Privacy and compliance

‍

Before publishing an application that uses Shen AI, make sure to review these privacy and compliance considerations. While the SDK is designed to support privacy by default, your application is ultimately responsible for how measurements are presented to users, how results are stored, and what information users receive before their first scan.

This article highlights the main areas to review before launch and points you to more detailed implementation resources where needed.

‍

Understand what Shen AI does and doesn’t do

One of the first questions users and security teams often ask is what happens to the camera image during a measurement.

Shen AI performs the physiological analysis locally on the user's device. Facial images are processed to extract the physiological signal needed for the measurement, but they are not transmitted to or stored on Shen AI servers as part of the measurement process. The SDK also does not collect personally identifiable information (PII) or protected health information (PHI). Communication with Shen AI is limited to licensing and SDK operation, not user health data.

This privacy-first architecture can simplify security reviews and help organizations meet their own data protection requirements. However, if your application stores, synchronizes, or shares measurement results, those activities fall under your own privacy and compliance responsibilities.

‍

Consider your own legal obligations

The exact legal requirements depend on where your application is available and how it is intended to be used.

For many products, you'll need to explain how measurement data is processed, stored, and shared through your own privacy policy. Depending on your jurisdiction, you may also need to obtain user consent before the first measurement or provide users with a way to withdraw that consent later.

If your application stores measurement results in the cloud or shares them with healthcare providers or third-party services, those data flows should also be clearly communicated to users.

Rather than prescribing a single implementation, Shen AI provides guidance and recommended wording that you can adapt to your own product and legal requirements.

‍

Set clear expectations for users

A short disclosure before the first measurement helps users understand what the technology does and how the results should be interpreted.

For most wellness applications, this includes explaining that the measurements provide health insights and are not intended to replace professional medical advice or serve as the sole basis for diagnosis or treatment decisions.

Many teams include this information alongside the onboarding screens shown before the first scan, together with their privacy notice or consent flow. For guidance on preparing users for the measurement itself, see Preparing users for their first measurement.

‍

Review your implementation before launch

Before releasing your application, take a moment to verify that your implementation reflects both your product's intended use and the regulations that apply to your market.

As a minimum, you should review:

- how measurement results are handled after the scan,
- whether user consent is required,
- the wording of your privacy notice and any measurement disclaimers,
- whether your application's intended use is communicated consistently throughout the onboarding experience.

These checks are often much easier to address before launch than during a compliance review or app store submission.

‍

Additional resources

- Shen AI SDK Legal Guidelines with recommended disclaimers and acknowledgements
- Preparing your app for store review: App Store, Google Play
- Intended use under FDA General Wellness

‍