Privacy Policy

1. Overview

EMStool.com ("EMStool," "we," "us") operates Cadence, a self-hosted Mobile Integrated Health scheduling and care coordination platform. This Privacy Policy describes how we collect, use, and protect information in connection with the Cadence platform and associated services, including SMS notifications.

Cadence is a B2B software platform. End-user data is controlled by the subscribing organization (the "Agency"). EMStool acts as a data processor on behalf of each Agency.

2. Information We Collect

Platform Users (Agency Staff)

• Name, email address, job title, and role within the organization
• Mobile phone number (if provided voluntarily for SMS notifications)
• Schedule and appointment data entered by authorized users
• Login activity and audit logs for security and compliance purposes
• Theme and notification preferences

Patient Records

Cadence may store Protected Health Information (PHI) as entered by Agency staff, including patient demographics, appointment history, and clinical documentation. PHI is stored encrypted at rest and is subject to the Agency's HIPAA policies and Business Associate Agreement with EMStool.

SMS Notifications

If a platform user opts in to SMS notifications, we collect and store their mobile phone number and consent timestamp. No patient information or PHI is included in any SMS message.

3. SMS Notification Program

Opt-In Process

To receive SMS notifications, a user must:

1. Enter their mobile phone number in their Cadence user settings
2. Check the consent checkbox: "This is my mobile number — I consent to SMS appointment notifications from Cadence."
3. Confirm consent by clicking Accept in the in-app confirmation modal
4. Enable SMS under their Notification Preferences

Message Types

Only one message type is sent: a transactional notification when a new appointment is added to the user's schedule. Messages include the scheduler's name, appointment date and time, and a link to the platform. No PHI, patient names, or clinical details are included in any SMS message.

Message Frequency

Message frequency depends on scheduling activity within the user's organization. Users may receive one message per appointment assignment. There is no fixed frequency — messages are event-driven only.

Opt-Out

Users may opt out at any time by:

• Replying STOP to any SMS message
• Disabling SMS in their Cadence Notification Preferences
• Unchecking the mobile consent checkbox in their user settings

Reply HELP for support. Message and data rates may apply.

SMS Sender

SMS messages are sent from +1-833-373-1523 on behalf of the subscribing Agency using Cadence.

4. How We Use Information

• To deliver appointment notifications to opted-in staff users
• To provide, maintain, and improve the Cadence platform
• To maintain security audit logs and detect unauthorized access
• To fulfill our obligations under Business Associate Agreements with Agencies

We do not sell, rent, or share personal information with third parties for marketing purposes.

5. Data Sharing

We share data only with:

• Telnyx — our SMS delivery provider. Receives the recipient phone number and message body (no PHI). Subject to Telnyx's privacy policy.
• Resend — our email delivery provider for transactional emails. Subject to Resend's privacy policy.
• The subscribing Agency — all user and patient data entered into Cadence is owned and controlled by the Agency.

6. Data Security

Cadence implements the following security controls:

• AES-256 encryption at rest for database and uploaded files
• TLS encryption in transit for all web and API traffic
• Multi-factor authentication (MFA) support
• Role-based access control with audit logging
• HIPAA-aligned policies and Business Associate Agreements available upon request

7. HIPAA

EMStool operates as a HIPAA Business Associate for subscribing Agencies that handle Protected Health Information. A Business Associate Agreement (BAA) is available upon request. Our HIPAA compliance documentation is available at emstool.com/hipaa/.

8. Data Retention

User account data is retained for the duration of the Agency's subscription. Upon termination, data is retained for 30 days then securely deleted unless a longer retention period is required by law or contractual obligation. Audit logs are retained for a minimum of 6 years in accordance with HIPAA requirements.

9. Your Rights

Platform users may contact their Agency administrator to access, correct, or delete their personal information. SMS consent may be withdrawn at any time as described in Section 3.

10. Children's Privacy

Cadence is a professional healthcare operations platform not directed at individuals under 18. We do not knowingly collect information from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page reflects the most recent revision. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact

For privacy questions or to request a Business Associate Agreement:

• Email: [email protected]
• Web: emstool.com/cadence/