Legal
Privacy and data policy
Last updated 28 October 2026
This policy explains how TINYHealth, a division of TINYLabs (“TINYHealth”, “we”, “us”), collects, uses, discloses and protects your personal data when you visit tessahealth.ai, try the TESSA demo, book a walkthrough, request a report or receive our emails (together, the “Site”).
It is written to comply with Singapore’s Personal Data Protection Act 2012 (PDPA) and, where it applies, the EU General Data Protection Regulation (GDPR).
This policy covers the Site only. When a healthcare institution uses TESSA with its patients, patient data is handled under that institution’s agreement with us and its own privacy notices, not this policy.
1. Data protection officer
Our data protection officer can be reached at privacy@gotinylabs.com. Contact them with any question, concern or request about your personal data.
2. Personal data we collect
2.1 What you give us
| When | What we collect |
|---|---|
| You try TESSA | Email address (a work email is preferred), your organisation and role, your first name if you give it, and whether you want updates |
| You book a walkthrough | Your name, email, organisation, job title, what you would like TESSA to help with, and the time you choose |
| You contact us | Your name, email, organisation, role, topic and message |
| You request an ROI report | Your email and the figures you enter |
2.2 What we collect automatically
- How you use the demo: which case you watched, how far you got and how long it took
- Whether you open or click our emails
- Technical details: IP address, browser and device type, pages visited, and the campaign that brought you to the Site
2.3 No patient data
The demo uses made-up patients. Please do not enter real patient information anywhere on the Site. If you do, we delete it when we find it.
3. How we use your personal data
- To send you the clinician summary or report you asked for
- To follow up about TESSA after your demo: up to three emails, which stop when you book, reply or unsubscribe
- To arrange and run a walkthrough you requested
- To answer your message
- To send you updates, only if you ticked the box
- To understand which pages and cases help visitors, and to improve the Site
- To keep the Site secure and meet our legal obligations
3.1 What we do not do
- We do not sell or rent your personal data
- We do not use your personal data to train AI models
- We do not use advertising or cross-site tracking cookies
- We do not share your details with other visitors
4. The demo and AI
Demo cases are prepared and checked in advance, and play back as recorded. Nothing you do in the demo is sent to an AI model.
5. Sharing and disclosure
5.1 Service providers
We share personal data only with providers that run the Site for us, under contracts that require them to protect it: website hosting, our database, email delivery and scheduling. They may only use it to provide their service to us.
5.2 Legal requirements
We may disclose personal data where the law requires it, or to protect the rights, property or safety of TINYHealth, our users or others.
5.3 Business transfers
If TINYLabs is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of it. We will tell you before your data becomes subject to a different policy.
5.4 With your consent
We share personal data in any other way only with your consent.
6. Emails
6.1 Updates
We send updates only if you tick “Send me interesting updates, but don’t spam my inbox”. You can unsubscribe at any time from any email.
6.2 Follow-up after a demo
After you try TESSA we send your summary and up to two more emails about it. They stop once you book a walkthrough, reply or unsubscribe.
6.3 Service emails
Emails about a walkthrough or report you asked for are sent even if you have not opted in to updates.
6.4 Email tracking
Our emails can tell us whether they were opened and which links were clicked. You can stop this by turning off images in your email app.
7. International transfers
TINYLabs is based in Singapore. Our providers may store or process data in other countries. Where data leaves Singapore, we make sure it is protected to a standard comparable to the PDPA, including through contracts with our providers. For visitors in the European Economic Area, transfers follow the GDPR, including Standard Contractual Clauses where needed.
8. How long we keep it
| Data | How long |
|---|---|
| Demo and contact details | 24 months after our last contact with you |
| Walkthrough records | 3 years |
| Update preferences and consent records | While you are subscribed, plus 2 years after you leave |
| Site and demo usage | 24 months in identifiable form; longer only once anonymised |
When we no longer need it, we delete it or remove what identifies you.
9. Your rights
9.1 Under the PDPA
- Ask to see the personal data we hold about you and how it has been used
- Ask us to correct it
- Withdraw your consent at any time
9.2 Under the GDPR (EEA visitors)
- Access, correction and erasure
- Restriction of processing and objection
- Data portability
- Complaint to your local data protection authority
9.3 How to exercise them
Write to privacy@gotinylabs.com. We reply within 30 days under the PDPA, or within one month under the GDPR.
10. Security
Data is encrypted when it is sent, access is limited to the people who need it, and access is logged.
11. Data breaches
If a breach is likely to cause significant harm or is of significant scale, we will notify the Personal Data Protection Commission as the PDPA requires, tell the people affected as soon as practicable, contain it, and notify other authorities where required.
12. Children
The Site is for healthcare professionals and organisations. It is not meant for anyone under 18.
13. Cookies
See our cookies page.
14. Changes to this policy
We may update this policy. We will post the new version here with its date, and tell you by email about significant changes if you are on our list.
15. Contact us
Questions or requests: privacy@gotinylabs.com. We aim to reply within 30 days.