Children’s & caregiver data addendum

Why this document exists

Children’s & caregiver data addendum: How Cadence handles data for minors and shared diaries. Cadence advertises infancy and caregiving modes. Both mean the same unusual thing: an adult using the app to record health information about somebody who is not themselves — a baby, a child, an elderly parent, a partner recovering from surgery, an adult with a learning disability or an ostomy.

Almost every privacy policy for a health app assumes one user recording their own data. That assumption is wrong for a meaningful share of Cadence’s users, and getting it wrong produces two failures: users are left without guidance on obligations they may genuinely have, and the person whose bowel habits are being recorded — who is often the most vulnerable party and never reads the policy — is left out of the picture entirely.

This addendum sets out who is responsible for what, and what we ask of you.

1. The short version

1. We never see any of it. Everything logged in caregiver or infancy mode stays on your device, exactly like your own data.
2. When you log data about another person, you become responsible for it — not us. In most family situations the law asks very little of you. In professional situations it asks a great deal.
3. Only log another person’s health data if you have the right to. Parent or guardian, legal authority, or their agreement.
4. Tell them, if they can understand. And show them, if they ask.
5. Hand it over when it stops being yours to keep. A child grows up. A person regains capacity. Section 6 covers how.
6. Cadence is not a surveillance tool. Please read §8.

2. Children and the app

2.1 Cadence is not directed at children

Cadence is designed for adults. We do not market it to children, it carries no child-appealing content, and we do not knowingly permit anyone under 16 to join the waitlist or to be our customer.

Our Google Play target audience is set to adults only, and we do not participate in Google Play’s Designed for Families programme.

2.2 Infancy mode is a tool for parents, not a service to children

Infancy mode exists because newborn and infant stool frequency and appearance are among the things paediatricians and health visitors actually ask parents about, and because parents of a colicky or constipated baby are frequently asked to keep a diary. It is a diary for the parent.

The distinction matters legally:

• We do not collect personal data from a child. The person operating the app is an adult. The data is entered by that adult, onto that adult’s own device, and is never transmitted to us.
• Article 8 GDPR governs consent where an information society service is offered directly to a child. Cadence is not offered directly to children, so Article 8 is not engaged.
• COPPA (US, 15 U.S.C. §§6501–6506) applies to operators of online services directed to children under 13 that collect personal information from children. We operate no service directed at children and collect nothing from them. COPPA is not engaged.
• UK Age Appropriate Design Code and equivalent EU codes apply to services likely to be accessed by children. Cadence is not, and we take reasonable steps to keep it that way.

If any of these assumptions changes — if we build a teen mode, or a version a child would operate themselves — this analysis has to be redone before launch, not after.

2.3 If a child has given us data

If you believe a person under the applicable age has joined our waitlist or written to us, tell us at [email protected] and we will delete it promptly and confirm when done. We do not require a formal request or proof of guardianship for this.

3. When you log data about someone else, who is the controller?

This is the question that determines everything else, and the answer depends on why you are doing it.

                    Are you logging for a family member,
                    in a personal capacity, not for work?
                                   │
                 ┌─────────────────┴─────────────────┐
                YES                                  NO
                 │                                   │
                 ▼                                   ▼
   ┌──────────────────────────┐      ┌────────────────────────────────┐
   │  HOUSEHOLD EXEMPTION     │      │  PROFESSIONAL / ORGANISATIONAL │
   │  GDPR Art. 2(2)(c)       │      │  You or your employer are the  │
   │                          │      │  CONTROLLER, Art. 4(7)         │
   │  The GDPR does not apply │      │                                │
   │  to you. No controller   │      │  Needs: Art. 6 basis + Art.    │
   │  obligations.            │      │  9(2)(h) condition, Art. 30    │
   │                          │      │  records, likely an Art. 35    │
   │  Still: §3.3 applies.    │      │  DPIA, Art. 32 security.       │
   └──────────────────────────┘      │                                │
                                     │  ⚠ Check with your employer's  │
                                     │  DP lead BEFORE logging.       │
                                     └────────────────────────────────┘

3.1 Family and household use — the household exemption

Article 2(2)(c) GDPR provides that the Regulation does not apply to processing by a natural person “in the course of a purely personal or household activity”.

A parent recording their baby’s nappies. An adult child keeping a diary of an elderly parent’s constipation to take to the GP. A partner tracking symptoms during recovery from surgery. These are household activities. The GDPR does not apply to you at all, and you have no controller obligations under it.

