Privacy Policy

How we handle your information.

Effective date: September 10, 2026 · Last updated: September 10, 2026 · What changed in this version: we described the payment record accurately, because it holds a copy of your intake (Section 01); we named reproductive-health and mental-health information as sensitive (Section 01b); we completed the list of companies that handle your information (Section 03); we said plainly where the page-metrics switch does not yet reach (Section 04); we corrected what happens when you unsubscribe and what deletion can and cannot reach (Sections 05 and 06); and we replaced the security paragraph with a plain description of how your report link actually works (Section 07). Washington and Nevada residents: there is a separate Consumer Health Data Privacy notice.

This Privacy Policy describes how Kascade Health LLC (“Kascade,” “we,” “our,” or “us”) collects, uses, and discloses information about you when you visit kascadehealth.com or use our lab interpretation service (collectively, the “Service”).

Kascade Health™ is a health education and literacy platform. It is not a covered entity under HIPAA, and the information you provide is not protected health information (PHI) within the meaning of HIPAA. We nonetheless treat the information you provide with rigorous privacy protections consistent with industry best practices.

01Information we collect

Information you provide directly

Information collected automatically

01aNotice at collection (California residents)

This section is provided to comply with California Civil Code § 1798.100(b). At or before the point of collection, we inform you of:

01bSensitive personal information

The lab values you enter (e.g., fasting insulin, SHBG, hsCRP, etc.) may constitute sensitive personal information under California law. So does a good deal of what sits around them, and we would rather name it than leave it inside a general word:

We use your lab values solely to generate the educational interpretation you requested and to operate the Service. We do not use your lab values for any other purpose, including marketing, profiling for cross-context advertising, or training third-party AI models. The same is true of everything else listed just above. You have the right to limit our use of sensitive personal information; however, doing so will prevent us from generating your interpretation.

If you live in Washington or Nevada, the Consumer Health Data Privacy notice sets out the additional rights those states give you over this information.

01cAutomated decision-making

Your educational interpretation is generated by an AI system (Anthropic’s Claude model) using a system prompt designed and maintained by Kascade. The interpretation is educational research context based on published literature and is not a diagnostic determination, treatment recommendation, or clinical evaluation. The output may contain errors, omissions, or generalizations and should always be reviewed with a qualified healthcare provider. By submitting your lab values, you understand and consent to automated generation of the interpretation. You may opt out of automated generation only by not purchasing the Service.

02How we use your information

We use the information we collect to:

We don’t accept money or anything else of value in exchange for your personal information. Your lab values never go to advertisers or data brokers, and they’re not used to train anyone’s AI model. They’re used once, to write the interpretation you asked for.

03Who we share information with

We share information only with the third-party service providers we need to operate the Service, each acting on our instructions under confidentiality and security obligations:

We may also disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or a governmental request, or to protect the rights, property, or safety of Kascade, our users, or others.

04Cookies and tracking

Here is everything this site sets, and there is not much of it.

The emails we send you are measured separately from this website. Section 04b covers that, including how to stop it.

We do not use session recording. Nothing on this site replays your screen or watches your mouse. We removed Microsoft Clarity on 1 September 2026 because Microsoft’s terms let it use what it collects for its own purposes, advertising profiles included, and we were not willing to put that on a site where women read about their own health.

There is nothing left to switch off

This section used to explain how to turn page metrics off, and then explain honestly that the switch did not reach every page. Both are now out of date, and here is the whole story, because we would rather you saw the correction than a tidy version of it.

The page-metrics script was never something our own code added. Our host inserted it as each page was served, which happens after our code has had its say, so neither our switch nor your Global Privacy Control signal could stop it loading. On the intake page and the report page we send a security instruction with the page that stops it connecting anywhere except back to us, so it could never send anything from the two pages that hold your lab values. On our other pages it still loaded and still sent the page address, your browser, your operating system, your screen size and your IP address, even if you had switched it off here.

We said there were two ways to close that and that we were taking one of them. On 11 September 2026 we switched the tool off at our host entirely. Nothing is inserted into any page now, on any part of this site, for anyone. The blocking instruction on the intake and report pages stays in place as a second layer.

The cookie notice and the “Cookie preferences” link in the footer still work and your choice is still remembered. There is simply nothing for them to govern at the moment. If we ever add a measurement tool again, they are the control, this section will say what it is, and Section 10 tells you how we let you know the policy changed.

We store your choice in your browser, so it holds on that device until you clear your browsing data. If you switch browsers or devices, set it again there, because the first browser can’t pass the message along and we have no account to apply it from our side. If something isn’t working, email hello@kascadehealth.com and we’ll help you sort it out.

Switching it off changes nothing about what you can do here. You can still buy a report, you’ll still receive one you’ve already paid for, and the interpretation itself is identical either way. We don’t treat you differently for saying no.

04aNothing is sent from your lab pages

The page where you enter your lab values, your medications and your symptoms, and the page where your report is displayed, are served with an instruction to your browser that blocks those pages from connecting to anywhere except back to us. The page-metrics script has nowhere to send to. It cannot report that you were there, and it cannot report anything else either.

So no page-metrics data about your intake or your report leaves your browser: not a lab value, not a medication name, not a symptom you ticked, not a word of your report, and not the fact that you opened the page. This is a property of those two pages rather than a setting you have to find. It holds whether or not you have changed anything, and it holds if you never touch the notice at all. Our own code also keeps page metrics off those two pages by name, and has since 1 September 2026; the blocking instruction is what makes that hold even though our host inserts a script of its own.

