Privacy Policy

This Privacy Policy describes our policies and procedures on the collection, use, and disclosure of your information when you use the Service and tells you about your privacy rights and how the law protects you.

We collect and use your personal data to operate, personalize, and improve our services. By using the Service, you agree to the collection, use, and handling of your data as described in this Privacy Policy.

Interpretation and Definitions

Interpretation

The words with capitalized initial letters have meanings defined under the following conditions. These definitions shall have the same meaning regardless of whether they appear in singular or plural.

Definitions

For the purposes of this Privacy Policy:

• You: The individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service.
• Company: (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Cardilog PTY LTD, ACN: 686097290
• Application: Either of the software programs provided by the Company and downloaded by You on an electronic device, named Cardilog and Iaso.
• Website: Cardilog's website at cardilog.app, including its forms, such as the Iaso waitlist.
• Service: Refers to the Application and the Website.
• Personal Data: Any information that relates to an identified or identifiable individual.
• Usage Data: Data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Data Controller: The Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data: While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name

Usage Data: Usage Data is collected automatically when using the Service. This may include information such as Your Device's Internet Protocol address (e.g., IP address), browser type, browser version, the components of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

Health Data Synchronization and Privacy

At Cardilog, protecting your data is our top priority. To allow you to sync your health data across multiple devices, we use a secure and encrypted synchronization service. Your health records are stored safely and are only accessible to you.

We do not sell your health data under any circumstances.

By using our application, you agree to the collection, use, and secure synchronization of your information as outlined in this Privacy Policy.

What We Mean by Health Data

In Cardilog, Health Data refers to the information you manually enter or sync through integrations, including:

• Systolic blood pressure (SYS)
• Diastolic blood pressure (DIA)
• Heart rate
• Tags (e.g., after workout, morning reading)
• Notes you attach to each entry

This data helps generate insights, visualize trends, and support your health goals.

Importantly, this Health Data is not directly linked to your identity. We do not require your real name or other identifying details to use the app. Health entries are stored securely and are treated as non-identifiable.

What We Mean by "Non-Identifiable Health Data"

When we talk about non-identifiable health data, we mean that the information you enter — such as your blood pressure readings, heart rate, tags, and personal notes — is not linked to your name, email, or any personal details.

Even if you log detailed health information, we store it in a way that does not reveal who you are. Unless you choose to sign in with an email or add personal information, the data remains completely anonymous.

This approach protects your privacy while still allowing you to track your progress, view trends, and sync across devices if you choose to.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service: Including to monitor the usage of our Service.
• To manage Your Account: To manage Your registration as a user of the Service.
• For the performance of a contract: The development, compliance, and undertaking of the purchase contract for the products, items, or services You have purchased or of any other contract with Us through the Service.
• To contact You: To contact You by email or other equivalent forms of electronic communication regarding updates or informative communications related to the functionalities, products, or contracted services, including the security updates when necessary or reasonable for their implementation.
• To manage Your requests: To attend and manage Your requests to Us.

Email Communication and GDPR Compliance

With your consent, we may occasionally send you emails related to:

• Product updates and improvements
• New features and tips
• Promotions or special announcements

These emails are designed to enhance your experience with Cardilog.

Under the General Data Protection Regulation (GDPR), we will only send you marketing emails if you have explicitly opted in—either by checking a consent box during signup or by subscribing through our app or website.

You have the right to withdraw your consent at any time. Every marketing email we send includes a clear "Unsubscribe" link at the bottom. Clicking this link will remove you from future marketing communications.

Please note: You may still receive essential service-related emails (such as account notices, security updates, or changes to legal terms), as these are considered necessary for app functionality and do not require separate consent.

The Iaso Waitlist

Iaso is an app we are building. Until it launches, you can join its waitlist on the Website at cardilog.app/iaso. This section explains what happens to the details you give us there.

What We Collect

The waitlist form asks for your name and your email address. Joining is separate from the Cardilog and Iaso apps, so it creates no account and collects no health data.

Like the rest of the Website, the page collects Usage Data. Our analytics note that the form was used and never record what you typed into it. The form also uses your IP address to limit how many sign-ups can come from one connection.

When you join, the Website also tells our advertising partner that someone signed up, without your name or email.

How You Give Consent

We use your name and email for one purpose, which is to email you when Iaso launches. The form says this under the button, and submitting it is how you agree to that email. You are on the waitlist as soon as you submit, and we do not send an email asking you to confirm your address first.