That is a real and deliberate carve-out, and we would rather tell you it exists than imply you are taking on a compliance burden you are not. Note that the exemption is about the activity, not the relationship — it can be lost if the data is published, circulated beyond the household, or used for a purpose outside private life.

3.2 Professional and organisational use — the exemption does not apply

If you are recording another person’s bowel health in the course of paid work or an organised activity — a care home worker, a home care agency, a nurse, a nursery or childminder, a supported living service, a school — the household exemption does not apply.

In that case you or your employer are the data controller for that person’s health data, with the full set of obligations that follow:

• a lawful basis under Article 6 and a separate condition under Article 9 for the health data — most often Article 9(2)(h), health or social care, under the responsibility of a professional subject to a duty of secrecy, and typically requiring Member State law such as [national implementing legislation];
• transparency to the data subject or their representative under Articles 13 and 14;
• respecting their rights under Articles 15 to 22;
• appropriate technical and organisational security under Article 32;
• records of processing under Article 30, and possibly a Data Protection Impact Assessment under Article 35, since this is special category data about vulnerable people, often at scale;
• an assessment of whether the personal device you are using is an appropriate place for it at all.

We are not your processor in this scenario. We supply software; we receive no data; we cannot access, extract or delete anything on your device; and we cannot assist with a data subject access request. There is no Article 28 data processing agreement between us because there is no processing by us to govern.

If you are using Cadence professionally, please check with your employer’s data protection lead before you log a single entry. Recording residents’ or patients’ health data on a personal phone in an app your organisation has not assessed is a common and serious compliance failure, and it is not one we can fix for you. Many organisations will conclude it is not appropriate. That is a legitimate conclusion.

3.3 What we ask of every caregiver user

Whichever category you fall into:

4. What the app does to help

• Modes are separated. Each person you track has a distinct profile. Data is not merged across profiles and reports are generated per person.
• Nothing is transmitted. The same architectural guarantee that protects your data protects theirs. See §3 and §5 of the main Privacy Policy.
• Per-profile export. You can export or delete a single person’s data without touching your own — necessary for the handovers in §6.
• Per-profile erase. One tap, immediate, permanent.
• Photographs are off by default and must be enabled per profile. Images of another person’s body — especially a child’s — carry a category of risk that text entries do not. Please think carefully before enabling this on a profile that is not your own, and consider whether a Bristol type and a note would do the same job.
• Reports name the subject. So a report about a person in your care cannot be mistaken for one about you when it reaches a clinician.

5. Rights of the person you are recording

The person whose data you are recording has rights, whether or not they are able to exercise them and whether or not the GDPR technically applies to your particular use.

We cannot help them exercise those rights, because we hold nothing. If somebody contacts us saying “my daughter is keeping a Cadence diary about me, I want a copy / I want it deleted”, the honest and only answer we can give is that we have no access to it and they must ask the person holding the device. We will say so promptly and courteously, and we will explain how per-profile export and erase work so they know what to ask for.

If you are the subject of a Cadence diary and the person holding it will not engage, your route is your national data protection authority (where the household exemption does not apply), a safeguarding authority, or legal advice — not us. We are sorry that is not a more satisfying answer; it is a direct consequence of a design that also makes it impossible for anyone else to reach your data.

6. Handovers: when the data stops being yours to hold

This is the part most policies never address, and it is where real harm tends to occur.

6.1 A child grows up

Health records a parent keeps about a child do not remain the parent’s property indefinitely. As a child develops sufficient understanding, the record becomes theirs.

There is no single legal age at which this happens — it turns on the child’s evolving capacity, and different jurisdictions frame it differently (Gillick competence in the UK, various ages of medical consent across EU member states). As a practical rule:

• From roughly age 8 to 12, involve them. Tell them the diary exists and let them see it.
• From roughly age 12 onwards, treat the record as substantially theirs. Ask before adding to it. Do not read it to others.
• When they want it, export the profile as CSV and give it to them.
• When they ask you to stop, stop and delete the profile.

Bowel and continence records are among the most embarrassing things that can exist about a teenager. A childhood diary of soiling accidents or constipation, kept without their knowledge and surfaced later, can do real and lasting damage to trust. Please handle it as you would want yours handled.

