How we handle your information.

Effective date: September 10, 2026 · Last updated: October 27, 2026

This Privacy Policy describes how Kascade Health LLC (“Kascade,” “we,” “our,” or “us”) collects, uses, and discloses information about you when you visit kascadehealth.com or use our lab interpretation and Supplement Stack Audit services (collectively, the “Service”).

01Information we collect

We collect information from the following sources:

• Directly from you: when you provide information through the Service, purchase a report, sign up for our free educational materials, or communicate with us.
• Through your use of the Service: certain technical information may be generated or collected automatically through the operation, security and delivery of the Service.
• Generated by Kascade: we generate certain calculated, classified or other derived information from the information you provide, including as part of the processing used to generate your report.
• Through service providers: we may receive or access certain information through providers that support payment processing, email delivery and other Service operations.

Information you provide directly

• Contact information: first name and email address when you sign up for the free Lab Decoder Guide, purchase a lab interpretation, or contact us.
• Health and other information you provide: When you use the Service, you may provide laboratory values and other information used to generate your report, including your first name, age, height, weight, ancestry, information regarding whether you have received a PCOS/PMOS diagnosis, pregnancy or breastfeeding status, current medications, supplements and doses, symptoms, lifestyle information, free-text notes, and information about what you are hoping to understand from the report. The laboratory information currently requested may include fasting insulin, fasting glucose, HbA1c, HOMA-IR, total testosterone, free testosterone, SHBG, DHEA-S, hsCRP, LH, FSH, vitamin D, triglycerides, HDL, AMH, TSH, anti-TPO and morning cortisol.
• Payment information: when you purchase a report, payment is processed by Stripe. Kascade does not store your full payment card number; we receive only a Stripe customer identifier and basic transaction metadata.
• What the payment record itself holds: For purchases made on or after 22 September 2026, the payment record Stripe holds carries your first name, which product you bought, the record of the consent you gave at checkout, your keep-my-results choice, and a pointer to your intake, which is stored with our host. Your lab values, medications, symptoms and notes are not sent to Stripe. For purchases made before that date, your intake travelled to Stripe attached to the payment, so that payment record carries a shortened copy of it: your first name, the lab values you entered, your medications, the symptoms you ticked, your free-text notes, what you said you were hoping to get out of the report, and the record of the consent you gave at checkout. Long answers were capped there and stored in full with our host instead. This reflects the way the Service currently operates. It is used only to build your report and to show it to you again when you open your link.
• Your email address, read back from Stripe: Before we send an email that sells the report, we ask Stripe who has already bought one and take those people out of the list. So the address you paid with is read back out of the payment record for that one purpose.
• What you tell us when you ask for a Challenge spot. The PCOS/PMOS Clarity Challenge has its own short request form. It asks for your first name and email, what made you interested in the Challenge, what feels most confusing to you right now, and what would make it useful. It does not ask whether you have been diagnosed with anything, and it asks you not to put lab values, medication names, diagnoses or other private medical information in the free-text box. If you write health information there anyway, we treat it as sensitive. We use the form only to decide whether the Challenge is a fit for you and to write to you about it. It is not added to any marketing list, it is not used to build your report, and it is not sold or shared for anyone else’s purposes.
• Challenge calls. The PCOS/PMOS Clarity Challenge includes an introductory call and a debrief call, held by video on Google Meet. What you choose to say on those calls may include health information, such as your symptoms, your lab results or your health history. We record a call only if you agree to it. We tell you before the call that calls are recorded, we ask again at the start of the call, and if you would prefer not to be recorded, we do not record it. Declining does not affect your place in the Challenge or anything you receive in it. We use a recording only to keep an accurate record of what was discussed, to provide the Challenge to you, and to respond to any question or concern about it. We do not publish it, use it in marketing or advertising, sell or share it, or use it to train any AI model, and we will not quote you or use your name, image, voice or words publicly without your separate written permission.
• The Inositol Masterclass waitlist. The waitlist form asks for your first name and email. It also asks three optional questions: how well you feel you understand your PCOS/PMOS, how much you already know about inositol, and which topics you would most like covered. It does not ask about your health, your diagnosis, your medications or whether you take any supplement. We use your answers to plan the masterclass and to write to you about it, and you may also receive our educational updates, which you can unsubscribe from at any time. We do not sell your information or share it for anyone else’s purposes.
• Communications: the contents of emails or other messages you send us.

