Tendly Privacy Policy

Last updated: April 13, 2026

Effective date: April 13, 2026

1. Who We Are

Tendly is operated by The Price Group Holdings LLC, a limited liability company, doing business as Tendly ("Tendly", "we", "us", or "our"). We provide a practice management platform for wellness practitioners, therapists, coaches, and other healthcare and wellness professionals.

For all privacy enquiries:

Email: privacy@tendly.health

This Privacy Policy applies to:

• •The Tendly marketing website at tendly.health and related subdomains ("Site")
• •The Tendly application at app.tendly.health and associated mobile applications ("App")
• •Any other services we operate that link to this policy (collectively, the "Services")

2. Scope and Who This Policy Covers

This policy explains how we collect, use, disclose, and protect personal information about:

• •Visitors to the Site (including waitlist signups and prospective customers)
• •Practitioners who create and use a Tendly account (our direct customers)
• •End clients of practitioners whose information is stored in the App

Important distinction: Tendly is a business associate under HIPAA and a data processor under GDPR. When practitioners use the App to store information about their clients, Tendly processes that information on behalf of the practitioner (the covered entity or data controller). The practitioner is responsible for their own privacy obligations toward their clients. Tendly's obligations in respect of that data are governed by the Business Associate Agreement ("BAA") that every practitioner signs upon account creation.

Section 9 below contains specific information about how we handle protected health information ("PHI").

3. Information We Collect

3.1 Information You Give Us Directly

On the Site (marketing):

• •Email address when you join the waitlist or submit a contact form
• •Any other information you choose to provide in a message

On the App (practitioner accounts):

• •Account registration: name, email address, password, professional credentials, modality and license number
• •Billing information: processed via Stripe; we store only the last four digits of a card and billing address — full payment card data is never stored by Tendly
• •Practice configuration: business name, booking page settings, availability, services offered
• •Profile photo if uploaded

Client records created by practitioners:

• •Personal details: client name, date of birth, contact information, emergency contacts
• •Health and clinical information: presenting concerns, diagnoses, medications, session notes, treatment plans, progress notes, assessments
• •Insurance information: where provided by the practitioner for billing purposes
• •Communication: secure messages exchanged between practitioner and client through the App
• •Session recordings or transcripts: only if the practitioner enables AI note generation, in which case audio or transcript content is temporarily processed to generate a draft note and is not retained beyond that processing event

3.2 Information We Collect Automatically

On the Site:

• •Usage data via Google Analytics and Vercel Analytics: pages visited, time on page, referring URL, browser type, operating system, approximate geographic location derived from IP address
• •Cookies and similar tracking technologies (see Section 12)
• •Meta Pixel data: page views and standard events on the Site for advertising measurement purposes (see Section 12.3)

On the App:

• •Log data: IP address, device type, browser or app version, pages or features accessed, timestamps, error events
• •Session activity for security and audit purposes: login events, data access events, and note modifications are logged with timestamps and IP addresses as required by HIPAA

3.3 Information From Third Parties

We may receive limited information from:

• •Stripe: payment confirmation and subscription status
• •Claim.MD: claim status updates and ERA data for practitioners using our insurance billing add-on

4. How We Use Your Information

4.1 Site visitors

4.2 Practitioner accounts

4.3 Client data stored in the App

We process client data entered by practitioners solely:

• •To provide the App features the practitioner has enabled
• •For AI note generation where the practitioner has activated this feature
• •For insurance claim submission where the practitioner uses the insurance billing add-on
• •To fulfil our obligations under the BAA with the practitioner

We do not use client data, session note content, transcripts, or any protected health information to train, fine-tune, or improve any artificial intelligence or machine learning models — ours or any third party's.

5. Sharing and Disclosure

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.

We share information only in the following circumstances:

5.1 Subprocessors

We use the following third-party services that process personal information on our behalf. All subprocessors handling PHI have signed a Business Associate Agreement with Tendly.

5.2 Legal requirements

We may disclose information where required by applicable law, regulation, court order, or lawful governmental request. Where legally permitted, we will notify you of such a request before disclosing.

5.3 Business transfers

If Tendly is involved in a merger, acquisition, or sale of all or a portion of its assets, personal information may be transferred as part of that transaction. We will notify affected users via the email address on their account before any such transfer occurs and before personal information becomes subject to a different privacy policy.

5.4 Protection of rights

We may disclose information where necessary to protect the rights, property, or safety of Tendly, our users, or the public, and to detect or prevent fraud or security incidents.

5.5 With your consent

We may share information for other purposes with your explicit consent.

6. International Data Transfers

Tendly is based in the United States. If you are located in the European Economic Area ("EEA"), the United Kingdom, or another jurisdiction with data transfer restrictions, your personal information will be transferred to and processed in the United States.

