Privacy Policy

Everything below is information you give us, or that is created when you use the product. We do not buy data about you, and we do not gather it from anywhere else.

• Account details: your name, email address, profile picture and sign-in provider when you sign in with Google; your phone number if you sign in with a one-time password.
• Health answers: sex, age and ethnicity; height, weight and waist; blood pressure; lifestyle answers about smoking, alcohol, diet, stress, sleep, screen time, sitting time and activity; family heart history.
• Lab, imaging and wearable figures, when you choose to give them: lipids and ApoB, HbA1c, TSH, Lp(a), hs-CRP, homocysteine, Lp-PLA2, fasting glucose and insulin, uric acid, coronary calcium score, VO₂ max, resting heart rate and heart rate variability.
• Your reports: the heart age, ten-year risk and heart health figures we calculate, and a copy of the answers each report was calculated from, so an old report can be reopened exactly as it was.
• Payment records: order, payment and transaction identifiers, the amount, the method, and whether the payment succeeded or failed. Card, UPI and banking credentials are entered on the payment gateway, never on Cardea — we never see or store them.
• Technical data: sign-in sessions, and for the mobile app a refresh token stored only as a one-way hash together with a device hint such as “ios” or “android”.
• Anonymous usage measurement from our hosting provider, which tells us which pages are visited and how the site performs. It is not tied to your health answers.

• To calculate your Heart Score and produce the report that explains it.
• To keep your reports available to you afterwards, and to show which of them match the answers you hold today.
• To take payment, to record what it unlocked, and to work out how much of your report allowance is left.
• To keep your account secure, to answer your support requests, and to detect fraud or abuse of the service.
• To fix and improve the product, using aggregate measurements rather than readings of individual health answers.
• We do not sell your data. We do not use your health answers for advertising, and we do not share them with insurers, employers, or data brokers.

• Your health answers and reports are not shown to other users, and are not shared with any third party for their own purposes.
• Payment gateway: when you pay, the order and amount go to our payment provider, which handles the transaction and returns its result. Your health answers are not sent to it.
• Sign-in provider: if you sign in with Google, Google confirms your identity to us and gives us your name, email address and profile picture.
• Infrastructure providers: the companies that host our application and database, and the provider that measures anonymous site usage, process data on our instructions and only to run the service.
• Law and safety: we may disclose information where the law requires it, or where it is necessary to protect our rights, our users, or someone’s safety.
• If the business is ever transferred, your data may pass to the acquiring entity under this same policy, and we will tell you before that happens.

• Your answers and reports are kept while your account exists, because the point of a report history is to still be there in a year when you want to compare.
• Reports are deliberately not overwritten when you edit an answer: the old report is kept as it was, and a new one is created.
• Payment records are retained as long as tax and accounting law requires, even after an account is closed.
• Sign-in tokens expire on their own schedule and are revoked when you sign out.
• Ask us to delete your account and we will remove your answers and reports, keeping only what the law requires us to keep.

• Traffic to and from Cardea is encrypted in transit.
• Every read of a report is scoped to the account that owns it, so one user cannot fetch another user’s report by guessing at an address.
• Payments are verified on our servers against the gateway. A redirect back from the payment page cannot unlock a report by itself.
• Mobile refresh tokens are stored only as one-way hashes and are rotated on use, so a stolen database does not hand over live sessions.
• No system is completely secure. We work to reduce the risk, and we will tell affected users if a breach ever puts their data at risk.

• You can correct any answer at any time. Doing so does not alter a report you have already generated — it starts a new one.
• Every question beyond the free check is optional. Leaving a lab figure blank costs you accuracy, never access.
• You can see every report you hold, and the payment behind each one, in My Report.
• You can ask us for a copy of your data, or ask us to delete your account, by writing to the address below.
• You can opt out of promotional email while still receiving essential messages about your account and payments.

For any privacy question, a copy of your data, or a deletion request, write to team@tripsam.com from the email address on your account.