How Shen AI protects privacy and data security

When choosing health monitoring technology, developers need to know how it handles sensitive data. They need to understand where data is processed, who can access it, and whether it is shared with other systems.

Shen AI is designed to keep scan data on the user's device - all scan-related processing takes place locally. Shen AI does not receive or access the data generated during a scan.

For teams building digital health products, this means fewer questions about where sensitive data travels, who can see it, and which systems it touches. Here's how it works and what it means in practice.

‍

How on-device processing works

Many health technologies send data to remote servers for analysis. Shen AI's SDK instead processes video frames directly on the user's device or in the browser, in five steps:

1. Camera capture: The device's camera captures video frames.‍

2. Image processing: The SDK processes the frames on the device.‍

3. Signal extraction: The system identifies signals linked to physiological activity.

4. AI analysis: The SDK analyzes these signals to estimate health measurements.

5. Results: The measurement results become available to the application.

The entire scan process takes place locally, so video frames do not need to be uploaded to Shen AI for analysis. This reduces the need to send sensitive data to external servers and removes the need for a separate cloud-based processing step.

‍

What data does Shen AI receive?

Processing data locally is only part of the picture. Developers also need to know what information reaches the technology provider. Shen AI does not receive, access, collect, or store scan data.

This includes:

- Facial images and video recordings.
- Video frames used during a scan.
- Facial-feature information generated during processing.
- Physiological signals and estimated vital signs.
- Measurement results.

So, what information does Shen AI receive?

The SDK sends an aggregated measurement count linked to the application provider's licence. This count supports licensing and billing. It does not include scan data, measurement results, device identifiers, or information that identifies an individual. The SDK also does not require users to create a Shen AI account to use the functionality.

This approach follows the principle of data minimization: collect or transmit only the information needed for a specific purpose.

‍

Does Shen AI use scan data to train its AI models?

No. Shen AI does not use scan data from this local-processing configuration for AI model training, research, testing, validation, or product development. Because Shen AI does not receive this data, there is no way for any data to be processed or utilized.

‍

Privacy by design

Privacy by design means building data protection into a product from the start, not something added only after the technology is developed. Shen AI's approach supports this principle in several ways.

Data stays on the device. The SDK processes scan data locally instead of sending it to Shen AI for analysis.

Less sensitive data is transferred. Shen AI receives an aggregated measurement count for licensing and billing, not individual scan data or results.

Scan data is not used for AI training. The data generated during a scan stays separate from Shen AI's AI model development.

Data collection is limited. The SDK can perform measurements without sending facial images, video frames, or physiological signals to Shen AI.

These measures help massively reduce the amount of sensitive information handled by Shen AI. They also reduce the risks linked to transferring and storing that information in external systems.

‍

Who can access the measurement results?

One of the most important distinctions when integrating Shen AI is understanding the boundary between the SDK and the application around it.

Shen AI does not access the health results generated by users' scans. However, the partner integrating the SDK can access those results through the integration.

This means privacy depends on two related but distinct layers:

- Shen AI's processing: The SDK processes video frames locally, and Shen AI does not receive the personal or biosignal data generated during the measurement process.

- The partner's application: The integrating organization determines how results are presented, used, stored, or transmitted within its own product, subject to its implementation and applicable legal requirements.

For example, an application may choose to retain historical measurements to help users track changes over time. That functionality introduces additional data handling considerations beyond the local measurement process itself.

Developers should therefore evaluate both the SDK's architecture and their application's complete data flow. This includes reviewing storage, analytics, third-party integrations, access controls, retention periods, and user-facing privacy disclosures.

Understanding these boundaries helps teams make informed architectural decisions and communicate clearly with users about how their health information is handled.

‍

What does Shen AI’s approach mean for GDPR?

GDPR compliance depends on how personal data is processed throughout an application. Shen AI helps developers address one important part of this: how health measurements are generated.

The SDK processes facial images locally on the user's device. Images and recordings are not sent to or stored on Shen AI servers as part of the measurement process. This can reduce the amount of sensitive data transferred to external systems and help developers meet their data protection requirements. Learn more about Shen AI's approach to privacy and compliance.

However, using Shen AI does not automatically make an application GDPR-compliant. The application provider must consider what happens to measurement results after a scan, whether results are stored or shared, and what information users need before using the feature.

For example, developers should review:

- Privacy information and consent: Explain how the application handles health measurements. Assess whether explicit consent or other specific safeguards are required for the intended use.

- Data storage and sharing: Check whether measurement results are saved, sent to a backend, or shared with healthcare providers or other services.

- User rights: Make sure users can exercise the rights that apply to their data, including withdrawing consent where processing relies on consent.

- Consistent communication: Ensure that privacy notices, onboarding screens, and app store descriptions accurately explain how the feature works.

‍

Shen AI provides resources to help developers work through these steps. Our Privacy Policy explains how Shen AI handles personal data across its services. The Shen AI SDK Legal Guidelines provide guidance on privacy disclosures, consent, and recommended disclaimers. Our guides to Apple App Store review and Google Play review cover privacy disclosures and other requirements to check before launch.

These resources provide a starting point, not a substitute for assessing your application's specific requirements. The steps you need to take depend on your product, its intended use, the data it processes, and the markets where it is available.

By combining Shen AI's local-processing architecture with clear disclosures and appropriate safeguards in the wider application, developers can build health monitoring features with privacy in mind.

‍

What on-device processing makes possible

Health monitoring features should provide useful insights without exposing more data than necessary.

Shen AI's on-device processing allows applications to estimate physiological parameters without sending video frames or scan data to Shen AI for analysis. Only an aggregated measurement count is transmitted for licensing and billing, while individual scan data and results remain outside Shen AI's systems.

For developers, this means they can integrate camera-based health monitoring without adding a cloud-based processing step to send scan data to Shen AI. They can then decide how measurement results fit into their application, based on its purpose and user needs.

Developers should still consider how their application handles results, including where data is stored, who can access it, and whether it is shared with other services.

Privacy starts with the way data is handled. By processing measurements locally, Shen AI helps developers limit data transfers and build health monitoring features with data minimization in mind.

‍