We rely on the following transfer mechanisms:

• •EU Standard Contractual Clauses ("SCCs"): We use the SCCs approved by the European Commission to lawfully transfer personal data from the EEA to the United States where applicable.
• •UK International Data Transfer Agreements ("IDTAs"): We use the UK IDTA for transfers from the United Kingdom.

EU and UK Representative: Tendly does not currently have a physical establishment in the EEA or UK. We are in the process of appointing local representatives as required by Article 27 of the GDPR and the UK GDPR. Until appointed, please direct all privacy enquiries to privacy@tendly.health.

7. Data Relating to Minors

7.1 Site visitors and account holders

The Site and App are intended for adult professionals. We do not knowingly collect personal information directly from individuals under the age of 18 through account registration or the Site. If we become aware that we have inadvertently collected personal information from a child under 13 without verifiable parental consent in violation of COPPA, we will take steps to delete that information promptly.

7.2 Client data involving minors

Practitioners using Tendly may provide care to clients who are minors. In such cases:

• •The practitioner, as the covered entity and data controller, is responsible for obtaining appropriate consents and authorisations from the minor's parent or guardian as required by applicable law and professional regulations
• •Tendly processes this data solely as a data processor/business associate under the practitioner's instructions and the BAA
• •We apply the same security standards to all client data regardless of the client's age
• •Practitioners are responsible for complying with HIPAA's specific rules around the disclosure of a minor's health information, including situations where a minor is the personal representative of their own record

If you believe we have received personal information relating to a minor in error, please contact privacy@tendly.health immediately.

8. Data Retention

8.1 Marketing site visitors

• •Waitlist email addresses: retained until you unsubscribe or request deletion
• •Analytics data (Google Analytics, Vercel Analytics): subject to each provider's standard retention periods, typically 26 months

8.2 Practitioner accounts

• •Account information and practice data: retained for the duration of your active subscription and thereafter until you request deletion
• •Billing records: retained for a minimum of 7 years as required by tax and financial regulations, even following account deletion
• •Security and audit logs (HIPAA-required): retained for a minimum of 6 years from the date of creation or the date when last in effect, as required by the HIPAA Security Rule

8.3 Client data

• •Client records, session notes, and clinical data stored in the App: retained for the duration of the practitioner's active account and thereafter until the practitioner requests deletion
• •When a practitioner deletes their account, all client data associated with that account is permanently deleted within 30 days, except where retention is required by law
• •Individual client records can be deleted by the practitioner at any time from within the App

8.4 Deletion requests

To request deletion of your personal information, email privacy@tendly.health. We will respond within 30 days. Note that we may be required to retain certain information by law (for example, billing records) and will inform you of any such limitations at the time of your request.

9. HIPAA and Protected Health Information

This section applies to practitioners using the Tendly App and to client data stored within the App.

9.1 Business Associate relationship

Tendly operates as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"). Every practitioner who creates a Tendly account enters into a Business Associate Agreement ("BAA") with Tendly at the point of account creation. This BAA governs Tendly's obligations with respect to protected health information.

9.2 How we protect PHI

• •All PHI is encrypted at rest using AES-256 encryption
• •All PHI is encrypted in transit using TLS 1.2 or higher
• •Access to PHI is restricted to authorised Tendly personnel on a need-to-know basis
• •All access to PHI by Tendly personnel is logged and audited
• •Multi-factor authentication is available and recommended for all accounts
• •Sessions automatically expire after a period of inactivity

9.3 AI and PHI

When a practitioner uses the AI note generation feature, session audio or text descriptions are transmitted to OpenAI for processing. OpenAI has signed a BAA with Tendly covering this use. Session content submitted to the AI feature is not stored beyond the processing of the immediate request and is not used to train AI models.

9.4 Insurance billing and PHI

When a practitioner uses the insurance billing add-on, claim data including PHI is transmitted to Claim.MD for claim submission and ERA processing. Claim.MD has signed a BAA with Tendly covering this use.

9.5 Breach notification

In the event of a breach of unsecured PHI, Tendly will notify affected practitioners without unreasonable delay and no later than 60 days following discovery of the breach, as required by the HIPAA Breach Notification Rule. Practitioners are responsible for notifying their affected clients and, where required, HHS and applicable media outlets in accordance with HIPAA.

10. Your Privacy Rights

10.1 Rights available to all users

Subject to applicable law, you have the right to:

• •Access: request a copy of the personal information we hold about you
• •Correction: request that inaccurate or incomplete information be corrected
• •Deletion: request that we delete your personal information (subject to legal retention obligations)
• •Objection: object to certain processing activities, including direct marketing
• •Restriction: request that we restrict processing of your information in certain circumstances
• •Withdrawal of consent: where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact privacy@tendly.health. We will respond within 30 days of receiving your request. We may need to verify your identity before fulfilling the request.

