What’s collected
- Answers to questions, with timestamps.
- Camera readings: heart rate, breathing rate, HRV, confidence scores and waveforms.
- Face detected, talking and blinking indicators.
Off unless you turn it on
- Location and audio: off unless the program owner turns them on and the participant opts in.
- Video: kept only from Stream steps with Save recording to cloud on, after the participant agrees to recording. Capture steps don’t save video.
How it’s protected
- Encrypted in transit (TLS 1.2 or later) and at rest (AWS KMS), hosted in the United States.
- Controls modeled on FedRAMP Moderate (NIST SP 800-53), with HIPAA-aligned safeguards.
- Access granted by role at the organization, program and participant level.
- Multi-factor sign-in (authenticator app or passkey) on every account.
- A seven-year, write-once audit log.
Retention and deletion
- Data is deleted within 30 days of a written request. Backups expire within 90 days.
- Presage keeps a de-identified copy.
- If there’s a breach, affected customers are notified within 60 days.
Participants and program builders accept Presage’s Terms of Service, Privacy Policy and Your Responsibilities when they sign up. Your organization is responsible for its own participant consent. See Consent.