Information collected automatically

• Usage data: on our public website pages we use Microsoft Clarity, described in Section 04; we do not use tracking scripts, analytics cookies or session-recording technologies anywhere else on the Service. Our hosting provider, Netlify, generates and retains ordinary technical records of requests as part of operating and securing the Service, and we use its Web Analytics feature to view aggregate visit statistics built from those records (see Section 04).
• Cookies: see the Cookies section below for detail.

01aNotice at collection (California residents)

This section is provided to comply with California Civil Code § 1798.100(b). At or before the point of collection, we inform you of:

• Categories of personal information collected: identifiers (name, email), commercial information (purchases), and health and other sensitive personal information, including the laboratory values, health information, demographic information, pregnancy or breastfeeding status, medications, supplements, symptoms, lifestyle information, free-text information, and other information you voluntarily provide in connection with the Service, as described in Section 01.
• Purposes: to provide the educational interpretation, deliver your report, communicate with you, process payments, maintain and retrieve reports, provide customer support, conduct quality assurance and testing, maintain and improve the Service and its automated processing systems, protect the Service, and comply with legal obligations, as further described in Section 02.
• Retention: as described in Section 5 below.
• Sale or sharing: we don’t accept money or anything else of value in exchange for your personal information, and we don’t share it so anyone can advertise to you across other websites.
• Affiliate links: we earn a commission when someone orders lab testing through a partner link on our site. Currently, this includes Ulta Lab Tests. Clicking the link takes you to the partner. We don’t send your name, your email or your lab values with you merely because you click the affiliate link, and the commission never changes your price. The laboratory-testing partner may collect information directly from you when you visit or transact with its website, subject to its own privacy policy.
• Opt-out preference signals: we honor the Global Privacy Control signal automatically as an opt-out of any sale or sharing. A browser that sends it does not load Microsoft Clarity (Section 04), and the aggregate visit statistics described in Section 04 are not used for advertising.

01bSensitive personal information

The lab values you enter (e.g., fasting insulin, SHBG, hsCRP, etc.) may constitute sensitive personal information under California law. So does a good deal of what sits around them, and we would rather name it than leave it inside a general word:

• Reproductive health information. The intake asks what you are hoping to get out of the report, and trying to conceive is one of the answers. It asks about hormonal contraception, hormone therapy and whether you recently came off the pill, and about what your cycle is doing. The Service also asks you to confirm whether you are currently pregnant or breastfeeding. All of that is reproductive health information about you, and we hold it.
• Mental health information. We do not ask for it. The free-text box is yours, though, and users may voluntarily include information about mood, anxiety, and sometimes about thoughts of harming themselves. If you voluntarily include health or mental-health information in a free-text field, we treat that information as sensitive health information and process it only for the purposes described in this Privacy Policy.
• What you tell us on the Challenge request form. The form asks what has been confusing, not what is wrong with you, and it asks you to leave lab values, medication names and diagnoses out of the free-text box. If you write health information there anyway, we treat it as sensitive.
• What you say on a recorded Challenge call. If a Challenge call is recorded with your agreement and you discuss your health on it, the recording contains that health information, and we treat it as sensitive.
• Your laboratory values, other health and intake information, and the interpretation and other derived information generated from them.

