Privacy Policy

Last updated: July 3, 2026

This Privacy Policy explains how Collective Edge ("Collective Edge", "we", or "us") collects, uses, and discloses information in connection with our website and our services, including the Collective Edge Agent (the "Agent"). It also describes the choices and rights you have regarding your information.

Information we collect

We collect the following categories of information:

  • Account and contact information, such as your name and email address, provided by you or your organization when you are onboarded to our services.
  • Service usage information, including the messages and requests you send to the Agent and the operational logs used to run and secure the service.
  • Connected account data that you authorize the Agent to access on your behalf, as described in "Google user data" below.

How we use information

We use the information we collect to provide, maintain, secure, and improve our services, to communicate with you, and to comply with our legal obligations. We do not sell personal information, share it with advertisers or data brokers, or use it, including Google user data, to train general-purpose AI models.

How we share information

We share information only with service providers that help us operate the service, such as cloud infrastructure providers, under contractual confidentiality obligations; where required by law; or where necessary to protect the rights, safety, and security of our users and the service.

Google user data

If you connect a Google account to the Agent, you authorize access through Google's OAuth consent flow. Depending on the permissions you approve, the Agent may:

  • read email in the connected mailbox (Gmail read-only access);
  • send email from the connected mailbox at your direction (Gmail send access);
  • read files in the connected account's Google Drive (Drive read-only access).

We use this access solely to provide the features you request, such as searching or summarizing your email, sending a message you have reviewed and approved, or reading a document you ask about. In connection with this access:

  • We store the OAuth token that maintains your connection in encrypted form. Email and file contents are processed only to fulfill your requests and are not retained beyond what is necessary to complete them.
  • We do not sell Google user data, use it for advertising, or use it to train generalized machine-learning models.
  • Our personnel do not access your Google user data except with your explicit permission, where required for security or legal compliance, or where necessary to operate the service.
  • You may disconnect a Google account at any time by instructing the Agent to disconnect it, or by revoking access at myaccount.google.com/permissions. Disconnecting deletes our stored token for that account.

Collective Edge's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and tracking

Our website does not use analytics, advertising, or tracking cookies, and we do not build a profile of your browsing activity. Within the product, we use only the cookies necessary to keep you signed in and to keep the service secure.

Data security

We maintain administrative, technical, and physical safeguards designed to protect the information we hold. Because we handle data from healthcare organizations, our security program is built to a healthcare standard.

  • HIPAA-aligned
  • SOC 2
  • MFA + SSO
  • Encrypted in transit & at rest

Compliance and standards

  • HIPAA: we handle protected health information in accordance with HIPAA and can enter into a Business Associate Agreement (BAA) with covered entities and their business associates.
  • SOC 2: we maintain a SOC 2 security program with independent audits of our controls.

Safeguards

  • Data is encrypted in transit (TLS) and at rest.
  • OAuth tokens and other secrets are stored encrypted and isolated per user.
  • Access to accounts and internal systems requires multi-factor authentication, and we support single sign-on (SSO).
  • We apply the principle of least privilege, granting the minimum access necessary to operate the service.
  • Access to sensitive systems is logged and reviewed.

No method of transmission or storage is completely secure. If a breach affects your information, we will notify you and the relevant authorities as required by applicable law.

Data retention

We retain information only as long as necessary for the purposes described in this policy or as required by law, after which it is deleted. As noted above, email and file contents accessed through a connected account are not retained beyond fulfilling your request.

Your rights and choices

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at ce@collective-edge.co. You may also:

  • request a copy of the personal information we hold about you;
  • request that we correct or delete it; and
  • disconnect any connected account, which deletes our stored credentials for it, or revoke Google access at myaccount.google.com/permissions.

We will not discriminate against you for exercising these rights.

Children's privacy

Our services are intended for EMS organizations and their staff and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the services after an update constitutes acceptance of the revised policy.

Contact us

For questions or requests regarding this policy, contact us at ce@collective-edge.co.