Effective Date: September 2, 2026
EveryFit, Inc., doing business as QMedic ("EveryFit," "we," "our," or "us"), respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal information in connection with the Casa mobile application ("Casa") on iOS and Android.
This Privacy Policy applies to Casa users and also describes how we handle information about individuals whom users invite or designate as "Buddies."
Account and Profile Information
When you create a Casa account, we collect your first and last name and U.S. mobile phone number. You may also choose to provide an email address and profile photo. Casa uses a one-time passcode (OTP) sent by SMS or voice call to verify your mobile phone number. Casa also auto-detects and receives your time zone to support app functionality.
Buddy Information and Contacts
When you invite someone to participate as a Buddy, you provide or select information such as the person's name and mobile phone number. We use that information to send the invitation and, if the invitation is accepted, to support Buddy-related communications and features.
Buddies do not need to download Casa or create a Casa account to receive supported SMS communications. Casa may maintain information about invitation status and Buddy-related message delivery as needed to operate these features.
If you choose to allow Casa to access your device contacts, Casa uses that access to help you find and select a person to invite as a Buddy. Casa does not upload or store your full address book. Only information for a person you choose to invite or add is transmitted to and stored by Casa.
Authentication, Device and Technical Information
Create, authenticate, secure, and manage Casa accounts;
Connect and sync supported calendars and provide calendar-based visit functionality;
Create, operate and maintain visits and visit history;
Invite and connect users with Buddies and support Buddy-related communications;
Provide visit and SOS functionality, including one-time location sharing and backup location/address functionality;
Deliver service-related push notifications and SMS messages and maintain related delivery records;
Provide support and troubleshoot errors, crashes and technical issues;
Maintain the security, reliability and integrity of Casa; and
Maintain and improve Casa's functionality.
We process information needed to authenticate accounts, maintain sessions, deliver notifications, secure Casa, and troubleshoot technical issues. This may include account or internal identifiers, one-time verification records, session information, IP address, device or browser identifiers, device type and operating system, app version, push-notification tokens, timestamps and message-delivery information.
Casa also maintains limited activity and audit records describing system actions and related technical information for security, reliability, troubleshooting and audit purposes.
Calendar and Visit Information
If you connect a supported calendar, including Google, Microsoft or Apple, Casa receives and stores information used to support visit functionality. Depending on the calendar event, this may include event title, date and time, duration, location and notes, as well as information needed to maintain the calendar connection.
Casa supports connected-calendar syncing and may send supported visit changes back to the connected calendar. Casa also stores visit-related information such as visit status, actual start and end times, Buddies associated with a visit, and location information captured for supported visit functionality.
Location and SOS Information
Casa does not continuously track your location, monitor your location in the background, or use geofencing. Location is captured only at specific moments needed to provide visit and SOS functionality.
When you start a visit, Casa may capture and store a one-time location. If you send an SOS, Casa may capture another one-time location at that moment. Casa does not continuously update your location during an SOS.
If usable location information is not available, Casa may use an address already associated with the visit or ask you to provide an address. Casa may use mapping or geocoding services to create a readable address or map link for supported Casa functionality.
When you send an SOS, Casa may share applicable SOS information and available location information with the Buddies designated for the visit. Casa does not contact 911, law enforcement, fire, emergency medical services, QMedic's monitoring center or other emergency responders on your behalf.
Notification and SMS Information
Casa maintains information needed to send and manage service-related push notifications, SMS messages, and in-app communications, including Buddy invitations, visit-related communications, account verification, and SOS alerts. This may include message content, recipient information, delivery status, timestamps, and opt-out or preference information. If a Buddy opts out of SMS communications, Casa identifies that person as opted out, automatically declines a pending invitation, removes the person from Default Buddy assignments, and notifies the Casa account holder that the Buddy can no longer receive Casa SMS communications. If the person later opts back in, the prior Buddy relationship is not automatically restored; a new invitation and acceptance are required.
If a Casa account holder opts out of SMS, Casa records that preference and temporarily restricts app functions that depend on SMS until the account holder opts back in. During an active visit or SOS, Casa permits the user to finish or cancel the active visit or SOS. While the account holder remains opted out, login verification may be offered by automated voice call.
We do not use personal information for advertising, profiling or behavioral tracking.
We do not sell personal information or share personal information with advertisers. We disclose information as needed to provide and operate Casa, fulfill user-requested functionality, maintain security and reliability, support the service, and comply with applicable legal requirements.
Buddies
Casa shares information with applicable Buddies in order to provide the features you request. Depending on the feature, this may include your name, visit-related communications, SOS notifications, and available location information associated with an SOS.
Service Providers and Connected Services
Casa uses service providers and connected services to support its functionality. These include Twilio for SMS delivery; Google, Microsoft and Apple for connected-calendar functionality; Google Cloud services and Google Cloud Storage for application infrastructure and profile-photo storage; Firebase Cloud Messaging for push notifications; mapping/geocoding services for location-related functionality; and Sentry and Firebase Crashlytics for mobile-app crash and error diagnostics.