6.2 An adult regains capacity

If you have been recording under a power of attorney or deputyship and the person recovers capacity, the authority ends. Export the profile, give it to them, and delete it from your device unless they ask you to continue.

6.3 An adult loses capacity

If somebody who was recording their own data can no longer do so and you take over, make sure you actually hold the authority to. A family relationship alone is often not enough. In most jurisdictions this means a registered health and welfare power of attorney, a court appointment, or an equivalent instrument.

6.4 A person dies

The GDPR does not apply to the personal data of deceased persons, although some member states extend national protections ([NAME ANY THAT APPLY IN YOUR MEMBER STATE]).

Practically: consider whether the record is still needed — for an inquest, a claim, or a family’s understanding — and delete it when it is not. A bowel diary is rarely something an estate needs.

6.5 A caring relationship ends

If you stop caring for someone — a placement ends, a relationship ends, you change employer — the record does not travel with you as a personal keepsake. Export it to whoever is now responsible if that is appropriate, then delete the profile from your device.

7. Shared-diary mode

Shared-diary mode lets two carers — co-parents, siblings sharing care of a parent, a couple — keep one record between them, without any central server.

7.1 How the transfer works

• One device produces an encrypted export file of a single profile. The file is encrypted with a key derived from a pairing secret exchanged directly between the two devices, by QR code scanned on-screen or by a one-time code.
• You move that file to the other device yourself, by whatever means you choose.
• The receiving device decrypts and merges it.

Cadence does not host, relay, broker, store, queue or observe the transfer. There is no rendezvous server, no push channel and no account linking the two devices. If both phones are offline, the transfer still works over any local channel you use.

7.2 What you should understand before using it

The moment the file leaves the app, it is an ordinary file. If you email it, message it, or drop it in a cloud folder to get it to the other device, you have placed a person’s health record on a third-party server, encrypted but present, outside your control and outside this policy. That is your decision to make, not ours — but make it knowingly.

Prefer a local channel: direct device-to-device transfer, a cable, or local Wi-Fi. Avoid anything that keeps a copy.

• The pairing secret is what protects the file. Treat it like a password: exchange it in person if you can, and do not send it through the same channel as the file.
• Both carers then hold a full copy. Deleting a profile on your device does not delete it on theirs. If a care arrangement ends, or a co-parenting relationship breaks down, you must ask the other holder to delete their copy — and you have no technical means of compelling it.
• Consent to sharing is separate from consent to logging. If the person being recorded has capacity, they should agree to a second carer holding their record, not merely to the record existing. Ask them before you pair.

7.3 What this does not change

Shared-diary mode does not create any transmission to Cadence, does not alter our Data Safety declaration in respect of collection, and does not make us a controller or processor of the transferred data. It does mean an on-device transfer to another application may occur if you route the file through a messaging or storage app.

8. Caregiver mode and coercive control

We want to be direct about something.

A tool that lets one person keep a detailed, timestamped record of another person’s most private bodily functions can be misused. Continence is an area where controlling and humiliating behaviour is documented in the literature on domestic abuse and on institutional neglect. We would rather name that risk than pretend the feature is neutral.

Our design position:

• Cadence is a care tool, not a monitoring tool. It has no covert mode, no hidden operation, no remote visibility, no alerting to a third party, no location, and no way for anyone other than the device holder to see anything.
• We will not build covert monitoring. No stealth mode, no hidden profiles, no notification suppression designed to conceal the app’s operation from the person being recorded, and no remote access to another person’s diary. If we are ever asked for these, the answer is no.
• We will not add cross-device visibility of one person’s diary to another person’s device without the recorded person’s own consent given on their own device.

If you are being monitored in a way that frightens you, in the EU you can find national domestic abuse support through the Women Against Violence Europe network at https://wave-network.org. In the UK, the National Domestic Abuse Helpline is 0808 2000 247, free and 24 hours. In the US, the National Domestic Violence Hotline is 1-800-799-7233. If you are in immediate danger, contact your local emergency number.

9. Safeguarding

Cadence does not monitor your entries, cannot see them, and will not report anything to anyone. There is no mechanism by which the app could raise a safeguarding concern, and you should not rely on it as one.

If a diary you are keeping causes you to suspect that a child or vulnerable adult is being neglected or harmed, contact your local safeguarding authority or your professional safeguarding lead. Do not wait, and do not treat the app as having flagged or not flagged anything relevant to that question — its rules concern stool type and symptoms, nothing more.

10. Contact