We use your laboratory and health information to provide the Service and for other purposes described in this Privacy Policy, including security, fraud prevention, legal compliance, quality assurance and service improvement where permitted by applicable law. We do not use your lab values for any other purpose, including marketing, profiling for cross-context advertising, or training third-party AI models. The same is true of everything else listed just above. We use and disclose sensitive personal information only for purposes permitted under applicable law, including to provide the Service and for the other purposes described in this Privacy Policy. Where applicable law requires us to provide a right to limit the use or disclosure of sensitive personal information, we will provide the required notice and mechanism to exercise that right.

If you live in Washington or Nevada, the Consumer Health Data Privacy notice sets out the additional rights those states give you over this information.

01cAutomated decision-making

Your educational interpretation is generated by an AI system (Anthropic’s Claude model) using a system prompt designed and maintained by Kascade. The interpretation is educational research context based on published literature and is not a diagnostic determination, treatment recommendation, or clinical evaluation. The output may contain errors, omissions, or generalizations and should always be reviewed with a qualified healthcare provider.

We use automated systems, including Anthropic’s Claude model and Kascade-developed rules and processing logic, to analyze the information you provide and generate your educational report. Before the AI component is used, certain information is processed through Kascade’s own deterministic rules and validation logic. The resulting output is also subject to automated checks designed to identify prohibited or unsupported content and other formatting or consistency issues.

The resulting report is educational in nature and is not a diagnosis, medical treatment recommendation or clinical evaluation. Automated outputs may contain errors, omissions or generalizations and should not be relied upon as a substitute for advice from a qualified healthcare professional.

Where applicable law provides rights relating to our use of automated decision-making technology, we will provide the required notices and mechanisms for exercising those rights.

02How we use your information

We use the information we collect to:

• Provide the educational services you requested, including the lab interpretation and, where applicable, the Supplement Stack Audit.
• Deliver your report by email and send transactional communications (receipts, account messages).
• Send you the free Lab Decoder Guide and follow-up educational content if you opted in.
• Respond to your questions and provide customer support.
• Hold the PCOS/PMOS Clarity Challenge calls you signed up for and, where you have agreed, keep a recording of them for our records.
• Improve the Service, including by analyzing aggregate, de-identified usage patterns.
• Detect, prevent, and respond to security incidents, fraud, and unauthorized access and other activity that may harm the Service or its users.
• Comply with legal obligations and respond to lawful requests from governmental authorities.
• Process payments and maintain transaction and consent records.
• Store, maintain and retrieve your intake information and report as necessary to provide the Service.
• Respond to and process privacy rights requests and other requests relating to your information.
• Conduct quality assurance, testing, validation and maintenance of the Service, including maintaining and improving our automated processing systems. Use the information you provide, together with Kascade-generated calculations and classifications, to generate and quality-check your educational outputs, including the lab interpretation and, where applicable, the Supplement Stack Audit, through our automated processing systems.

We may also use information as reasonably necessary to establish, exercise or defend legal claims, enforce our agreements and policies, protect our rights and property, and conduct or prepare for a corporate transaction such as a merger, acquisition, financing, reorganization or sale of assets.

We don’t accept money or anything else of value in exchange for your personal information. Kascade does not provide your lab values to advertisers or data brokers, and does not use them to train its own or third-party AI models. Our current commercial arrangement with Anthropic also prohibits Anthropic from using customer inputs and outputs to train its models.

We use your information only for the purposes described in this Privacy Policy and the purposes for which it was collected.

03Who we share information with

We use third-party providers and service providers to process information on our behalf and to provide services necessary to operate the Service. Depending on the provider and the nature of the service, these providers may process information under contractual terms governing confidentiality, security and permitted use:

• Stripe · payment processing. For purchases made before 22 September 2026, the payment record also holds the shortened copy of your intake described in Section 01, including certain laboratory values, medications, symptoms, notes and other information associated with your purchase. For later purchases it holds no health information, as Section 01 describes.
• Anthropic (Claude API) · the AI service used to generate your educational interpretation. The information sent to Anthropic includes the laboratory values and other information from your intake, such as your age, height, weight, diagnosis status, medications, supplements and doses, symptoms, lifestyle information, free-text notes and report objective, together with calculated or classified results generated by Kascade’s own processing before the AI step. Your email address is not sent to Anthropic as part of this model call. Kascade’s current commercial terms with Anthropic prohibit use of customer inputs and outputs to train Anthropic’s models. Information submitted to Anthropic may be retained or processed for purposes described in Anthropic’s applicable commercial terms and documentation. The retention and deletion of information submitted to Anthropic are governed by Anthropic’s applicable commercial terms and documentation. Kascade is continuing to confirm the specific retention and deletion arrangements applicable to its use of the Claude API. Kascade does not use Anthropic consumer products for this Service.
• Resend · email delivery, and the open and click measurement described in Section 04b, including your email address, report link and related email delivery information. Every time we email you your report, the full address of that report is handed to Resend so it can put the link in the message.
• AWS CloudFront · the network that answers for links.kascadehealth.com, the address our email links pass through when click measurement is on. It sits in front of Resend, so a click measured there passes through Amazon’s network as well.
• Netlify · website hosting, form submissions, serverless function execution, and storage of your generated report, intake information and the laboratory values it was built from (Netlify Blobs), and aggregate visit statistics built from its server records (Netlify Web Analytics, see Section 04)
• Google Workspace · the video service (Google Meet) used for PCOS/PMOS Clarity Challenge calls, and the storage (Google Drive) that holds a call recording you have agreed to. Google processes this information to provide that service to us, under its terms for Google Workspace.
• Namecheap Private Email · our own mail provider rather than a contracted processor: the mailbox behind hello@kascadehealth.com. It holds anything you send us, under Namecheap’s own terms. It used to receive a blind copy of every report email we issued; it no longer does, but copies sent before that change may still be held there, with the information they contain.
• Google · also our own mail provider rather than a contracted processor: that mailbox is collected into a Gmail account so it can all be read in one place. Google therefore holds the same mail, under its own terms, including any of those earlier copies and the information contained in them.

We may change or add service providers from time to time as our Service develops. Where required by applicable law, we will update this Privacy Policy before or when such changes take effect and provide any additional notice or choice required by law.

We may also disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or a governmental request, or to protect the rights, property, or safety of Kascade, our users, or others.

04Cookies and tracking

We currently use only strictly necessary cookies and local storage on the Service. These technologies are used as necessary for the Service to function, including remembering your preferences in your browser, temporarily storing a part-finished intake on your device for up to seven days so that you can return to and complete it, and keeping the browser you enter your access code on signed in to your report for up to 14 days. That draft remains on your device until you submit it, and you can erase it at any time using the erase function provided on the intake page.

Visit statistics. We use Netlify Web Analytics, a feature of our hosting provider, to see aggregate traffic to the Service: how many pages were viewed and which ones, approximately how many different visitors there were, roughly which countries visits came from, which websites referred visitors, and which addresses returned “page not found.” Netlify builds these statistics from the ordinary records its servers keep of each request, so no script runs in your browser for them and no cookie is set for them. Netlify estimates the number of different visitors from the IP address of each request; we see totals, not IP addresses. The statistics cover the whole site, including the intake and report pages, because Netlify cannot limit them to particular pages. They list page addresses without anything that follows a question mark, and they never include what you type into a form or the contents of your report. The link in your report email is set up so that its unique part does not appear in these statistics.

Microsoft Clarity on our public pages. On our home page and our About, FAQ and free guide pages we use Microsoft Clarity, a Microsoft service, to understand how visitors use those pages: where they click, how far they scroll, and recordings of visits to those pages, with anything typed into a form masked. Clarity sets its own cookies and is loaded from Microsoft, which processes this data under its own terms. It is not loaded on the pages where you enter health information, on your report or the pages that open it, on the Clarity Challenge request page, or on any internal tool. It runs only while Analytics is on in Cookie preferences, which you can turn off at any time, and never in a browser that sends Global Privacy Control. We discontinued Clarity on 1 September 2026 and resumed it on these public pages only on 27 September 2026.

