Privacy Policy
Last updated October 2026.
Cuneate is a post-stroke assessment app made by Geometry Neuroscience for use under a
clinician's care. This page explains what data the app and this website collect, why, and who
can see it.
De-identification by design
Patients using the app are identified only by a randomly generated token in the form
GRT-XXXX-XXXX. We do not ask for or store a patient's name, email address, date of
birth, or any other directly identifying information. A patient's enrollment token is issued by
their clinician; we cannot link it back to a real-world identity ourselves.
What we collect
- Assessment data — results from movement, speech, cognitive, and
check-in tests the patient completes in the app (scores, timestamps, and the underlying
sensor trace needed to compute them), so the clinical team can review recovery over time.
- Account and device data — a device-scoped authentication key and, if
push notifications are enabled, a device token, used only to sign in and to deliver test
reminders.
- App usage — which screens and tests are opened, how long a test takes
and whether it was finished, and which settings are changed, so we can make the app easier
to use. It never includes what a patient types or says, or their results. It is shown to the
patient's clinician as a download and to no one else. Patients can turn it off in the app's
Preferences ("Share how I use the app"), which also deletes what was already sent.
- Daily walking — only if the patient turns on "Count my daily walking" in
the app's Preferences: the number of steps, distance, floors climbed, minutes walking and
walks of five minutes or more on each day, read from the phone's own motion and fitness
data. No location is read or stored. It is shown to the patient's clinician on the patient's
page and is never scored. Turning the setting off in the app deletes what was already sent.
Check-ins such as the life-space questionnaire (where a patient has been in the past four
weeks, how often, and with what help) are stored with the other check-in results.
- Clinician-entered data — test assignments, clinical notes, and reports
written by the care team about a patient's token.
- Contact form submissions — if you write to us through the contact card on
our website, we store the name, email, and message you provide, solely to reply to you. This
is never linked to any patient record.
How we use it
Assessment data is used to score tests, show recovery trends to the clinical team, and — when
a clinician requests it — to generate an AI-assisted clinical report. Report generation is
performed through Anthropic's API; the data sent is limited to precomputed clinical metrics, not
raw identity information, and Anthropic does not use it to train models under our agreement.
We do not use assessment data for advertising, and we do not sell data to anyone.
Who we share it with
We do not share patient data with advertisers, data brokers, or analytics networks. Data is
visible only to: the patient (through the app), the patient's assigned clinician (through the
clinical console), and infrastructure providers who process it on our behalf under contract
(hosting and, if configured, transactional email delivery for staff sign-in) — never for their
own purposes.
Retention and security
Data is retained for as long as a patient's account is active with their clinic, or as
required by the clinic's own record-keeping obligations. Cuneate is currently deployed as a
pilot for consented clinical testing. We take reasonable security precautions, but — in the
interest of being direct rather than making promises we can't yet back up — encryption at rest
is not yet in place. Do not use Cuneate for care decisions outside of a supervised clinical
pilot.
HIPAA status
Cuneate is not yet HIPAA compliant. No government body certifies HIPAA compliance, so we
show no badge. This is where we stand.
In place
- No patient names, emails or dates of birth are stored. Patients are tokens.
- Staff sign in with a password and a code sent by email.
- Each clinician sees only their own patients.
- All traffic is sent over HTTPS.
- Sign-ins, invites, new patients and uploads are written to an audit log.
Not yet in place
- Encryption of stored data at rest.
- Hosting under a signed Business Associate Agreement (BAA).
- A written backup, retention and breach-notification policy, and a formal risk analysis.
- An app-based or hardware-key second factor for staff.
- Rate limiting at the network edge, a web application firewall, and monitoring with alerts.
Until these are done, Cuneate is used only in a pilot for consented testing.
Your choices
A patient's data is managed by their clinician, who can deactivate an account at their
request. To ask about your data, or to request its removal, contact us using the details below.
Children's privacy
Cuneate is intended for use by adult patients under clinician supervision and is not directed
at children.
Changes to this policy
If this policy changes materially, we will update the date at the top of this page.
Contact us
Questions about this policy or your data can be sent to
hello@ghw.care.