Skip to content

What We Collect

Transparency is core to our approach. This page provides a complete inventory of the data Circadify collects during normal operation.

  • Session ID — UUID v4 uniquely identifying each scan session
  • Timestamps — Session creation, processing start, and completion times
  • Session type — The type of analysis performed (e.g., standard vital sign scan)
  • Status — Current session state (created, processing, completed, failed)
  • Heart rate — Beats per minute (bpm)
  • Respiratory rate — Breaths per minute
  • Heart rate variability (HRV) — Milliseconds (ms)
  • SpO2 — Blood oxygen saturation (%)
  • Blood pressure — Systolic and diastolic (mmHg)
  • Confidence score — Accuracy indicator for the measurement (%)
  • Processing metadata — Duration, model version, device capability tier
  • Browser information — User agent string, supported browser APIs
  • Device capabilities — Hardware tier classification (used for processing optimization)
  • SDK version — For compatibility tracking and debugging

When used via an EHR integration (Epic, Cerner, etc.), additional context is stored in the session:

  • Patient ID — FHIR Patient resource reference (provided by the EHR, not collected by Circadify)
  • Encounter ID — FHIR Encounter reference (if launched within an encounter context)
  • EHR system identifier — Which EHR system initiated the session
  • Email, name, company — Provided during developer signup
  • Plan tier — Starter, pro, or enterprise
  • Usage counts — Monthly scan counts (aggregated, not per-session)

You can attach custom metadata to sessions. In default mode, this data is returned alongside vital sign results in the upload-complete response. In persist mode (PERSIST_VITALS=true), it is stored in the ephemeral session cache and included in polling responses for the session’s TTL.

const session = await client.createSession({
type: 'standard',
metadata: { userId: 'user_123', flowId: 'onboarding' },
});

Custom metadata is not indexed or used by Circadify for any purpose other than returning it in your API responses.

Circadify does not collect or transmit: raw camera frames, video recordings, biometric templates, persistent device identifiers, precise geolocation, or data from non-camera sensors. See Data Minimization for the full exclusion list and technical details.