No page-performance measurement. We do not use page-performance measurement technologies on the Service. We previously used Netlify RUM for limited page-performance measurement, but discontinued it on 11 September 2026.

If we introduce other analytics, session-recording, advertising, or similar tracking technologies in the future, we will update this Privacy Policy to describe those technologies and implement any consent, opt-out, or preference mechanisms required by applicable law.

04bYour report link, and email opens and clicks

Your report is reached by a link and a separate six-digit access code. The link travels through our email provider, Resend, which handles the delivery. Anyone holding both the link and the code can open the report, as Section 07 explains. That is true whatever the measurement settings below say, because we hand the full address of your report to Resend every time we send you one, so that it can put the link in the message.

Separately from that, an email provider can measure two things about an email: whether it was opened, and whether a link inside it was clicked. Opens are measured with a 1x1 transparent image that loads when the message is displayed. Clicks are measured by routing the links through links.kascadehealth.com, which forwards you to the real destination straight away. We look at this to judge whether the emails we send are worth sending. We use these measurements only for email-delivery and engagement purposes and do not use them for cross-context behavioral advertising.

You can tell from the email itself whether click measurement is switched on for the message in front of you. Hold your cursor over a link, or press and hold it on a phone. If the address reads links.kascadehealth.com, the click is measured. If it reads kascadehealth.com, it is not. Where it is on, that includes the email that delivers your report. What we see is that a link was clicked and when, never anything inside your report and never your lab values.

Open measurement is unreliable by design, and we treat it that way. Plenty of mail apps load that image automatically or fetch it through their own servers, so an open can be recorded when nobody read a word, and a genuine read can go uncounted when images are blocked. If you would rather not be counted, switching off automatic image loading in your mail app stops open measurement, and the unsubscribe link in every marketing email stops the emails.

This is measurement of the email itself. It is separate from the visit statistics in Section 04, and none of it runs on this website.

05How long we keep information

We retain personal information for as long as needed to provide the Service and for legitimate business purposes, including tax, accounting, and legal compliance. Generally:

• Lab values and your generated report: stored so you can revisit your report link. We delete them whenever you ask, at any time, and you do not have to give a reason. Our own limit is 24 months from purchase for anyone who has not asked us to keep them. The job that enforces that limit on its own was switched on on 11 September 2026. It runs every night, it deletes records past the 24 month mark, and it emails us a summary of what it did. Nothing has reached 24 months yet, because the first reports were issued in August 2026, so in practice deletion today still happens when you ask us. You do not have to wait for the clock. At checkout you can choose to keep your results instead, so that Kascade can retain your results for future access if a comparison or history feature is introduced; if you choose to keep your results, we retain them until you request deletion, subject to applicable law and our need to maintain records for legal or security purposes. That box is unticked unless you tick it. Kascade Health™ does not create accounts, and does not currently show you a history across purchases: choosing to keep your results preserves them so that becomes possible, it does not turn on a feature that exists today.
• Email list: if you unsubscribe, we stop mailing you, and we keep a record of your address so that we do not mail you again. Unsubscribing takes you off the mailing; it does not erase the sign-up you made. We do not currently have a way to remove that original sign-up from the form service that holds it, and we would rather say so than imply it disappears. If that matters to you, email us and we will tell you exactly where it stands.
• Challenge request forms: the answers you give on the PCOS/PMOS Clarity Challenge request form sit with our form host, Netlify, and we keep them only while the Challenge is running and for a short period afterwards so we can look back at what the group told us. We delete yours whenever you ask, at any time, and you do not have to give a reason. Unlike the email sign-up described above, these can be removed individually, so asking us removes the answers themselves and not only your place on a list. Write to hello@kascadehealth.com.
• Challenge call recordings: kept for our records. We delete yours whenever you ask, at any time, and you do not have to give a reason. Write to hello@kascadehealth.com.
• Transaction records (Stripe): retained for at least 7 years for tax and accounting purposes. Read this alongside Section 01, because for purchases made before 22 September 2026 the payment record is also where the shortened copy of your intake sits. When you ask us to delete your information, the health fields are stripped out of that payment record and what is left behind is the transaction: that a purchase happened, when, for how much, and the consent you gave at checkout. The 7 years applies to that remainder, not to your lab values.

