it is made directly to the practice, not to Tidewell or through Apple or Google. See section 14.

8. Account Deletion

You have the right to delete your Tidewell account and all associated personal data at any time. You can request account deletion:

• In-app: via Settings > Account > Delete Account within the Tidewell app
• By email: contact us at support@blackbeltcodelabs.com with the subject line "Account Deletion Request"

We will permanently delete your account and all associated health data within 30 days of receiving your request. Anonymised, non-identifiable aggregated data may be retained. Deletion requests submitted through the app are processed immediately for account access revocation, with full data purge completed within 30 days.

If you booked an appointment through the provider directory without an account, there is no account to delete. Section 14 explains how to ask for your booking details to be removed.

9. Data Retention

We retain your personal data for as long as your account remains active. If you delete your account, we will delete your personal data within 30 days as described above.

Information about appointments booked through the provider directory without an account is kept for the periods set out in section 14.

We may retain certain information for a limited period where required by applicable law (for example, transaction records for tax compliance), or where it is necessary to resolve a dispute or enforce our agreements.

10. Your Rights

Rights for all users

Regardless of your location, you may:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your account and data
• Opt out of push notifications at any time via your device settings
• Revoke Apple Health or Health Connect permissions at any time via your device settings

If you booked an appointment through the provider directory, you can ask for a copy of your booking information or for your details to be removed as described in section 14.

Rights under GDPR and UK GDPR (EU and UK residents)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right of access — obtain a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restriction — ask us to pause processing your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

Our lawful bases for processing are: consent (for health and wellness data, and for marketing communications); contract (to provide the Service you have signed up for); and legitimate interests (for security, fraud prevention, and anonymised analytics — balanced against your rights).

You have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, contact the supervisory authority in your member state.

Rights under CCPA / CPRA (California residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know — what personal information we collect, use, and disclose
• Right to delete — request deletion of your personal information
• Right to correct — request correction of inaccurate personal information
• Right to opt out of sale or sharing — we do not sell or share your personal information, so this right is already satisfied. You may still submit a request to confirm.
• Right to non-discrimination — we will not treat you differently for exercising any of these rights

To exercise your California rights, contact us at support@blackbeltcodelabs.com. We will respond within 45 days.

11. Children's Privacy

Tidewell is not directed to children. You must be at least 13 years of age (or 16 in certain EU/EEA jurisdictions) to use the Service. We do not knowingly collect personal information from anyone under these age thresholds.

Booking an appointment through the provider directory has its own requirement: you must be 18 or older, or be the parent or legal guardian of the person the appointment is for and book on their behalf.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at support@blackbeltcodelabs.com and we will delete that information promptly.

12. International Data Transfers

Tidewell is based outside the European Economic Area. If you use the Service from within the EEA or UK, your personal data may be transferred to and processed in countries that may not provide the same level of data protection as your home country.

Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards — including Standard Contractual Clauses (SCCs) where applicable — to ensure your data is protected in accordance with GDPR and UK GDPR.

For appointments booked through the provider directory: booking information is stored in Australia; the booking pages are run on servers in the United States, and requests reach them through the network location nearest to you; and booking emails are sent through Resend, whose primary processing operations are in the United States.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will provide notice of material changes through the app or by email at least 14 days before they take effect.

The "Effective date" at the top of this page indicates when this version was last revised. We encourage you to review this policy periodically. Continued use of Tidewell after changes take effect constitutes your acceptance of the updated policy.

14. Provider Directory and Guest Booking

This section applies when you use the Tidewell provider directory at tidewellapp.com/providers and when you book an appointment with a practice through it. Our Booking Terms explain how booking works.

Booking without an account

You do not need a Tidewell account to book, and booking does not create one. A booking is identified by your email address, which you confirm with a code. It is not linked to any Tidewell app account you may have, and the information you log in the Tidewell app is not used for booking or shared with a practice through it.

Tidewell's role

Tidewell is a booking intermediary for appointments offered by independent practices and providers. Tidewell is not the healthcare provider for an appointment you book. The practice or provider is responsible for the appointment and the service: care and clinical decisions, availability, cancellations and changes, receiving payment, and any refund.

