Privacy Policy
The short version
Kadam has an account, so we hold your name and email to sign you in and to manage your subscription. But your health data does not leave your phone. Sessions, meals, symptoms, cycle dates and whatever Apple Health passes it stay in an encrypted database on your device. We cannot read that; it never reaches us.
If you join the early-access waitlist on this website, we also hold the first name, WhatsApp number and email you enter there. Your account plus, if you use it, your waitlist entry, is the whole of what we keep.
What we collect
Your account: a name, an email address, and a secure credential to sign you in — or, if you use Sign in with Apple or Google, a token from them rather than a password. We use this to authenticate you and to link your subscription. Payment is handled by the App Store or Google Play; we never see or store your card details.
On your device, not sent to us: your health data stays on the phone. That includes:
- Profile answers from onboarding — sex, and what you want to track.
- Training, running, nutrition and supplement logs.
- Cycle dates and symptoms, if you track them.
- Sleep, heart rate and activity read from Apple Health, only with your permission.
Through this website: your first name, WhatsApp number, email address, and the time you joined. Nothing else — no analytics, no advertising pixels, no fingerprinting, no third-party embeds, no cookies. The fonts are served from this domain rather than a font CDN, so loading this page does not tell anyone else that you visited it. The one thing stored in your browser is your reduce-motion preference, which never leaves the device.
Why we collect it
To send you one WhatsApp message when your wave of early access opens, and to email you instead if that message cannot be delivered. That is the entire purpose. The lawful basis is your consent, given when you submit the form.
How the app stores your data
Kadam's store is a SQLCipher-encrypted database on your device. The passphrase is generated on the device, kept in the iOS keychain or Android Keystore, and never written to the database file or to a backup. It is never transmitted.
Cycle and health data are special-category personal data under the UK and EU GDPR, and sensitive personal data under India's Digital Personal Data Protection Act, 2023. Kadam's answer to that is architectural rather than procedural: the data is not sent anywhere, so there is no transfer, no processor, and no breach surface for us to describe.
Kadam AI, and processing
Kadam AI is in active development. As designed and described on our home page, it runs inside the app, on your device, on data that is already there — it is not a chatbot bolted on and not a service your data is sent to.
We are telling you this because it is the thing most likely to change. If any part of Kadam ever processes your data off the device — a server, a sync, a third-party model — this policy changes before that ships, not after, and we will email everyone on the waitlist to say so. No part of your health data is sent for processing today.
Who can see it
Your app data: only you. There is no admin view, no support tool and no export we can run, because there is nothing on our side to look at.
Your waitlist details: us, and the hosting and messaging providers we use to send that one message, who handle it only on our instructions and only to deliver what you asked for. Your data is never sold, rented, or shared with advertisers or data brokers.
Cross-border transfers
App data does not cross any border, because it does not leave your phone. For the waitlist, where your details are stored depends on the hosting provider named above; that will be stated here before launch.
How long we keep it
Waitlist details are kept until early access ends or you ask us to delete them, whichever comes first. When the waitlist closes, the list is deleted.
App data lives on your device for as long as you keep the app. Deleting the app deletes it. We have no copy to delete.
Security
On the device: an encrypted SQLCipher database with a key held in the iOS keychain or Android Keystore, as described above. For the waitlist: the fields are stored with access limited to the people who need it to open a wave, and requests are rate-limited by a salted hash of the network address rather than by storing the address itself.
If a breach ever affects your data, we will tell you and the relevant authority within the time the law requires.
Your rights & data portability
Under India's DPDP Act 2023 and GDPR, you have the right to access, rectify, erase, and export your personal data. Inside the app, you can export 100% of your history to a structured JSON file at any time (Settings → Export Data). Deleting the app permanently destroys your local database and encryption keys.
For your waitlist entry, you can ask us for a copy, ask us to correct it, or withdraw your consent by writing to support@kadam.health. If you are in India you may raise a grievance with our Data Protection Officer and then with the Data Protection Board of India; in the UK or the EU you may complain to your supervisory authority.
Children
Kadam is not directed at anyone under 18, and the waitlist is not open to them. If we learn we have a child's details, we delete them.
Not a medical device
Kadam is not a medical device and it never diagnoses anything. It reads what you logged and reflects it back with guidance derived from deterministic rules. It is not a substitute for a doctor, a physiotherapist, a dietitian or a coach. If something about your body worries you, ask a clinician rather than an app.
Changes to this policy
If this policy changes we will post the new version here with a new effective date. For any change that affects where your data goes — cloud sync, an account system, server-side processing — we will email everyone on the waitlist, and the change will be published before the feature ships.
Contact
Write to support@kadam.health and a person will answer.