10.2 Rights of EEA residents (GDPR)

In addition to the above, if you are located in the EEA, you have the right to:

• •Data portability: receive your personal information in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible. Please note: the Tendly App does not currently offer a self-serve data export function. To make a portability request, contact privacy@tendly.health and we will fulfil the request manually within 30 days. We are working to provide a self-serve export feature.
• •Lodge a complaint: with the supervisory authority in your EU member state if you believe we have processed your personal information unlawfully

10.3 Rights of UK residents (UK GDPR)

If you are located in the United Kingdom, the same rights described in Section 10.2 apply under the UK GDPR. You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. California Privacy Rights (CCPA / CPRA)

This section applies to California residents and supplements the rest of this policy. It is provided pursuant to the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA").

11.1 Categories of personal information collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

11.2 How we use this information

We use the above categories for the purposes described in Section 4. We do not use or disclose sensitive personal information for purposes other than those specified in CCPA Regulation 7027(m).

11.3 Sale and sharing of personal information

We do not sell your personal information.

We do not share your personal information with third parties for cross-context behavioural advertising, except that we operate a Meta Pixel on the marketing Site which may constitute "sharing" under the CCPA. You may opt out of this by:

• •Using our cookie consent tool to decline advertising cookies
• •Visiting the Site with the Global Privacy Control (GPC) signal enabled — we honour the GPC signal

11.4 Your CCPA rights

California residents have the right to:

• •Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our business purposes, and the categories of third parties we share with
• •Delete: request deletion of your personal information, subject to certain exceptions
• •Correct: request correction of inaccurate personal information
• •Opt out of sale/sharing: opt out of the sale or sharing of your personal information (see Section 11.3 above)
• •Limit use of sensitive personal information: we do not use sensitive personal information beyond what is necessary for the Services
• •Non-discrimination: we will not discriminate against you for exercising your CCPA rights

To exercise your CCPA rights, contact privacy@tendly.health with the subject line "California Privacy Request". We will respond within 45 days (extendable by a further 45 days with notice). We will verify your identity before fulfilling the request. You may designate an authorised agent to make a request on your behalf.

12. Cookies and Tracking Technologies

12.1 What we use

We use cookies and similar technologies on the Site and App for the following purposes:

12.2 Cookie consent

When you first visit the Site, we display a cookie consent banner that allows you to accept or decline non-essential cookies. You can update your preferences at any time by clicking the "Cookie settings" link in the Site footer.

We do not deploy analytics or advertising cookies inside the authenticated App environment where PHI may be present.

12.3 Meta Pixel

We operate a Meta Pixel on the marketing Site (tendly.health) to measure the effectiveness of our advertising campaigns on Meta platforms (Facebook and Instagram). The Pixel collects:

• •Page views and standard events (e.g. visiting the pricing page or waitlist page)
• •Technical data including IP address and browser information, which Meta may use to match to a Meta account

We do not pass email addresses, names, or any other personally identifying information to Meta via the Pixel.

The Pixel is not present on any page of the App (app.tendly.health). It operates on the marketing Site only.

To opt out of Meta's use of this data for advertising targeting, you can:

• •Decline advertising cookies via our cookie consent tool
• •Visit Meta's Ad Preferences at facebook.com/ads/preferences
• •Use the Digital Advertising Alliance opt-out at optout.aboutads.info
• •Enable the Global Privacy Control (GPC) in your browser

12.4 Do Not Track

Our Site does not currently respond to Do Not Track signals from browsers. We do honour the Global Privacy Control (GPC) signal as described in Section 11.3.

13. Security

We implement technical and organisational measures designed to protect your personal information from unauthorised access, loss, misuse, disclosure, alteration, and destruction. These measures include:

• •AES-256 encryption of all data at rest
• •TLS 1.2+ encryption of all data in transit
• •Role-based access controls limiting internal access to personal information
• •Immutable audit logging of all access to PHI
• •Multi-factor authentication for all internal Tendly systems
• •Regular security assessments and vulnerability testing
• •Regular security assessments and vulnerability testing

No method of transmission over the internet or electronic storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. In the event of a security incident affecting your personal information, we will notify you as required by applicable law.

14. Links to Third-Party Sites

The Site and App may contain links to third-party websites and services. This policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• •Update the "Last updated" date at the top of this policy
• •Notify practitioner account holders by email at least 14 days before the change takes effect
• •For changes affecting how we handle PHI, provide notice in accordance with the BAA

Your continued use of the Services after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree with the changes, you may close your account and request deletion of your data.

16. Contact

For all privacy-related enquiries, requests, or complaints:

The Price Group Holdings LLC (DBA Tendly)

Email: privacy@tendly.health

We will respond to all enquiries within 30 days.

If you are an EEA or UK resident and are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu. The UK supervisory authority is the Information Commissioner's Office at ico.org.uk.

This Privacy Policy was last reviewed by legal counsel on April 13, 2026.