Privacy Policy

The short version

Kadam requires an account, so we hold your name and email to authenticate you and manage your subscription. By default, your workouts, nutrition logs, cycle entries, and health history remain stored directly on your device in an encrypted SQLCipher database. We do not sell your personal data, we do not share it with advertisers, and we never access your private local database.

When you choose to use optional cloud-powered features — such as conversational coaching with Kadam AI, Food Snap plate photo logging, cloud speech dictation on Android devices without offline voice models, or opting in to anonymous product usage analytics — specifically scoped requests are processed securely via our dedicated serverless proxy and privacy-focused providers, stripped of your name and account identity. These features are off until you turn them on.

One exception for web visitors: Kadam Care on this website is a public directory. What a family enters there about a patient is stored on our database and shown to volunteers so they can coordinate hospital journeys, as described in full below.

What we collect and process

Your account: A name, an email address, and a secure credential to sign you in — or, if you use Sign in with Apple or Google, a secure token from them rather than a password. We use this to authenticate you and manage your subscription. Payment is handled by Apple In-App Purchases or Google Play Billing; we never see or store your payment card details.

Stored locally on your device: Your core health logs stay in an encrypted SQLCipher database on your device. This includes:

• Profile attributes — biological sex, age, height, weight, and fitness goals.
• Workout sessions, exercises, sets, weights, reps, and running GPS routes.
• Nutrition entries, water intake, and supplement schedules.
• Menstrual cycle dates, flow, symptoms, and ovulation test results.
• Health data read from Apple Health (iOS) or Health Connect (Android), only for the types you allow in the system permission screen: steps, distance, active calories, heart rate, resting heart rate, heart-rate variability, sleep sessions and stages, water intake, menstruation, spotting (intermenstrual bleeding), ovulation test results, basal body temperature, and skin temperature. With your permission, Kadam reads up to a year of this history so your baselines and cycle predictions rest on more than one month.

How health data from Health Connect and Apple Health is used: only to show you your own readings and the scores built from them (recovery, sleep, strain, cycle predictions), and — if you turn on Kadam AI — as part of the summary described below. It is never sold, never used for advertising, never used to decide credit or insurance, and never used to train AI models. Kadam reads this data; it does not write to Health Connect or Apple Health.

Instant cold-start launch cache: To render your interface theme, preferred units, and layout instantly upon launch without waiting for database decryption, the app maintains an ephemeral display cache on your device. This cache strictly omits your account email, provider identity, medical conditions, cycle history, and food logs, and is completely wiped whenever you sign out or delete your account.

Location (only during a run): When you start a GPS run, Kadam asks for location permission to measure your route, distance, and pace. If you also allow background location, tracking continues while your screen is off or you switch apps, and an ongoing notification shows that a run is being recorded. Kadam does not track your location at any other time, and stops when you end the run. Routes are stored in the encrypted database on your device. They are excluded from the launch cache and are never sent to Kadam AI.

Encrypted backup (optional, off by default): If you choose to back up, the app encrypts a copy of your logs on your phone — including run routes and any data imported from Health Connect or Apple Health — with AES-256-GCM under a key derived from a recovery phrase that only you hold. Only that ciphertext is uploaded, stored under an anonymous ID that is not linked to your account. We cannot read it, cannot tell whose it is, and cannot recover it without your phrase. You can delete it from the app at any time.

When you use Kadam AI (opt-in): Kadam AI is off until enabled in Settings or in the AI assistant sheet. When you ask a question or request conversational coaching, a scoped factual summary is sent through Kadam’s secure AI proxy to an AI model provider (Google Gemini, Anthropic Claude, OpenAI, Groq, NVIDIA, or Cloudflare Workers AI, whichever is available when you ask). This includes today’s brief lines (sleep, resting HR, HRV against your baselines, cycle phase), a summary of what you have logged (recent meals and nutrition totals, best lifts and training streak, latest weight and trend, height and BMI, steps, sleep and recovery numbers against your own baselines, and your latest lab-marker readings), your questions, and your conversation history. It never includes your GPS routes. What never leaves: Your name, your email, your account ID, or any direct identifier. The AI receives an anonymous fitness context, not a named person.

Reporting an answer (only when you choose to): Under any Kadam AI answer you can tap “Report this answer” to tell us it was offensive, unsafe, wrong or otherwise a problem. That sends the question and answer on screen, the reason you picked and any note you add, plus your phone’s platform and the app version. It carries no name, email, account ID or other identifier. A person at Kadam reviews it so we can fix what went wrong, and it is deleted automatically after 180 days. This is the only Kadam AI content we keep.

Food Snap photographs (when you snap a meal): If you use Food Snap to log a plate of food, a photograph of your meal is transmitted ephemerally to our AI vision proxy solely to identify the food items and portion sizes. Meal photos are never stored on our servers, never used for advertising, and never used to train generalized artificial intelligence models.

