Privacy Policy

This Privacy Policy explains how Cadence Inc. ("Cadence", "we", "us") handles personal information and health data that you share with us when you use Cadence. We have written it to be readable, not just legally complete.

Cadence is a consumer health product, not a healthcare provider and not a covered entity under HIPAA. The data you log is your personal health information, and we treat it with care. We do not sell it. We do not use it to profile you for advertising. We hold it only to provide the service.

We collect only what we need to make Cadence useful to you:

• Account information: your name, email address, and a secure hash of your password.
• Health logs: entries you type or tap, including readings (blood pressure, blood glucose, weight), how you feel, meals, medications, and any notes you add.
• Profile information: any condition information you choose to add, such as a diagnosis, to help Cadence tailor its support.
• Usage data: basic information about how you use the app, such as which features you use most, to help us improve the product. This is not linked to your health logs.
• Communications: messages you send us through support forms or email.

We do not collect or store your payment card details. Card information is handled directly by our payment processor, Stripe.

We use the information you provide to:

• Operate your account and keep it secure.
• Generate trends, suggested questions, visit summaries, and reminders based on your logs.
• Send you notifications and reminders you have chosen to enable.
• Respond to support requests and questions.
• Improve Cadence's features and reliability, using aggregate and anonymised patterns, never your identifiable health data.

We do not use your health data to train AI models. When Cadence uses an AI model to generate a visit summary or a suggested question, your data is sent to the provider under a data processing agreement that prohibits use for model training.

Cadence uses large language models to turn your logs into summaries, identify trends, and suggest questions for your care team. When it does, a portion of your recent logs may be sent to an AI model provider to generate the output.

We apply a minimum-necessary principle: we send only the context needed for the specific task, not your full history. The provider processes this data under an agreement that:

• Prohibits use of your data to train or improve any public AI model.
• Requires confidentiality and security protections equivalent to our own.
• Limits use to fulfilling your specific request.

We keep a current list of AI model providers that may process your data and will notify you of material changes.

We share information only in limited circumstances:

• Service providers: companies that help us run Cadence, such as our hosting provider, database provider, AI model providers, and payment processor. Each is under a written agreement with confidentiality and security obligations.
• Your care team: if you choose to share a visit summary or grant a clinician or caregiver access, we send only what you explicitly choose to share, to the recipient you specify.
• Legal requirements: if required by law, court order, or to protect the safety of users or the public. We will tell you unless the law forbids it.

We do not sell your personal information or health data to any third party, including data brokers, advertisers, or research organisations.

We protect your data with encryption in transit (TLS) and at rest (AES-256), strict access controls, and isolated data storage. No system is perfectly secure, but security is a first-class part of how we build Cadence.

For a full description of our security practices, visit our Security page at https://getcadence.tech/security. To report a security concern, write to security@getcadence.tech.

We keep your account information and health logs for as long as your account is active. When you delete your account, we remove your health data from our systems within 30 days. Some records, such as billing history, may be retained longer where the law requires it.

You have the following rights regarding your personal information:

• Access: you can download a complete copy of your data as JSON from Settings at any time.
• Correction: you can update your account information and any log entry directly in the app.
• Deletion: you can permanently delete your account and all your health data from Settings.
• Objection: you can contact us to object to any processing we have described in this policy.

To exercise any right or to ask a question about this policy, write to us at privacy@getcadence.tech.

Cadence is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We will update this policy when our practices change in a meaningful way. We will notify you by email and by posting the updated policy with a new effective date. Continued use of Cadence after the update means you accept the revised policy.

For questions about privacy, write to privacy@getcadence.tech. For security matters, write to security@getcadence.tech. For anything else, write to hello@getcadence.tech.

Cadence Inc., 141 Tremont Street, Suite 300, Boston, MA 02111, United States.