Caredenza handles sensitive health information. We treat that responsibility with real engineering and a plain description of what's in place today — no aspirational claims.
All Caredenza data lives in Amazon Web Services data centers in the United States, on services that are HIPAA-eligible.
We collect only what the app needs to do its job: your medications, doses, care team, appointments, and the email address you sign in with.
The full list lives in our Privacy Policy.
Caregivers see your information only because you invited them. They sign in to the Caredenza app with their own credentials and land in a dedicated caregiver view — there are no shared accounts and no shared passwords.
HIPAA applies to "covered entities" (hospitals, clinics, plans) and their "business associates." When you use Caredenza directly as a consumer, neither role applies, and HIPAA does not technically govern that use.
We voluntarily apply protections that line up with HIPAA's Security Rule because it's the right way to handle health information. If a healthcare organization later offers Caredenza to its patients, we will sign a Business Associate Agreement with that organization for that program.
The product is built secure-by-default. Our founder spent a decade in information security before this — we treat security as how the codebase is wired, not a phase.
We use Vanta to monitor our security controls and to organize the evidence a SOC 2 audit will require. We have not yet completed an audit, and we won't claim a certification we haven't earned. We'll update this page when we do.
We don't sell your data. We don't share it without your consent. We don't keep it longer than we need to. And we'll tell you, in plain English, anything you want to know.