That means someone could sign you up without asking you. If that happens, use the unsubscribe link in the launch email or write to us, and we will take you off the waitlist.

Joining leaves your newsletter subscription as it was, whether or not you had one.

Who Holds Your Details

We store the waitlist with Resend, the service we use to send email. Resend is based in the United States and stores its data there. It handles your details on our behalf, under a data processing agreement, and only to send our emails.

How Long We Keep Your Details

We keep the waitlist until Iaso has launched and we have sent that email, and then we delete it. To leave before then, write to us at info@cardilog.app and we will remove you.

This section covers the waitlist only. The next section covers the Iaso app itself.

The Iaso App

Iaso estimates your blood pressure, heart rate, heart rate variability and breathing rate from a thirty-second scan of your face with your phone's front camera. This section explains what happens to your face during a scan, what happens to the readings, and who else is involved. The short version is that your face is never recorded and never leaves your phone, and your readings stay on your phone unless you choose to share them with Apple Health or Health Connect.

Your Face During a Scan

A scan works by watching tiny changes in the colour of your skin as blood moves through your face. To do this, Iaso reads the live pictures from the front camera for the thirty seconds of the scan. Each picture is looked at as it arrives and then discarded, and the scan keeps only the colour signal it needs to estimate your readings. The whole process happens on your phone.

Iaso does not take photographs, does not record video, and does not save any picture of your face, during a scan or at any other time. It does not create a face print or any other description of your face, it does not try to recognise or identify you, and it does not use your face to unlock anything. Nothing from the camera is sent to us or to anyone else. Once the scan ends, nothing of your face remains anywhere.

You can take the camera permission away at any time in your phone's settings. Iaso then cannot scan, and everything else in the app keeps working.

Your Readings

The result of a scan is a set of numbers: blood pressure, heart rate, heart rate variability and breathing rate, with the date and time. These are saved on your phone only. Iaso has no account and no sign-in, and we never receive your readings. If you choose to add your name, year of birth, sex, height, weight or whether you smoke for the optional body indices, or your readings from an arm cuff to calibrate the scan, those stay on your phone too.

You can delete any reading in the app, and deleting the app deletes everything it saved. Readings you have already sent to Apple Health or Health Connect stay there until you delete them in that app.

Apple Health and Health Connect

Health sync is off until you switch it on in Settings. When it is on, Iaso writes your scan readings to Apple Health on iPhone or to Health Connect on Android, and reads back blood pressure, heart rate variability and resting heart rate recorded there by other apps and devices, so that you can see them alongside your scans. Apple and Google hold that data under their own privacy policies. Switching sync off stops both directions. Iaso never uses Apple Health or Health Connect data for advertising, and never shares it with anyone.

Who Else Is Involved

The technology that turns the camera pictures into readings is licensed from another company and runs entirely on your phone. That company receives a count of how many scans have been taken, for licensing, and never receives a picture, your face, a signal from it, or any reading. The first scan on a phone needs an internet connection to confirm the licence and fetch the files the scan needs, and scans work offline after that.

Scanning is a paid feature, sold as a subscription through the Apple App Store or Google Play. Apple or Google take the payment under their own terms, and a subscriptions service based in the United States checks whether your subscription is active. It receives a random identifier for your copy of the app and the details of the purchase from the store, and never your name, your readings or anything from the camera.

Iaso also checks for updates to the app when it starts. That check sends the version of the app and your phone's type to the service that delivers updates, which sees your IP address as part of answering. The app has no analytics and no crash reporting, so it does not report what you do in it to us or to anyone else.

How Long We Keep It

Your face: not at all. Nothing from the camera is kept past the moment it is looked at. Your readings: on your phone, for as long as you keep them and keep the app. We hold nothing about you ourselves, so there is nothing for us to retain or delete. If you want help removing anything, or have a question about any of this, write to us at info@cardilog.app.

Iaso is a wellness app and not a medical device. Its readings are estimates, and they are not medical advice.

Cardilog Intelligence (AI-Powered Features)

Cardilog Intelligence uses artificial intelligence to generate educational summaries, spot patterns in your readings, and help you prepare reports for your doctor. To provide these features, your health data (such as blood pressure readings, heart rate, tags, and notes) is processed by a third-party AI service under a signed Business Associate Agreement (BAA) and Healthcare Addendum that meet HIPAA requirements. Processing occurs via a zero-data-retention workflow: your data is not logged for human review, is not saved to disk, and is not stored persistently by the AI provider. Your health data is never used to train, fine-tune, or otherwise improve AI models.