Voice dictation audio: Tapping the microphone uses your device's built-in speech recognition. On devices with offline speech models, audio is transcribed 100% on-device and never transmitted. On Android devices that lack an offline language model, Kadam requests your explicit consent before routing audio to the platform's speech service (Google Speech Services). Audio is never sent to or stored by Kadam’s servers.

Product analytics & diagnostics (opt-in only): Usage analytics is switched off by default. If you turn on Settings → Usage data, Kadam records anonymous app lifecycle counts (such as screens opened, workouts started, or features used) via Aptabase, an EU-hosted privacy-focused analytics service. Each event is tagged with a pseudonymous random user ID and session ID generated on your device. It never includes health metrics, heart rates, cycle data, meal contents, voice recordings, or personal identifying details.

Through the waitlist on this website: your first name, WhatsApp number, email address, and the time you joined. No analytics, no advertising pixels, no fingerprinting, no third-party embeds, no cookies. The fonts are served from this domain rather than a font CDN, so loading this page does not tell anyone else that you visited it. The one thing stored in your browser is your reduce-motion preference, which never leaves the device.

Through Kadam Care, if you use it: this is the one part of Kadam where health information is held on a server, and it is worth reading carefully, because it is usually not your own. Registering a patient stores their name, age, city, gated society, gate or pickup point, hospital, the nature and schedule of their appointment, what they like talking about, a contact number for the family, and the name of the person confirming the listing. Volunteering stores your name, your phone number, the activity you chose and the pass that was issued.

We ask for this because a stranger cannot accompany someone to chemotherapy without knowing where to collect them and where they are going. But it is health information about a named person, so:

• A listing needs the patient's agreement. The form asks who is confirming it, and that name and time are stored with the record. Do not list someone who has not agreed, or whose next of kin has not agreed on their behalf.
• Phone numbers are not public. The directory anyone can browse never includes the family's number. It is released only to the volunteer who has confirmed a specific journey, and to nobody else.
• A listing can be withdrawn at any time, from the browser it was created in, using the control on the listing itself. Withdrawing erases the patient's details rather than hiding them.
• Listings expire after 90 days and stop being shown, whether or not anyone remembers to take them down.
• Everything else on the page still applies. Kadam Care sets no cookies and loads nothing from anyone else.

Why we collect it

To send you one WhatsApp message when your wave of early access opens, and to email you instead if that message cannot be delivered. That is the entire purpose. The lawful basis is your consent, given when you submit the form.

How the app stores your data

Kadam's store is a SQLCipher-encrypted database on your device. The passphrase is generated on the device, kept in the iOS keychain or Android Keystore, and never written to the database file or to a backup. It is never transmitted.

Cycle and health data are special-category personal data under the UK and EU GDPR, and sensitive personal data under India's Digital Personal Data Protection Act, 2023. Kadam's primary protection is architectural: your complete historical health database lives encrypted on your device. When you engage optional cloud capabilities (such as Kadam AI or Food Snap), only the minimal factual context required for that immediate prompt is processed ephemerally, completely unlinked from your name or account ID.

Kadam AI, and serverless processing

Kadam AI provides personalized training, recovery, and nutrition coaching. It operates through a privacy-first serverless architecture:

• Serverless AI Proxy: Requests flow through Kadam’s Cloudflare Workers proxy directly to an AI model API (Google Gemini, Anthropic Claude, OpenAI, Groq, NVIDIA, or Cloudflare Workers AI, whichever is available when you ask). All transmissions use strict TLS/HTTPS encryption.
• Zero Identity Guarantee: Before any payload leaves your phone, Kadam’s on-device client strips all direct identifiers — your name, email address, phone number, account ID, and device identifiers. The AI models receive an anonymous, contextual fitness summary (e.g., today’s sleep duration, resting heart rate, HRV relative to baseline, cycle phase, daily macro totals, and your conversation prompt).
• Zero Model Training & Zero Retention: Our commercial API agreements prohibit foundational model providers from training their models on your queries or health data. Payloads are processed in-memory to generate the immediate response and are not permanently retained or archived.
• Food Snap (Plate Vision): When you photograph your meal with Food Snap, the image is transmitted ephemerally to our vision proxy solely to detect dishes and estimate portion sizes. Images are never retained on our servers and are never used for advertising or model training.
• Voice Dictation: When dictating logs, devices with offline language models process speech 100% on-device. On Android devices lacking an offline model, speech is routed to platform Google Speech Services with your explicit prior consent. Kadam’s servers never receive or store audio recordings.

Kadam Care, on this website, is a separate community service: What you log in the mobile app stays on your phone. What a family submits to Kadam Care is published to verified volunteers on a database, solely to coordinate hospital visits. Nothing in the mobile app feeds Kadam Care, and Kadam Care cannot access anything in the app.

