Tuesday Privacy Policy

Effective October 14, 2026

Tuesday is a workplace application operated by BRI Health. This notice explains how we handle information when you use Tuesday at https://tuesday.brihealth.ai, including optional Google and Microsoft sign-in, Microsoft 365 email and calendar sync, email tracking and Google Drive transcript renaming when enabled. It covers Tuesday, not other BRI Health products or the independent services of Google or Microsoft.

Privacy contact: info@brihealth.ai.

Information we handle

We handle the account and workspace information provided by you or your organization: names, work email addresses, account roles, team membership, tasks, contacts, notes, and other records entered into Tuesday. We also process password hashes, invitation and account-security information, and linked sign-in identifiers. Tuesday does not store your Google or Microsoft password.

We process technical and security information, including IP addresses, request information, authentication events, and records of actions taken within the application. Audit records identify the relevant actor, action, time, and affected record or operation. They are used for accountability, troubleshooting, and investigating unauthorized activity.

Google and Microsoft sign-in

When you choose to connect or sign in with Google, Tuesday requests access to your basic Google profile and email information. The provider response may include your account identifier, name, email address, and profile picture information. Tuesday uses the response to verify your identity and retains the provider name and stable account identifier to associate that identity with your Tuesday account. It does not retain the full Google profile response as part of this login integration.

Microsoft sign-in similarly uses your basic Microsoft profile and stable identity, including the organization's tenant identifier, to verify and associate your account.

Provider access tokens are used temporarily on Tuesday's server to retrieve the identity response. This integration does not persist access or refresh tokens. Sign-in does not authorize Tuesday to access Gmail messages, Google Drive files, calendars, or Microsoft mailbox contents. Mailbox access and Google Drive transcript renaming are separate, optional connections, described below.

Connecting a provider requires proof of ownership of your existing Tuesday account and authentication with the provider. Matching email addresses do not automatically merge accounts. Using Google or Microsoft does not grant additional workspace or executive permissions.

Google-derived sign-in data is used for authentication, account linking, and related security. We do not use it for advertising, sell it, or use it to train general-purpose AI models. Tuesday's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including applicable Limited Use requirements.

Email and calendar sync

Email and calendar sync is optional and separate from sign-in. Once your organization enables it, admins and members may connect their own Microsoft 365 mailbox. Connecting lets Tuesday read the date, sender, recipients and subject line of messages in your Inbox and Sent Items and of your calendar meetings — never message bodies, previews or attachments. Tuesday cannot send mail or change your mailbox.

Only messages and meetings that include a Tuesday contact are recorded, each as an entry on that contact's timeline with its subject line, visible to Tuesday users with CRM access. During the initial pilot, subject lines are shown only to the mailbox owner. A screening filter withholds subject lines that appear to contain health information; it is a safeguard, not a guarantee. Other people on those messages may be suggested privately to the mailbox owner as possible contacts, but they are never added automatically. Open suggestions expire 90 days after they were last seen, and a dismissed address is kept only as a keyed hash for up to a year. A contact can be marked so that email and calendar activity with them is not recorded, and a mailbox owner can stop logging a conversation.

To sync in the background, Tuesday stores an encrypted Microsoft refresh token for your mailbox until you disconnect. Disconnecting deletes the stored token, sync position and your suggestions; entries already recorded stay, like any other timeline entry. An encrypted copy of the token can remain in backups for up to 90 days. To end Microsoft's authorization immediately, ask your Microsoft 365 administrator to remove your access to the Tuesday Mail application or to revoke your sessions.

Agents and integrations that use Tuesday API keys never receive subject lines or tracking information. Mailbox information is not used by Tuesday's AI features, sold, or used for advertising.

Manual email imports

You may paste email text or upload .eml files to import a thread into a contact's encounter history. These user-supplied message bodies are stored separately from encounter metadata. Only signed-in people who are currently authorized to read the encounter may read the full text; API keys and Tuesday's AI features cannot access it.

Tuesday screens the full submitted text, summary and next step for patient information and blocks detected patient information. Uploaders must also confirm that the thread contains no patient data. Screening and confirmation are safeguards, not a guarantee; do not import patient information.

Manual email bodies are retained until the whole contact identity is erased, including merged aliases. Backup retention is unchanged: copies may remain in protected backups until the existing retention and expiration processes complete. Manual imports are separate from automated mail sync, which never downloads message bodies.

Email tracking

Email tracking is optional and applies only to new messages that a sender chooses to track with Tuesday's Outlook add-in. Just before such a message is sent, Tuesday adds a small invisible image and rewrites its web links to pass through a Tuesday address. When a recipient's mail program loads the image or someone follows a link, Tuesday records a possible open or possible click with its time and count; for links, only the destination's host is shown. These signals are uncertain: mail scanners, image proxies and the sender's own copy can cause them, and they do not show which recipient acted. Tuesday does not log the IP address of these requests. Signals are recorded for 90 days, and tracked links keep redirecting for 365 days so that they do not break. Tracking information is visible to Tuesday users with CRM access. If you received a tracked message, you can contact us at the address above.

Google Drive transcript renaming

Transcript renaming is optional, separate from sign-in, and available only once your organization enables it. A person who can edit a meeting may connect their own Google account through a separate Google authorization that lets Tuesday see and rename only the files they choose in Google's file picker. Tuesday reads the chosen file's name and version, shows the current and proposed names, and renames the file only after the person confirms. It never reads file contents, never deletes files, and never repeats a rename on its own.

