Caduvo
Sign in

Privacy Policy

Last Updated: September 30, 2026

This Privacy Policy describes how Product Via Ai, Inc. (the "Company", "we", "us", or "our") collects, uses, and shares information in connection with the Caduvo platform, website, applications, APIs, and related services (collectively, the "Service"), available at https://caduvo.com.

Data controller. Product Via Ai, Inc., a Delaware corporation, owns and operates the Service and is the data controller (or "business" under the CCPA) responsible for the personal information described in this Privacy Policy. "Caduvo" is a product and brand name of Product Via Ai, Inc. and is not a separate legal entity.

1. Information We Collect

a. Information You Provide Directly

  • Account information: name, email address, password (stored only as a salted cryptographic hash), organization/workspace details, and role.
  • Payment information: processed by our third-party payment processor (Stripe). We do not store your full payment card details; we receive limited billing metadata such as plan, payment status, and the last digits of your card.
  • Content you submit: device descriptions, uploaded documents, report inputs, comments, watchlists, data-room materials, and any other material you choose to submit to the Service.
  • Communications: support requests, feedback, and emails you send us.

b. Information Collected Automatically

  • IP address, browser type and version, and operating system;
  • Device identifiers and hardware information;
  • Pages visited, features used, reports generated, time spent, and interaction patterns;
  • Referring/exit URLs; and
  • Server logs, error logs, and access timestamps.

c. Information from Third Parties

  • Payment processor (Stripe): subscription and payment status information.
  • Public data sources: the Service compiles publicly available data (e.g., FDA, CMS, and USPTO records) that may include names of individuals appearing in public filings (such as clinicians or company contacts); this data originates from those public sources, not from the individuals themselves.

2. How We Use Your Information

We use collected information to:

  • Provide, operate, and maintain the Service;
  • Generate the reports and analyses you request, including processing your submitted content through automated and artificial-intelligence systems;
  • Process transactions and send related information;
  • Send administrative communications such as service updates, security alerts, and account notices;
  • Respond to inquiries and provide support;
  • Monitor and analyze usage trends and preferences;
  • Detect, investigate, and prevent fraudulent or unauthorized activity;
  • Comply with legal obligations;
  • Enforce our Terms of Service;
  • Improve and personalize the Service;
  • Develop new products, services, features, and functionality; and
  • For any other purpose disclosed at the time of collection or with your consent.

3. Cookies and Tracking Technologies

The Service uses browser local storage for strictly necessary purposes: keeping you signed in (authentication tokens) and remembering interface preferences.

We also set one first-party cookie, caduvo_attr, for acquisition attribution. When you arrive at caduvo.com it records the campaign tags in the link you followed (UTM parameters and ad click identifiers such as gclid), the domain of the website that referred you, the page you landed on, and when. It expires after 90 days without a visit. If you create an account, this information is stored with your account so we can understand which channels bring us customers; it is not shared with advertising networks or other third parties. We rely on our legitimate interest in measuring our own marketing. You can delete the cookie in your browser at any time.

Analytics (cookies are opt-in). We use two analytics services. Google Analytics 4, provided by Google LLC, tells us how visitors use caduvo.com (pages viewed, approximate location derived from IP address, device and browser type, and how you arrived). PostHog (hosted in the United States) is our product-analytics tool: it records the pages you view, the features you use, and how you interact with the Service (clicks and navigation), and, with your consent, may record some sessions with all form inputs masked. Neither service sets cookies until you click "Accept" on the cookie notice. Before you choose, Google Analytics is not loaded at all, and PostHog runs in a cookieless mode that stores nothing in your browser, cannot recognise you across visits, and does not record sessions. If you accept, Google sets its _ga and _ga_* cookies (which persist for up to two years) and processes the data under the Google Analytics terms and its privacy policy; PostHog sets first-party cookies and local storage entries named ph_* that assign your browser a random identifier, and session recording is enabled. When you are signed in, PostHog events are linked to your account ID, email address, role, and company name so we can understand how customers use the Service and improve it; we do not send Google Analytics your name, email address, or report contents. We do not use either service for advertising and do not sell this data. Your choice is remembered in a first-party cookie, caduvo_consent, for one year; if you decline, no analytics cookies are set and no sessions are recorded. You can withdraw consent at any time by deleting the caduvo_consent cookie (the notice will appear again) or by clearing cookies for caduvo.com. PostHog is also disabled if your browser sends a Do Not Track signal. We do not use third-party advertising cookies.