We normally delete your lab values, report and related intake information 24 months after purchase unless you choose to keep your results. You can also request deletion at any time, subject to the limitations described in Section 06.

Retention periods may be extended where necessary to comply with applicable law, resolve disputes, enforce our agreements, prevent fraud or abuse, or establish, exercise or defend legal claims.

06Your rights

For California residents (CCPA / CPRA)

You have the right to:

• Know what personal information we have collected about you, including the categories and specific pieces of personal information, the categories of sources, the purposes for which it is used, and the categories of third parties to whom it is disclosed, sold or shared, as applicable.
• Request deletion of your personal information (subject to legal retention requirements).
• Correct inaccurate personal information.
• Opt out of the “sale” or “sharing” of personal information. We don’t accept money or anything else of value in exchange for your personal information, and we don’t share it for cross-context behavioral advertising. So on that particular right there is nothing to switch off, and you don’t need to send us a request to keep it that way. If you’d like it confirmed in writing anyway, email us and we will. The visit statistics in Section 4 are a separate thing: they come from our hosting provider, they are not used for advertising, and we don’t get paid for them either. Microsoft Clarity on our public pages is described there too, and you can switch it off under Cookie preferences. See Section 4.
• Limit use and disclosure of sensitive personal information. We use and disclose sensitive personal information only for purposes permitted under applicable law, including to provide the Service and for the other purposes described in this Privacy Policy. Where applicable law requires us to provide a right to limit such use or disclosure, we will provide the required notice and mechanism for exercising that right.
• Non-discrimination for exercising any of these rights.

To exercise these rights, email hello@kascadehealth.com with the subject line “Privacy Rights Request.” Requests to know, delete, or correct personal information will generally be substantively answered within 45 calendar days, subject to any extension permitted by applicable law. Requests to opt out of sale or sharing, or to limit the use or disclosure of sensitive personal information where applicable, will be processed within the timeframe required by applicable law.

For all users

You may unsubscribe from marketing emails at any time using the link in any email. You may request a copy or deletion of your data by emailing the address above.

What deletion actually reaches

When you ask us to delete your record, this is what goes:

• Your report, and the stored copy of your interpretation.
• The intake it was built from: your lab values, medications, symptoms, notes, what you were hoping to get out of the report, your age, height, weight, ancestry, diagnosis status and first name.
• The copy held in the payment record at Stripe, for purchases made before 22 September 2026. Those fields are blanked one by one.
• The copy held while a report was waiting to be reviewed, and the internal delivery record maintained by Kascade for the Service. Deletion of the internal delivery record does not necessarily remove copies of emails or reports that remain in Kascade’s email mailbox or in the systems of third-party email providers, subject to the capabilities and retention practices of those providers. Where applicable, we will also instruct relevant service providers to delete or restrict retained copies in accordance with their contractual obligations and applicable law.

Your report link stops working from that moment, for you and for anyone else who has it. It is not the only way access stops working: access can also expire, be revoked on its own, or be replaced when we issue a fresh link and code. Section 07 says how.

And this is what it does not reach, which we would rather you heard from us:

• The record of your consent at checkout, kept deliberately: it is the evidence that you were shown the terms and agreed to them, and destroying it would mean neither of us could show what you were told.
• The fact of the transaction at Stripe, which tax and accounting rules require us to keep.
• The suppression list, which is the record that you asked us to stop emailing you. Deleting it would start the emails again.
• The send ledgers, which record that a particular campaign was already sent to your address, for the same reason.
• Sign-ups held by our form service, as described in Section 05.
• Copies that have already left us: including email or delivery records retained by our email provider, any earlier copy of your report email still in our hello@kascadehealth.com inbox, and anything you forwarded to somebody else.

