Duet

Consumer Health Data Privacy Policy

Coda Compute, Inc., doing business as Coda Health, provides Duet. This policy describes the consumer health data Duet collects and shares, and how to use your rights under Washington's My Health My Data Act (RCW 19.373).

Effective October 3, 2026

01

What consumer health data do we collect, and how do we use it?

Consumer health dataHow we use it
Health information from sources you connect: what you allow Duet to read from Apple Health, Epic MyChart, or another supported sourceTo organize your health history, calculate measurements and comparisons, and support the uses below.
Your conversation with Duet and what Duet remembers about youTo reply to you and pick up where you left off.
Plans you save, and check-ins and reminders you ask forTo follow through on what you asked for.
Insights, and the items, notes, and summaries you prepare for your doctorTo point out useful changes and help you prepare for appointments.
Feedback on Duet's replies, including any note you addTo keep your feedback in your account. To improve Duet, Coda uses only daily counts of how many people gave each rating and reason, kept in deidentified form.
Sharing information: who you share with and which measurement types. Shared values are end-to-end encrypted.To deliver what you choose to share.
Records, original files, and private Moments you saved in earlier versions of DuetTo keep what you saved until you delete your account.
Consumer health data
Health information from sources you connect: what you allow Duet to read from Apple Health, Epic MyChart, or another supported source
How we use it
To organize your health history, calculate measurements and comparisons, and support the uses below.
Consumer health data
Your conversation with Duet and what Duet remembers about you
How we use it
To reply to you and pick up where you left off.
Consumer health data
Plans you save, and check-ins and reminders you ask for
How we use it
To follow through on what you asked for.
Consumer health data
Insights, and the items, notes, and summaries you prepare for your doctor
How we use it
To point out useful changes and help you prepare for appointments.
Consumer health data
Feedback on Duet's replies, including any note you add
How we use it
To keep your feedback in your account. To improve Duet, Coda uses only daily counts of how many people gave each rating and reason, kept in deidentified form.
Consumer health data
Sharing information: who you share with and which measurement types. Shared values are end-to-end encrypted.
How we use it
To deliver what you choose to share.
Consumer health data
Records, original files, and private Moments you saved in earlier versions of Duet
How we use it
To keep what you saved until you delete your account.

If you choose Allow AI, we also use this data for your Duet conversation, remembering what you share, check-ins and reminders you ask for, reviews of new information, insights, and summaries you prepare for your doctor. We do not use it for advertising, and we do not sell it.

02

Where does it come from?

  • You: what you write, save, select, and rate in Duet.
  • Apple Health on your iPhone, for the data types you allow.
  • Each Epic MyChart organization you authorize.
  • Duet itself, which creates insights, notes, and summaries from the data above.
  • People who share measurements with you. We can't read those values.
03

What do we share, and with whom?

Who receives itConsumer health data shared
Cloud hosting and storage provider (Google Cloud)All of the data above, to run and store Duet.
AI service provider (OpenAI), only if you choose Allow AIWhat you write, Duet's earlier replies, what it remembers, selected health facts, relevant details from your records and saved items, and the items you select for a doctor summary. Never raw health samples, ECG waveforms, audiogram measurements, workout routes, original files from your sources, or anything another person shares with you.
Health record provider (Epic)Your requests to connect and read your MyChart records.
People you choose to share withThe daily measurements you select, end-to-end encrypted.
Authorities and others, when requiredInformation needed to comply with law, legal process, or a governmental request, or to protect rights, safety, and security.
A party to a corporate transactionInformation transferred in a merger, financing, acquisition, or similar corporate transaction.
Who receives it
Cloud hosting and storage provider (Google Cloud)
Consumer health data shared
All of the data above, to run and store Duet.
Who receives it
AI service provider (OpenAI), only if you choose Allow AI
Consumer health data shared
What you write, Duet's earlier replies, what it remembers, selected health facts, relevant details from your records and saved items, and the items you select for a doctor summary. Never raw health samples, ECG waveforms, audiogram measurements, workout routes, original files from your sources, or anything another person shares with you.
Who receives it
Health record provider (Epic)
Consumer health data shared
Your requests to connect and read your MyChart records.
Who receives it
People you choose to share with
Consumer health data shared
The daily measurements you select, end-to-end encrypted.
Who receives it
Authorities and others, when required
Consumer health data shared
Information needed to comply with law, legal process, or a governmental request, or to protect rights, safety, and security.
Who receives it
A party to a corporate transaction
Consumer health data shared
Information transferred in a merger, financing, acquisition, or similar corporate transaction.

Coda Compute, Inc. has no affiliates, so we do not share consumer health data with any affiliate.

04

How do I use my rights?

If you live in Washington, or your consumer health data is collected in Washington, you have the right to:

  • Confirm whether we collect, share, or sell your consumer health data, and get access to it, including a list of the third parties and affiliates we have shared it with and how to contact them.
  • Withdraw your consent to our collecting and sharing it.
  • Have it deleted.
  • Appeal if we decline your request.

To make a request, email legal@codahealth.ai. You can also withdraw AI permission, export your information, or delete your account yourself in the app. We may need to confirm your identity before we act on a request.

We respond within 45 days of receiving your request. If we need more time, we may extend this once by up to 45 more days, and we will tell you why within the first 45 days. We answer requests free of charge, up to twice a year.

When we delete your data, copies in database backups are removed as those backups expire. Until then, backups are used only for recovery.

To appeal a decision, email legal@codahealth.ai with "Appeal" in the subject line. Within 45 days of receiving your appeal, we will tell you in writing what we did and why. If we deny your appeal, you can file a complaint with the Washington State Attorney General at atg.wa.gov/file-complaint or 1-800-551-4636.