By using the Service, you consent to the use of the strictly necessary storage technologies described in this section; analytics cookies are used only with your opt-in consent. You can configure your browser to block or clear local storage, but the Service will not function properly without it (you will be unable to stay signed in).

4. Third-Party Services

We use third-party services to operate the Service, including:

  • Payments: Stripe (payment processing and subscription billing);
  • Infrastructure and storage: DigitalOcean (cloud hosting, managed databases, and object storage);
  • AI processing: third-party large-language-model providers, currently including OpenRouter (and the model providers available through it) and Google (Gemini), which process report inputs and uploaded documents to generate analyses;
  • Email delivery: Resend (transactional email);
  • Analytics: Google Analytics 4 (website usage measurement, loaded only after you accept analytics cookies) and PostHog (product analytics and, after consent, session recordings), both described in Section 3; and
  • Fonts: Google Fonts (served from Google's servers, which may log requests including your IP address).

These third-party services have their own privacy policies governing their use of your information. We are not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you interact with through our Service.

5. Data Sharing and Disclosure

We may share information in the following circumstances:

  • Service Providers: with third parties that perform services on our behalf (hosting, payment processing, AI processing, email delivery);
  • Legal Compliance: when required by law, regulation, legal process, or governmental request;
  • Protection of Rights: to enforce our Terms, or to protect the rights, privacy, safety, or property of the Company, our users, or the public;
  • Business Transfers: in connection with any merger, acquisition, reorganization, sale of assets, or bankruptcy;
  • With Consent: when you have given explicit consent (for example, sharing a report or data room with recipients you designate); and
  • Aggregated/Anonymized Data: we may share aggregated or de-identified information that cannot reasonably be used to identify you.

We do not sell your personal information.

6. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy. After account deletion, we may retain certain information as required by law, to resolve disputes, enforce agreements, or for legitimate business purposes. We may retain aggregated or anonymized data indefinitely.

7. Data Security

We implement commercially reasonable technical and organizational security measures designed to protect your personal information, including encryption in transit (TLS), hashed passwords, and access controls. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. We are not responsible for unauthorized access to your information that occurs despite our reasonable security measures. You are responsible for maintaining the security of your account credentials.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at support@caduvo.com.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to such countries. We will take reasonable steps to ensure your information is treated securely and in accordance with this Privacy Policy.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: request a copy of the personal information we hold about you;
  • Correction: request correction of inaccurate information;
  • Deletion: request deletion of your personal information;
  • Portability: request transfer of your information in a machine-readable format; and
  • Objection: object to certain processing activities.

To exercise any of these rights, contact us at support@caduvo.com. We may need to verify your identity before processing your request. We reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

Individuals appearing in compiled public records. As described in Section 1(c), the Service presents information about healthcare professionals and other individuals compiled from public government records (such as CMS provider utilization data, CMS Open Payments, NPPES, and ClinicalTrials.gov). This information concerns professional activity, originates from those public sources, and may be exempt from certain statutory privacy rights as publicly available government-record information. If you are an individual appearing in this compiled data and believe our compilation is inaccurate, or wish to raise any concern about it, contact us at support@caduvo.com; we will review your request and correct errors in our compilation, though we cannot alter the underlying government records, which are maintained by the issuing agencies.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, including the right to know, the right to delete, the right to opt out of sale or sharing, and the right to non-discrimination for exercising your rights. We do not sell personal information as defined by the CCPA. To exercise your California privacy rights, contact us at support@caduvo.com.

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area or the United Kingdom, you may have additional rights under the General Data Protection Regulation (GDPR). Our legal bases for processing are: performance of a contract (providing the Service), legitimate interests (securing and improving the Service), consent (where applicable), and compliance with legal obligations. You have the right to lodge a complaint with a supervisory authority. To exercise your GDPR rights, contact us at support@caduvo.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy at any time. Changes are effective when posted on this page. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

14. Contact

If you have any questions about this Privacy Policy, please contact us at support@caduvo.com.