Privacy Policy

It depends on the features you use. You choose which health sources to connect. Duet reads what you allow and never changes records in Apple Health, Epic MyChart, or another source.

Our public website, separate from the app, may collect browser, device, page-view, performance, and service-log information through its hosting, analytics, and performance providers. We use it to run and improve the website. It isn't added to your Duet health profile or combined with your health information for advertising.

We use your information to provide Duet. We don't:

• Sell health information.
• Use it for advertising or credit decisions.
• Use it to train or fine-tune AI models.
• Let our service providers use your health information for advertising, data brokerage, or tracking you across apps.
• Use it for product improvement or research without your separate permission.

AI is optional. After you accept the Terms and finish setup, Duet asks for your permission before any AI processing. You don't need to connect a health source first.

If you choose Allow AI, Coda uses third-party AI services for your Duet conversation, remembering what you share, check-ins and reminders you ask for, reviews of new information, insights, and summaries you prepare for your doctor. If you choose Not now, the rest of Duet still works. You can change your choice in Settings.

To do this, Duet uses what you write, its earlier replies, what it remembers about you, selected health facts, and relevant details from your connected records and the items you save in Duet. For a doctor summary, it uses only the information and notes you select.

Duet never sends these to AI services:

• Raw health samples, ECG waveforms, or audiogram measurements.
• Workout routes.
• Original files from your sources.
• Anything another person shares with you.

Anything you type or paste into the conversation is sent as you wrote it.

Duet keeps one private set of notes about what matters to you, such as your goals, preferences, circumstances, and ongoing concerns. The notes can also reflect your connected records. To correct them, tell Duet in the conversation. In a long conversation, Duet may also keep a shorter summary of what you discussed earlier.

You can pause AI in Settings and resume it later, or withdraw your permission to stop future AI processing. Neither deletes your records, conversation, what Duet remembers, insights, or doctor materials. Withdrawing can't recall information already sent.

OpenAI is our AI provider. Duet sends it information only after you choose Allow AI. Our agreement with OpenAI covers the handling of eligible health information. We turn off ordinary response storage and don't permit model training with your health information.

OpenAI may still keep limited information for abuse monitoring, legal obligations, and technical processing, including encrypted prompt caching for up to 24 hours. Our settings restrict human review. They don't guarantee zero retention or processing only in the United States.

These service providers process information to provide and protect Duet. We don't let them use your health information for advertising, data brokerage, or tracking you across apps.

Credentials for connected health services are encrypted and held by Duet's server.

We may also disclose information, including health information, when required by law, legal process, or a governmental request; to protect rights, safety, and security; or in connection with a merger, financing, acquisition, or similar corporate transaction.

You choose Apple Health permissions by data type on your iPhone. Each MyChart organization has its own authorization and disconnect control. Connecting one doesn't give Duet access to another.

Duet keeps the source and date with your records. Information from a source may be delayed, incomplete, changed, or unavailable.

While you use Duet, it refreshes MyChart about once a day. To do this, it records when you last opened Duet. If you haven't opened Duet for seven days, automatic refreshes stop until you come back.

Disconnecting a source stops future access and updates and removes its saved credentials. It doesn't change the original source. Duet keeps the history it already imported, along with insights, doctor materials, and what it remembers, and can still use them. They stay until you delete your account. You can remove doctor materials in For my doctor.

Disconnecting MyChart in Duet doesn't confirm that Epic has revoked its authorization. To revoke access at the source, use the connected-apps controls in MyChart.

You choose what to share and with whom. Receiving someone's information doesn't give them access to yours. Duet has no public profiles, no contact discovery, and no automatic access to new health information.

Your iPhone encrypts a separate copy of the daily measurements you select for each person. The private sharing key stays on that iPhone. In normal operation, Coda stores and delivers this encrypted information without being able to read the shared values. We can see the accounts involved, which measurement types you share, and delivery timing.

Other health information in your Duet account doesn't have this end-to-end encryption.

Information shared with you stays separate from your own. It isn't used for your analytics, AI processing, doctor materials, personal comparisons, Apple Health, widgets, or account export.

Apple delivers Duet's notifications, and they are generic. When a check-in or reminder you asked for has a reply, the alert says only "You have a new message." Notifications never include a person's name, measurement names or counts, health values, or where the information came from.

Each iPhone signed in to your account registers for notifications on its own. Check-in and reminder alerts can go to every signed-in iPhone that has notifications on. Sharing alerts go only to the iPhone that holds your private sharing key.

Signing out on an iPhone stops notifications to that iPhone. Sign out everywhere signs your account out on all devices and stops notifications to all of them. Another device may keep working for up to an hour.

You can rate Duet's replies: a thumbs up, or a thumbs down with any of the listed reasons and an optional note. Your feedback stays in your account and is included in your export. Duet doesn't use it in its replies or in what it remembers.

To improve Duet, Coda uses only daily counts of how many people gave each rating and reason. We don't use your note or your conversation for these counts. Counts from fewer than five people are left out.

A day's counts don't change once recorded, and they are kept after you delete your account. They don't identify you. We keep these counts only in deidentified form and do not attempt to reidentify them.

We don't currently use connected health information for optional product-improvement or research programs. Connecting a source, using Duet, or allowing AI doesn't give that permission.

Any future program would ask for a separate, optional choice and use only the information it needs. It would exclude raw health samples, records, documents, doctor PDFs, free text, and anything another person shares with you. You could withdraw without losing core Duet features, and deleting your account would remove the related information Duet holds.

We keep your information while you use Duet, and as long as needed to meet legal obligations, protect the service, or carry out a deletion or withdrawal.

Logs aren't used as a separate health profile or research dataset.

Deleting your account can't remove copies in an earlier device or computer backup, or files you exported or sent to someone else. Those copies follow the rules of wherever they are.

We use administrative, technical, and organizational safeguards. These include encryption in transit, encrypted credentials for connected services, restricted account access, and deletion controls. No storage or transmission system is completely secure.

Duet also protects the data it keeps on your iPhone, including your measurement preferences and private sharing key.

In the app, you can:

• Connect or disconnect health sources.
• Pause AI, or withdraw AI permission.
• Pause reminders, check-ins, and reviews.
• Stop sharing, disconnect, or block someone.
• Export your information, including your conversation and what Duet remembers.
• Sign out on one iPhone, or sign out everywhere.
• Delete your account.

Start fresh in For my doctor clears the note, selected items, and active summary after you confirm.

Deleting your account removes your account data, Terms and AI permission records, provider credentials, health information, conversation, what Duet remembers, check-ins and reminders, feedback, insights, doctor materials, and sharing content. It also clears account data and sharing keys from your iPhone. Backups and recovery records follow the schedule above. Deletion can't take back information someone else has already received, viewed, or saved.

If you live in Washington, or your health data is collected there, our Consumer Health Data Privacy Policy explains your rights under Washington's My Health My Data Act and how to use them.

Duet is for adults age 18 or older who live in the United States. You confirm this when you accept the Terms. We don't infer eligibility from your health information, device location, or Apple account.

We may update this policy as Duet or the law changes. We will post the updated policy here with its effective date and give you additional notice when required.

For privacy, rights, or appeal requests, email legal@codahealth.ai. For product support, email hello@codahealth.ai. You can also write to Coda Compute, Inc., 99 Wall Street, New York, NY 10005.