If you want any of those addressed, say so in the same email and we will review the request and respond in accordance with applicable law, including explaining any limitations that apply.

If we say no

You can appeal any decision we make on a privacy rights request. Reply to our decision, or write to hello@kascadehealth.com with the subject line “Privacy Appeal,” within the period permitted by applicable law or, where no specific period is prescribed, within 45 days of receiving it. Tell us what you asked for and why you think the answer was wrong. A person, not an automated process, will look at it again, and we will write back within 45 days with the decision and the reason for it.

If we deny the appeal, you can complain to your state Attorney General. Washington residents: atg.wa.gov/file-complaint. Nevada residents: the Office of the Nevada Attorney General, ag.nv.gov. California residents may contact the California Privacy Protection Agency or the California Attorney General. We will also tell you how to do this in the denial itself.

How we verify requests

To protect your information, we verify your identity before fulfilling rights requests. We may ask you to confirm your email address used at signup and at least one of: your full name as provided, the date of your most recent purchase, or other reasonably available information. We do not require account creation or government ID. We respond to verified requests within the timeframes required by applicable law. Where permitted by applicable law, we may decline to act on requests that are manifestly unfounded or excessive, or may charge a reasonable fee for such requests.

Global Privacy Control (GPC)

If your browser or a browser extension sends a Global Privacy Control signal, we read it on every page load and honor it automatically as a valid opt-out of any “sale” or “sharing” of personal information. We don’t do either. A browser that sends it also never loads Microsoft Clarity on our public pages (Section 04).

Authorized agents

You may designate an authorized agent to make a privacy rights request on your behalf. The agent must provide written authorization signed by you, and we may verify your identity directly.

06aBreach notification

If Kascade determines that a security incident constitutes a breach requiring notification under applicable law, Kascade will provide notice as required by applicable federal, state and other applicable law. Where required, notices will describe the nature of the incident, the categories of information affected, the measures taken in response and steps individuals may take to protect themselves.

07Security, and how your report is actually reached

Your report is accessed through a private link we email you, and opening it also requires a six-digit access code that we send in a separate email. There is no password, because there is no account to attach one to.

• Whoever has both the link and the code can access the report. Anyone holding the link and the access code, or able to read the inbox they were sent to, can open the report and the lab values in it. If you forward them, the recipient may be able to access the report.
• The browser you use stays signed in for 14 days. After the code is entered, that browser can open the report again for up to 14 days without it. On a shared or public device you can end that straight away with the “forget this browser” link at the end of your report.
• Access expires on a timer. The link and the code currently stop working 180 days after they are issued. That does not delete your report: how long we keep the report itself is Section 05, and while we still hold it you can ask us for a fresh link and code at kascadehealth.com/report-access.
• Access can be switched off on its own, and deletion switches it off too. We can revoke a link and code without deleting your report, which is what happens when a fresh set is issued. Asking us to delete your record also turns access off, for everyone at once. Section 06 says what deletion reaches and what it does not.

Alongside that we take reasonable measures to protect the information while we hold it: we maintain administrative, technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration or destruction, including access controls and encryption in transit, as appropriate to the nature of the information and the risks associated with its processing. No system is perfectly secure, and we cannot guarantee the absolute security of information transmitted over the internet. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

08Children

The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it promptly. If you believe a child under 18 has provided information to us, please contact hello@kascadehealth.com.

09International users

The Service is operated from the United States and is intended solely for users physically located in the United States. We do not currently offer the Service to residents of the European Economic Area or the United Kingdom or to users physically located outside the United States.

10Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (if you have provided one) and post the updated policy on the Service with a new effective date.

11Contact

If you have questions about this Privacy Policy or how we handle your information, contact us at:

Kascade Health LLC
hello@kascadehealth.com