Firebase Analytics is disabled. Casa does not use Firebase Analytics for behavioral analytics or advertising.
Service providers may process information necessary to perform their services and may maintain their own service records according to their applicable practices.
We retain personal information for as long as reasonably necessary to provide and operate Casa, maintain the security and reliability of the service, comply with applicable requirements, and support the purposes described in this Privacy Policy.
Under Casa's current configuration, account-associated visit history, SOS records and associated location information, notification and Casa-side SMS records, Buddy invitation records, authentication/session records and similar account-linked information are generally retained while the Casa account remains active and are deleted through the account-deletion process, subject to the limited exceptions described below.
Certain transient synchronization records are automatically removed after a short technical retention period. Limited activity and audit logs may remain after account deletion for security, reliability, troubleshooting, and audit purposes. These logs do not store the user's name, phone number or email address; after account deletion, an internal identifier that remains in such logs is no longer linked by Casa to the deleted account.
Service providers may retain their own records according to their own retention practices even after Casa deletes its corresponding records.
We use reasonable administrative, technical and organizational safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration or loss. These measures include access controls, authentication practices, encryption in transit and cloud infrastructure, and technical controls designed to support the security of Casa.
No method of electronic transmission or storage can be guaranteed to be completely secure. If a security incident affecting personal information occurs, we will provide notices as required by applicable law.
Depending on where you live and whether applicable privacy law applies to Casa, you may have rights regarding your personal information. These may include rights to request access to, correction of, deletion of, or a portable copy of certain personal information; opt out of certain sales, sharing, targeted advertising or profiling; limit or withdraw consent to certain processing of sensitive personal information; and appeal certain decisions regarding privacy requests, subject to applicable exceptions.
Casa does not sell personal information or use personal information for targeted advertising or cross-context behavioral advertising.
You can update certain information within Casa, disconnect a connected calendar, and manage certain device permissions through your device or connected-service settings. You may also contact us using the information below to make an applicable privacy request.
Account and Data Deletion
Casa provides an in-app account-deletion flow. After the user confirms the deletion request, Casa sends a 6-digit one-time passcode to the user's mobile phone by SMS or voice call. The user must enter that code to complete the permanent deletion. Deletion is blocked while a visit is active or an SOS remains unresolved. If a Casa account holder has opted out of SMS, self-service deletion may be unavailable while the account is in that opted-out state; the user may contact QMedic Support to complete an account-deletion request.
You may also request account and data deletion outside the app through Casa's public account-deletion webpage at qmedichealth.com/casa-account-data-deletion. The webpage may direct you to QMedic Support at support@qmedichealth.com to submit or complete the request.
When a Casa account is deleted, Casa deletes the user profile, sessions, Buddy relationships and invitations, calendar connections, visits and visit-Buddy assignments, SOS events and delivery records, device tokens, notification events, in-app notifications, OTP codes, SMS opt-out records and the user's stored profile image. The user's phone number is then available for re-registration. Limited activity/audit log records are preserved only as described in Section 5; those records do not contain the user's name, phone number, or email address and retain only an internal identifier that is no longer linked by Casa to the deleted account.
Information about you that another Casa user independently provided or maintains within that user's account may remain associated with that user's account. For example, if another user added you as a Buddy, that user's Buddy record may continue to contain the name and phone number they provided for you.
Authorized EveryFit/QMedic personnel may access limited information through Casa's administrative tools for operational, security, troubleshooting, and support purposes. This may include account information, limited visit-status information, and technical activity/audit information.
Casa's administrative tools are designed to limit access to sensitive visit and SOS content. Access to information is restricted to authorized personnel for appropriate business purposes.
Casa is not intended for children under 13 years of age. Individuals under 13 are not permitted to create an account for or use Casa. Individuals ages 13 through 17 may use Casa only with the consent of a parent or legal guardian. If we learn that personal information has been collected from a child under 13 contrary to this policy, we will take appropriate steps to address it.
Casa is currently intended for use in the United States. Casa and its supporting systems are operated from the United States, and personal information processed through Casa may be stored and processed in the United States.
Certain U.S. states have enacted consumer privacy laws that may provide residents with specific rights regarding their personal information. These laws apply to Casa only to the extent that EveryFit and Casa's processing of personal information are subject to the applicable law, including applicable thresholds, exemptions and exclusions.
Where applicable law provides you with privacy rights, we will process eligible requests in accordance with the law that applies to you and to Casa's processing of your personal information.
We may update this Privacy Policy from time to time to reflect changes to Casa, our privacy practices, or applicable requirements. When we update this Privacy Policy, we will revise the Effective Date shown at the top and provide additional notice when required by applicable law.
This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict-of-law principles, except where applicable mandatory law provides otherwise.
If you have questions about this Privacy Policy, Casa's privacy practices, or an applicable privacy request, please contact us:
EveryFit, Inc. (DBA QMedic)
44 School St, Suite B5
Boston, MA 02108-4201
support@qmedichealth.com
