What we know about you
Updated September 16, 2026
This page gathers in one place everything the site says about your information: what we keep, why, for how long, and how to ask us to erase it.
This page exists to be read. The contract itself remains the Terms you accept when you order: article 8 is what governs, and it is reproduced here word for word, with nothing removed and nothing added.
What the Terms say
8.1 Data ownership
The Client and Participants acknowledge that Arsentis is responsible for the Data captured, generated, or processed as part of the Services (including cardiac signals and metadata), and that Arsentis holds the rights in the Artworks derived from it. That responsibility does not affect the rights the law grants to the persons concerned over their personal information, set out in article 8.4.
The Client and Participants consent to Arsentis collecting, storing, analyzing, transforming, deriving, aggregating and using such Data for the artistic, technical and archival purposes described herein, and for those purposes only. This consent may be withdrawn under article 8.4.
8.2 Internal use, improvement and training
Arsentis may retain and use the Data for: internal archiving, tool improvement, documentation, quality control, and artistic research. Arsentis does not train any model on Client Data. Should that change, only derived and aggregated data — stripped of direct identifiers and reproducing no individual trace — could be used, and these Conditions would be amended accordingly before any such use.
8.3 Identifiable data and confidentiality
Data may be linked to the identity of the Client/Participants in internal archives. Arsentis undertakes not to publish identifying elements (legal name, contact details, sensitive details) without additional explicit consent, except where required by law.
8.4 Access, correction, portability, withdrawal of consent, and deletion
The Client and each Participant may, by written request to Arsentis: access the Data concerning them and obtain a copy, obtain its correction, receive it in a structured, commonly used technological format where it was collected from them, withdraw their consent, or request its deletion. Arsentis replies in writing, free of charge, within thirty (30) days of the request.
The Client acknowledges, however, that certain Data may be retained where the law requires it, in particular for billing, contractual evidence, and fraud prevention; and that elements already included in backup copies are deleted only at the end of those backups' retention cycle.
8.5 Non-medical data
The Data is artistic/technical in nature and does not constitute a medical record.
8.6 Retention, destruction and derived data
Identifiable Data is retained for as long as the certificate of authenticity it relates to remains valid: it is that link which allows the Artwork to be authenticated. The certificate's validity is not limited in time; for as long as it remains valid, retention serves the purposes for which the Data was collected. Once those purposes have been fulfilled, or at the request of the Client or a Participant, Arsentis destroys it, within the period set out in article 8.4 and subject to the second paragraph of that article.
The Client acknowledges that destruction requested before the certificate ceases to be valid removes the Artwork's means of re-authentication: the certificate remains — its number, its date, the Artwork, the order, and the measurements printed on it — but Arsentis no longer holds the original signal against which to check them, nor the wearers' names.
Beyond that destruction, Arsentis may retain derived and aggregated data — measurements, statistics and parameters computed from the Data, stripped of direct identifiers and reproducing no individual trace. It serves the improvement and development of Arsentis' artistic and technical processes. Arsentis does not seek to identify a person from such data and takes reasonable measures to limit that risk.
What the site says
This section, together with the four that follow it, is the Arsentis consumer health data privacy policy. It says what we collect, where it comes from, what we do with it, who else sees it, and how you make us act.
The categories we collect are: the heart-rate and heart-rate-variability measurements recorded by the ring during your capture; the first names of the participants; your contact and delivery details; and the order record. Payment card details are handled by Stripe and never reach Arsentis.
We collect them from one source only: you, and the ring you wear. Nothing is bought, and nothing is inferred from your browsing.
We collect them to compose the artwork you ordered, to produce and ship it, and to keep its certificate of authenticity verifiable. We will not use any of it for another purpose, or collect a category not named here, without asking you first.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use heart-rate data to recognise or identify anyone, and we do not use it to determine anyone's state of health.
Quebec law requires that a person be in charge of the protection of personal information, and that their title and contact details be published. Absent a separate designation, this responsibility falls to the person holding the highest authority within the enterprise.
At Arsentis, this role is held by the founding artist, God’s Closet.
Any request for access, rectification, withdrawal of consent, or deletion, as well as any complaint regarding the processing of personal information, may be sent to them by email at godscloset@arsentis.com.
You may ask us to confirm what we hold about you and to let you see it, to correct it, to withdraw a consent you gave, and to delete it. A participant may do this on their own behalf, without going through the person who placed the order. Say which of the four you want. We answer within thirty days; if a request is complex enough that we need longer, we will tell you before those thirty days are up and take no more than forty-five additional days. We will not treat you differently for asking.
The operation of the site and the processing of orders rely on service providers established outside Quebec, primarily in the United States. Personal information may therefore be communicated to them.
The categories of providers concerned are: payment processing, site hosting, database and account authentication, sending of order and contact emails, the site’s conversational assistant, and traffic measurement by the host, which places no cookie and assigns no identifier.
Only the information necessary for the service entrusted is transmitted to them.
The categories of third parties who receive any part of this data are our service providers, and them alone: payment processing, site hosting, database and account sign-in, and order and contact email. They act on our written instructions and may use the data only to perform the service entrusted to them. We share nothing with anyone else, and Arsentis has no affiliates.
We will not collect, use, or share any category of this data, or use it for any purpose, beyond what is written in this policy without asking you first.
The order file and the invoice are kept for as long as tax law requires. The certificate of authenticity — its number, its measurements and the wearers' names — together with the data that allows it to be re-authenticated, is kept for as long as it remains valid; its validity is not limited in time.
Upon request from the person concerned, or once the purposes for which it was collected have been fulfilled, the information is destroyed within the thirty days provided for in article 8.4 of the Conditions.
Items already included in backup copies only disappear at the end of those copies' retention cycle. Arsentis does not make them accessible in the meantime.