This is also why the private link that opens your report cannot be leaked by page metrics. Nothing on that page is permitted to send anything anywhere.

Payment happens on Stripe’s own checkout page, which Stripe operates under its own privacy policy and its own fraud and security tooling.

04bYour report link, and email opens and clicks

Your report is reached by a link, and that link is the only key. It travels through our email provider, Resend, which handles the delivery. Anyone holding the link can open the report. That is true whatever the measurement settings below say, because we hand the full address of your report to Resend every time we send you one, so that it can put the link in the message.

Separately from that, an email provider can measure two things about an email: whether it was opened, and whether a link inside it was clicked. Opens are measured with a 1x1 transparent image that loads when the message is displayed. Clicks are measured by routing the links through links.kascadehealth.com, which forwards you to the real destination straight away. We look at this to judge whether the emails we send are worth sending. Nobody else receives it, and it is never sold or shared for advertising.

You can tell from the email itself whether click measurement is switched on for the message in front of you. Hold your cursor over a link, or press and hold it on a phone. If the address reads links.kascadehealth.com, the click is measured. If it reads kascadehealth.com, it is not.

Where it is on, that includes the email that delivers your report. What we see is that a link was clicked and when, never anything inside your report and never your lab values.

Open measurement is unreliable by design, and we treat it that way. Plenty of mail apps load that image automatically or fetch it through their own servers, so an open can be recorded when nobody read a word, and a genuine read can go uncounted when images are blocked. If you would rather not be counted, switching off automatic image loading in your mail app stops open measurement, and the unsubscribe link in every marketing email stops the emails.

This is measurement of the email itself. It is separate from the page metrics in Section 04, and none of it runs on this website.

05How long we keep information

We retain personal information for as long as needed to provide the Service and for legitimate business purposes, including tax, accounting, and legal compliance. Generally:

06Your rights

For California residents (CCPA / CPRA)

You have the right to:

To exercise these rights, email hello@kascadehealth.com with the subject line “Privacy Rights Request.” We will respond within 45 days.

For all users

You may unsubscribe from marketing emails at any time using the link in any email. You may request a copy or deletion of your data by emailing the address above.

What deletion actually reaches

When you ask us to delete your record, this is what goes:

Your report link stops working from that moment, for you and for anyone else who has it. That is the only way to switch a link off, and it is why Section 07 calls deletion the revocation.

And this is what it does not reach, which we would rather you heard from us:

If you want any of those addressed, say so in the same email and we will tell you honestly what we can and cannot do about each one.

If we say no

You can appeal any decision we make on a privacy rights request. Reply to our decision, or write to hello@kascadehealth.com with the subject line “Privacy Appeal,” within 45 days of receiving it. Tell us what you asked for and why you think the answer was wrong. A person, not an automated process, will look at it again, and we will write back within 45 days with the decision and the reason for it.

If we deny the appeal, you can complain to your state Attorney General. Washington residents: atg.wa.gov/file-complaint. Nevada residents: the Office of the Nevada Attorney General, ag.nv.gov. California residents may contact the California Privacy Protection Agency or the California Attorney General. We will also tell you how to do this in the denial itself.

How we verify requests

To protect your information, we verify your identity before fulfilling rights requests. We may ask you to confirm your email address used at signup and at least one of: your full name as provided, the date of your most recent purchase, or other reasonably available information. We do not require account creation or government ID. We respond to verified requests within 45 days (extendable once by 45 days if reasonably necessary, with notice).

Global Privacy Control (GPC)

If your browser or a browser extension sends a Global Privacy Control signal, we read it on every page load and honor it automatically. It does two things.

First, we treat it as a valid opt-out of any “sale” or “sharing” of personal information. That one changes nothing in practice, because we don’t do either.

Second, we treated it as you telling us to switch off page metrics. That part is now moot: as of 11 September 2026 there are no page metrics on this site for anyone, whatever their browser sends. Section 4 explains what changed and why.

Authorized agents

You may designate an authorized agent to make a privacy rights request on your behalf. The agent must provide written authorization signed by you, and we may verify your identity directly.

06aBreach notification

In the event of a security breach affecting your personal information, we will provide notice as required by applicable law, including California Civil Code § 1798.82 for California residents and North Carolina General Statutes § 75-65. Notice will include, where known, the categories of information affected, the date(s) of the breach, our response, and steps you may take to protect yourself. We will issue notice without unreasonable delay following confirmation of a breach. Where a breach affects more than 500 California residents we will also notify the California Attorney General, and whenever we notify affected individuals we will notify the Consumer Protection Division of the North Carolina Attorney General’s Office, which North Carolina requires regardless of how many people are affected.

07Security, and how your report is actually reached

The honest description is short, and it tells you more than a paragraph about safeguards would.

Alongside that we take ordinary care of the information while we hold it: it travels over encrypted connections, it sits with hosts that run their own security programs, and the number of people at Kascade who can reach it is one. No system is perfectly secure, and we cannot guarantee the absolute security of information transmitted over the internet. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

08Children

The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it promptly. If you believe a child under 18 has provided information to us, please contact hello@kascadehealth.com.

09International users

The Service is operated from the United States and intended for U.S. residents. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law. We do not currently offer the Service to residents of the European Economic Area or the United Kingdom.

10Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (if you have provided one) and post the updated policy on the Service with a new effective date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

11Contact

If you have questions about this Privacy Policy or how we handle your information, contact us at:

Kascade Health LLC
hello@kascadehealth.com