Who can see it

Your local app database: Only you. There is no remote admin portal, back door, or cloud database containing your health logs.

Your AI coaching requests: Processed ephemerally by enterprise AI inference APIs under strict confidentiality and zero-data-retention terms. No human reviews your logs or photos. The one exception is an answer you choose to report: a person at Kadam reads that question and answer, without knowing who sent it.

Your account contact details (name, email, phone number): Us, and only to sign you in and contact you about the app. They are stored on Cloudflare's infrastructure, never alongside any health data.

Your encrypted backup, if you made one: Nobody. We hold ciphertext we cannot decrypt, under an ID not linked to your account.

Your waitlist details: Us, and the transactional messaging services used to send your access link. Your data is never sold, rented, or shared with advertisers, data brokers, or marketing networks.

A Kadam Care listing: Anyone who visits the care directory. That is the express purpose of the directory — but the family’s direct contact number is restricted solely to the volunteer who confirms the appointment pass. Listings can be withdrawn instantly or expire automatically after 90 days.

Cross-border transfers

Your encrypted core database remains stored locally on your device in your country of residence. When you choose to use optional cloud-powered features:

• Ephemeral Kadam AI prompts and Food Snap photos are processed securely through Cloudflare Workers and enterprise AI inference infrastructure located in the United States and European Union, stripped of personal identity.
• Your account contact details, and encrypted backups if you make one, are stored on Cloudflare's global infrastructure.
• Opt-in product analytics (if enabled under Settings) are processed by Aptabase on servers located within the European Union (EU).
• Kadam Care listings and waitlist registrations are stored on secure cloud database infrastructure.

All cross-border transmissions are secured by TLS 1.3 encryption and comply with standard contractual clauses and applicable data protection regulations.

How long we keep it

Waitlist details are kept until early access ends or you ask us to delete them, whichever comes first. When the waitlist closes, the list is deleted.

App data lives on your device for as long as you keep the app. Deleting the app deletes it. Unless you turned on encrypted backup, we have no copy to delete.

Your account contact details are kept until you delete your account — in the app under Settings → Delete account and data, or by email (see Delete your account). An encrypted backup is kept until you delete it in the app, and is deleted along with your account when you delete your account from the app. AI prompts and Food Snap photos are ephemeral and discarded immediately after processing, except an answer you report, which is kept for 180 days for review and then deleted automatically. Opt-in analytics event counts are pseudonymized and aggregated.

Kadam Care listings expire 90 days after they are created, and can be withdrawn before that from the browser that created them. Withdrawing overwrites the patient's name, society, gate, hospital, appointment details and contact number; what remains is an empty record keeping the identifier so it cannot be reissued. Booking records are kept while the listing they belong to exists and are deleted with it.

Security

On the device: an encrypted SQLCipher database with a key held in the iOS keychain or Android Keystore, as described above. For the waitlist: the fields are stored with access limited to the people who need it to open a wave, and requests are rate-limited by a salted hash of the network address rather than by storing the address itself.

For Kadam Care: the same rate limiting, on the same basis — a salted hash, never the address. The token that lets a family withdraw their listing is generated on the server, shown to that browser once, and stored only as a hash, so it cannot be read back out of the database and cannot be used by anyone else to take a listing down. Contact numbers are excluded from the query the public directory runs, rather than filtered out afterwards.

If a breach ever affects your data, we will tell you and the relevant authority within the time the law requires.

Your rights & data portability

Under India's DPDP Act 2023 and GDPR, you have the right to access, rectify, erase, and export your personal data. Inside the app, you can export 100% of your history to a structured JSON file at any time (Settings → Export Data). Deleting the app permanently destroys your local database and encryption keys. To remove the account itself — your name, email and phone number — see Delete your account, which works whether or not the app is still installed.

For your waitlist entry, you can ask us for a copy, ask us to correct it, or withdraw your consent by writing to support@kadam.health. If you are in India you may raise a grievance with our Data Protection Officer and then with the Data Protection Board of India; in the UK or the EU you may complain to your supervisory authority.

Children

Kadam is not directed at anyone under 18, and the waitlist is not open to them. If we learn we have a child's details, we delete them.

Not a medical device

Kadam is not a medical device and it never diagnoses anything. It reads what you logged and reflects it back with guidance derived from deterministic rules. It is not a substitute for a doctor, a physiotherapist, a dietitian or a coach. If something about your body worries you, ask a clinician rather than an app.

Changes to this policy

If this policy changes we will post the new version here with a new effective date. For any change that affects where your data goes — cloud sync, an account system, server-side processing — we will email everyone on the waitlist, and the change will be published before the feature ships.

Contact

Write to support@kadam.health and a person will answer.