This processing is used solely to generate personalised educational summaries within the app. Your data is not used to train AI models and is handled under strict confidentiality agreements with our AI service providers. Cardilog Intelligence does not provide medical advice, diagnoses, or treatment recommendations.

Third-Party Services

We use trusted third-party service providers to support the functionality of our app and website. These may include:

• Cloud hosting providers
• Analytics and crash reporting services
• Email delivery services
• Spam protection for the forms on our website
• A partner that shows the app download banner on our website and measures the downloads it leads to
• AI service providers (for Cardilog Intelligence features)
• The company whose technology Iaso uses to turn a face scan into readings, which runs on your phone and receives only a count of scans
• A subscriptions service for Iaso, which checks whether a subscription is active
• A service that delivers updates to the Iaso app

These providers process data on our behalf and under strict confidentiality agreements. They are only given access to the minimum data necessary to perform their tasks and are required to comply with applicable data protection laws.

Spam Protection on Our Forms

To keep spam out of our contact form and newsletter sign-up, these forms use a security service that checks each visitor is a real person. It looks at your IP address and details of your browser to do this. The service is based in the United States and handles this data there.

Measuring Our Ads

We advertise Cardilog online, and the Website uses a script from our advertising partner to see whether those ads work. It tells our partner when you view a page, click through to an app store, join the Iaso waitlist or use the buttons on our page for doctors, along with the page address, the time, your IP address and details of your browser. It never receives your name, your email address, anything you type into a form, or the readings in your Cardilog app. The page where you request a cardiologist consultation sends nothing.

The script sets two cookies. One links your visit to the ad you clicked and lasts 30 days, and the other identifies your browser to our partner and lasts up to a year. Our partner is based in the United States and handles this data there. You can block or delete these cookies in your browser, and the Website works the same without them.

The App Download Banner

On a phone, the Website may show a small banner that links to the Cardilog app in the Apple App Store or Google Play. A partner that measures app downloads runs the banner for us. To choose which banner to show you, the Website sends our partner the address of the page you are on, along with your IP address and details of your browser. Our partner also learns when the banner appears and when you tap it, so that we can see whether it leads people to the app.

The banner never receives your name, your email address, anything you type into a form, or the readings in your Cardilog app. It does not appear on the Iaso page or on the page where you request a cardiologist consultation, and nothing about those pages is sent to our partner. The banner keeps a small note of your visit in your browser and sets no cookies. Our partner handles this data in the European Union.

Children's Privacy

Cardilog is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that data has been collected from a minor without consent, we will promptly delete it.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

Data Security

We implement robust security measures to protect your personal and health data from unauthorized access. Despite our efforts, no data security measures can guarantee 100% security.

Your Rights

You have certain rights regarding your personal and health data. These rights may vary depending on your location and the applicable data protection laws, such as the General Data Protection Regulation (GDPR) in the EU/EEA. These include:

Right to Access

You have the right to request a copy of the personal and health data we hold about you. We will provide this information in a clear and accessible format.

Right to Rectification

If you believe any of your information is incorrect or incomplete, you can request that we correct or update it.

Right to Erasure (Right to Be Forgotten)

You can ask us to delete your account and all associated data at any time. This can be done through the app or by contacting us directly.

Right to Restrict Processing

In certain cases, you can request that we temporarily suspend the processing of your data, for example if you are contesting its accuracy.

Right to Data Portability

You have the right to receive your personal and health data in a commonly used format and, if technically feasible, to have that data transmitted to another service.

Right to Object

You can object to the processing of your data where we rely on legitimate interests, or when your data is used for direct marketing purposes.

Right to Withdraw Consent

If we process your data based on your consent (for example, for marketing emails), you can withdraw that consent at any time. This does not affect the legality of processing carried out before you withdrew consent.

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to file a complaint with your local data protection authority.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

info@cardilog.app

We will respond to your request within the time required by applicable law, usually within 30 days.

Changes to This Privacy Policy

We may update our Privacy Policy periodically. We will notify you of any changes by posting the new policy on our website and within the app.

Contact Us

If you have any questions about this Privacy Policy, please contact us at info@cardilog.app