Information we collect when you book

• your email address;
• your name;
• the appointment you book: the provider, the practice, the location or that it is by video, the service, and the date and time;
• the status of the appointment and a record of changes to it, such as when it was booked, cancelled, declined or moved, and by whom (you or the practice);
• where the practice cancels, declines or moves an appointment, the reason it selects from a short fixed list, and, after an appointment, whether the practice recorded it as having taken place or as not attended;
• if the practice charges for the service and you tell us you have paid: the payment reference and payment date you give us;
• when you acknowledged the Booking Terms, and which version;
• technical information needed to provide and protect booking, such as the IP address of requests.

We do not ask for or collect clinical information when you book: no diagnoses, medications, medical history, symptoms, clinical notes or health records. Please do not include any in the details you give. The service you choose and the provider you book with are part of your booking.

Confirming your email address

When you enter your email address we send it a six-digit code, and ask you to enter the code to show the address is yours. Entering it correctly starts a temporary booking session, which lets you make and manage your own bookings for a limited time. The codes and session credentials are kept in a protected form, not as readable text, and we limit how often codes can be requested and tried.

Who sees your booking

We share your booking with the practice you book with so that the appointment can be arranged and managed. At the practice it is available to:

• the practice's administrators;
• the provider your appointment is with;
• colleagues the practice has specifically given access to manage appointments on that provider's calendar.

What they see is your name, your email address, the appointment details, and the payment reference and date if you gave them. Other members of the practice's staff do not have access by default, and other practices and providers cannot see your booking.

Tidewell support staff can look up the bookings made with an email address in order to deal with a request about them. Each lookup is recorded.

Booking information is also processed for us by the service providers named in section 4: Supabase, Resend and Vercel. Email you send to support@tidewellapp.com is forwarded to us by ImprovMX.

Paying the practice

Tidewell does not collect payment for appointments. Where a practice charges for a service, you pay the practice directly, following its instructions. You can tell us you have paid and give a payment reference and the date. That is all we ask for about a payment; there is no free-text note. We keep those with your booking and show them to the practice. Tidewell does not verify the payment, does not process it, and does not handle refunds. Please never send us card or bank account numbers.

Emails about your booking

We send emails that are needed for your booking: the verification code, confirmation that an appointment is booked, that a payment is awaited and by when, that your payment report was received, that a booking was not confirmed, that the practice cancelled, and that the practice moved your appointment. These are sent because of your booking. We do not send marketing emails or appointment reminders as part of booking.

How long we keep booking information

• Your details on an appointment. Your name, your email address and your payment reference and date are kept with an appointment for 24 months after the appointment's end time, whatever became of the appointment. After that they are removed from it.
• The appointment record. The record of the appointment itself, the history of changes to it, and audit records are kept without your details.
• Verification and session records. Records of verification codes and booking sessions are removed about a day after they are no longer needed.
• Records of emails. Our own records that a booking email was due are removed within about 30 days. Our email provider keeps its own records of emails it has sent, for a period it sets.

Where our database provider keeps backups, details we have removed may remain in those backups until they expire.

Asking for a copy of your booking information, or for it to be removed

Write to support@tidewellapp.com from the email address you booked with. There is no online form for this. We may need to confirm that you control the email address before we act.

• If you ask for removal, your name, your email address and your payment reference and date are removed from your past and finished appointments without waiting for the 24 months.
• We cannot remove your details while you still have an appointment to come. We do not cancel an appointment in order to carry out a removal request: cancel it first in the usual way, and then ask again.
• Any verification and session records still held for your email address are removed at the same time.
• The record of each appointment, its history and audit records are kept without your details. They are needed to operate the service, for security, and to keep an accurate record for the practice.
• We keep a record that a request was looked at or carried out, and by which member of staff. It holds a one-way fingerprint derived from your email address, so that two requests about the same address can be told apart. It does not hold the address itself.

How we protect booking information

We use appropriate technical and organisational safeguards for booking information. These include keeping verification codes and session credentials in a protected form, limits on repeated requests and attempts, access rules in the database that keep each practice's information separate from every other practice's, restricted access for Tidewell staff, and audit records of changes. As section 3 says, no method of transmission or storage is completely secure.

What "verified by Tidewell" means

Verified by Tidewell means Tidewell has completed identity, licence/credential, and affiliation checks available to us at the time of verification. It does not mean Tidewell endorses the provider, guarantees care quality, or guarantees availability.

Who can book

To book you must be 18 or older, or be the parent or legal guardian of the person the appointment is for and book on their behalf.

15. Contact

Questions, requests, or concerns about this Privacy Policy? Contact us:

For questions or requests about an appointment booked through the provider directory, write to support@tidewellapp.com.