Tuesday never stores the Google access token. It holds it in server memory for at most an hour and, while Google's file picker is open, in that picker window in your browser. Tuesday stops using it when you disconnect, sign out or lose access to meetings. Disconnecting makes Tuesday forget the token at once, but Google may keep it valid for up to an hour; to end it sooner, remove Tuesday in your Google Account settings. To support rename checks, Tuesday retains a private record of each attempt: the meeting, the Drive file identifier, the outcome and keyed one-way hashes of your Google account identifier and of the proposed name. These records are not available to API keys, agents or Tuesday's AI features, and are not sold or used for advertising. When a contact is erased, the records for meetings that linked that contact lose the meeting link and the name hash; the file identifier and outcome remain. Erasure does not rename files in Google Drive, so a title Tuesday already set, which can contain an attendee's name, stays as it is until someone changes it in Drive. Copies may remain in protected backups until the existing retention and expiration processes complete. You can remove Tuesday's Drive access at any time in your Google Account settings.

Why we use information

We use information to operate your account and workspace, provide the features you use, enforce access permissions, maintain security and audit history, respond to support requests, and recover the service after failures. Your organization manages workspace membership and the permitted use of workplace records.

Where privacy law requires a legal basis, the applicable basis depends on the processing and our relationship with you or your organization. It may include providing contracted services, legitimate interests in operating and securing a workplace service, complying with legal obligations, or consent where required. Choosing a sign-in provider authorizes that connection; it does not constitute consent to unrelated uses of your data.

Who receives information

Authorized workspace members can access records according to their permissions. Authorized operators and service providers may access information as necessary to operate, support, secure, or recover Tuesday. Amazon Web Services provides hosting, storage, and related infrastructure. Google or Microsoft processes authentication requests when you choose its sign-in service, under its own privacy terms. If you connect your mailbox, Microsoft also processes Tuesday's requests for your mailbox and calendar information. If you connect Google Drive, Google also processes Tuesday's requests for the files you choose.

Tuesday currently loads fonts from Google Fonts. Your browser therefore connects to Google to request those assets, transmitting technical information such as your IP address and request headers. This happens independently of whether you choose Google sign-in.

We may disclose information when required by applicable law or as necessary to investigate abuse, protect security, or protect legal rights. We do not sell personal information or share it for targeted advertising.

Cookies and browser storage

If you choose Remember this browser, Tuesday stores a necessary authentication cookie for up to 30 days. The server stores a hash of that credential, its browser label and creation/expiry times. You can revoke remembered browsers in Sign-in methods. Signing out, password changes, and account revocation can end remembered access earlier. Remembering a browser does not bypass executive document verification.

Tuesday uses cookies to maintain authenticated sessions and protect sign-in transactions. The application may also use browser storage for interface preferences and working state. Your browser must receive the workspace information it displays; cloud hosting does not prevent authorized users from viewing, copying, or downloading information available to them. Blocking necessary cookies may prevent sign-in from working.

Hosting and safeguards

Tuesday is hosted on AWS in the United States. Information may therefore be processed outside your country. Where legally required, appropriate transfer arrangements must apply to that processing.

Safeguards include encrypted connections, access controls, protected credentials, security logging, and encrypted cloud backups. Access permissions apply independently of your choice of sign-in provider. No system can guarantee absolute security.

Retention and deletion

We retain account and workspace information for the operation of the service and your organization's authorized business purposes. Security and audit information may be retained separately to investigate incidents, establish accountability, and satisfy applicable obligations. Retention depends on the record type, organizational instructions, security needs, and legal requirements.

You may request access, correction, export, or deletion by contacting info@brihealth.ai. We may verify your identity and coordinate with your organization before acting. Depending on applicable law, some requests may be limited by another person's rights, security needs, or legal retention requirements. Where relevant, you may also request restriction, object to processing, withdraw consent for consent-based processing, or complain to your local data-protection authority.

You can disconnect a linked provider in Tuesday's Sign-in methods where available. Accounts subject to additional security protections require operator assistance. Disconnecting removes the active provider association; it does not delete your Tuesday account, workspace records, or historical security logs. You can also revoke Tuesday's access through your Google or Microsoft account settings. To request deletion of information already held by Tuesday, contact us directly.

Deleted or disconnected information may remain in protected backups until the applicable backup retention and expiration processes complete. Backup retention or legal holds may prevent immediate removal. We do not promise immediate deletion from every backup copy.

AI organizer and company-document features

Tuesday's automatic AI task organizer is enabled as of the effective date. When you create a task, it uses AWS Bedrock with models from the Anthropic Claude family to help fill missing priority, category, due date and, for eligible admins and managers, team fields. Limited portions of the task title and description, existing workspace category labels and, when selecting a team, up to 20 workspace team names and identifiers may be sent to AWS Bedrock. Suggestions are validated before being saved and only fill fields that are still blank.

Tuesday's local AI audit and usage records contain operation metadata and usage counters, not full prompts or raw model responses.

Company Brain remains disabled. Google and Microsoft sign-in are not document-import permissions. They do not give Tuesday's agents access to your provider's files or messages. Before introducing additional processing through AI or company-document features, we will provide the relevant disclosures and obtain authorization or consent where required.

Workplace use and changes

Tuesday is intended for authorized workplace use, not services directed at children. Do not submit patient-identifiable information unless your organization has expressly authorized the relevant use and the necessary contractual and technical safeguards are in place.

We will update this notice when our practices change and identify the effective date. Material changes will be communicated as appropriate. If Google-derived information is to be used for a new purpose requiring renewed consent, that consent will be requested before the new use begins.