Privacy Policy

This Privacy Policy explains how Steadio™ (provided by Enchantra, Inc.) handles information collected through the platform. Steadio is used by authorized camp staff to coordinate health and operations at Type 1 Diabetes (T1D) camps and similar programs. The camp organization ("Camp Operator") is the controller of camper health information; Enchantra processes that information on the Camp Operator's behalf.

• Camper health information entered by authorized staff, such as blood-glucose readings, medications administered, care notes, and MESH (mental, emotional, and social health) observations.
• Staff account information, including name, email address, assigned role, and cabin/staff assignments.
• Technical data, including authentication events, audit logs of security-relevant actions, session activity, and limited device/browser information needed to operate the platform.

Steadio does not sell personal information and does not use it for advertising.

Information in Steadio is used solely to:

• Operate camp health and operations workflows for the Camp Operator.
• Enable authorized staff to record and review care for campers.
• Maintain security, prevent abuse, and produce audit trails.
• Provide de-identified reporting and exports to the Camp Operator.

Steadio enforces role-based access controls. Staff can only see the camper information their role requires — for example, counselors see the campers in their assigned cabin, and mental-health data is limited to MESH staff and medical leadership. Access is enforced in the database (row-level security), not just in the user interface.

MESH exports offer a "de-identified" option that removes camper names, dates of birth, cabin identifiers, and parent/guardian contact information before the file is generated. De-identified exports are intended for aggregate reporting and program review.

Steadio is not directed to children and children do not create accounts. All camper information in Steadio is entered by authorized adult staff on behalf of the Camp Operator, under the Camp Operator's agreements with parents and guardians. Questions about a specific camper's data should be directed to the Camp Operator.

• All traffic is served over HTTPS.
• Data is stored in a managed database with row-level security policies.
• Sensitive administrative actions are limited to service-role server functions and require an authenticated privileged role.
• Security-relevant writes are recorded in an append-only audit log.
• Sessions time out after a period of inactivity, and sensitive client-side state is cleared on sign-out.

No system is perfectly secure. Staff must follow account security practices and report suspected incidents to the Camp Operator.

Steadio retains information for as long as needed to provide the service to the Camp Operator and to meet the Camp Operator's own retention obligations. Retention periods and deletion requests are handled in coordination with the Camp Operator.

We may update this Policy from time to time. Material changes will be communicated to Camp Operators.

Questions about this Policy or privacy practices may be sent to tara@enchantragroup.com.