Privacy Policy

1. Data we collect

We collect only the data necessary to operate Kynthai for you and your family:

• Account data: name, email address, phone number (optional), hashed password (bcrypt), and chosen portal (Family / Patient / Doctor / Lab / Admin).
• Profile data: family-member profiles you create, including name, relationship, age, and notes.
• Health data (special category): medication names, dosages, schedules, reminder logs, symptom-analyzer inputs, AI chat messages, uploaded prescription and medicine images, chronic conditions, and lab results.
• Usage data: device type, app version, IP address (country-level only), feature usage events, and crash logs.
• Communication data: records of consults with doctors, lab orders, and prescription invitations.
• Payment data: billing email and subscription tier. Card data is handled entirely by our payment processor (Stripe) — we never see or store your full card number.

2. Permitted uses of sensitive health data under US privacy law (45 CFR § 164.502)

We process Protected Health Information (sensitive health data) under the Health Insurance Portability and Accountability Act , the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable US federal and state law as a Covered Entity or Business Associate, as applicable:

• Authorization (45 CFR § 164.508): — free, specific, informed, and unambiguous consent for processing personal data. You may withdraw consent at any time via the in-app consent manager or by emailing privacy@kynthai.app.
• Treatment, Payment, Healthcare Operations – TPO (45 CFR § 164.506): — to deliver the Kynthai service you signed up for, including medication reminders, AI features, doctor consults, and lab orders.
• Legal obligation (45 CFR § 164.512): — to comply with US healthcare laws, federal and state tax laws, and medical record retention requirements.
• Vital interests (45 CFR § 164.512(b)): — to send emergency SOS alerts to caretakers and linked doctors when a user's health or safety is at risk.
• Legitimate interest (45 CFR § 164.502): — for security, fraud prevention, and product improvement, balanced against your rights as an individual whose sensitive health data is held by Kynthai.

Because health data is classified as Protected Health Information (sensitive health data) under US privacy law, we obtain your explicit Privacy-compliant Authorization before using or disclosing sensitive health data for purposes beyond treatment, payment, and healthcare operations (TPO). Revocation does not affect uses or disclosures made in reliance on the earlier authorization prior to revocation.

3. US privacy compliance

Kynthai operates in the United States and is governed primarily by the Health Insurance Portability and Accountability Act (US privacy, 45 CFR Parts 160 & 164) and the Health Information Technology for Economic and Clinical Health (HITECH) Act, along with applicable US federal and state law. As a Covered Entity and/or Business Associate under US privacy law:

• We use and disclose your sensitive health data only for the purposes permitted or required by US privacy, with strict purpose limitation and the minimum-necessary standard.
• We obtain your explicit written US privacy Authorization before using or disclosing sensitive health data for purposes beyond TPO. A Notice of Privacy Practices (NPP) is provided and acknowledged at account registration.
• You have the right to access, correct, amend, and designate a personal representative for (appoint another individual to exercise your rights in the event of death or incapacity) your data.
• In the event of a breach of unsecured sensitive health data, we will notify affected individuals without unreasonable delay and, where required by the HITECH Breach Notification Rule (45 CFR §§ 164.400–414), HHS OCR — in no case later than 60 calendar days from discovery.
• Health data is processed as Protected Health Information (sensitive health data) under US privacy law, which imposes heightened security, privacy, and breach-notification safeguards.
• A Privacy Officer (details in Section 18) handles privacy complaints. Complaints are acknowledged within 5 business days. Standard grievances are resolved within 30 days; complex investigations are extended in writing with stated resolution timelines.

For users in the United States, US privacy and the HITECH Act are the primary governing frameworks. California residents are additionally protected by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). For users in other jurisdictions, Kynthai complies with applicable local data protection laws to the extent required.

4. US privacy authorization & privacy practices

At registration, you are presented with a Privacy-compliant Notice of Privacy Practices (NPP). For uses and disclosures of sensitive health data beyond treatment, payment, and healthcare operations (TPO), a written US privacy Authorization is required. AI features may require a separate optional data-use consent. You may revoke any authorization or consent at any time via your account settings or by emailing privacy@kynthai.app. Revocation takes effect promptly (typically within 72 hours) but does not apply to uses or disclosures made prior to revocation in reliance on the earlier authorization. Withdrawing AI consent disables AI features but retains your medication reminders and health records. Withdrawing TPO consent may require account deletion.

5. Your US privacy privacy rights — how to exercise

under US privacy law, the HITECH Act, and — for California residents — the CCPA/CPRA, you have the following rights:

• Right of access (US privacy § 164.524): — Export all your data via Profile → Export Data (GET /api/user/data-export). You will receive a JSON file within 30 days (as permitted under 45 CFR § 164.524(c)).
• Right to amendment (US privacy § 164.526): — Request correction of inaccurate or incomplete sensitive health data via your profile settings or by emailing privacy@kynthai.app.
• Right to request restriction (US privacy § 164.522): — Request restrictions on certain uses and disclosures of your sensitive health data, subject to applicable limitations under US privacy law.
• Right to delete account: — You may delete your account and all associated sensitive health data at any time via Profile → Delete Account (DELETE /api/user/account). A 7-day cooldown applies.
• Privacy complaint (US privacy § 164.530): — File a complaint with our Privacy Officer at privacy@kynthai.app. We acknowledge within 5 business days and resolve within 30 days. You may also file a complaint directly with HHS OCR at hhs.gov/ocr/privacy.
• Escalation: — Appeal unresolved complaints to HHS OCR.
• Right to designate a personal representative (45 CFR § 164.502(g)): — Designate an authorized individual to act on your behalf in the event of death or incapacity. Email privacy@kynthai.app to set up.

If you are a California resident, you have additional rights under the CCPA/CPRA, including the right to know, delete, and opt out of the sale of personal information. We do not sell your personal information. We will respond to valid requests within 30 days (extendable by 30 days for complex requests, with notice).

6. Your rights regarding health data

Health data is classified as Protected Health Information (sensitive health data) under US privacy law. The following safeguards apply:

• sensitive health data is used and disclosed in accordance with US privacy's TPO framework, or with your explicit Privacy-compliant written Authorization for purposes beyond TPO.
• You may request access to, amendment of, or restrictions on the use and disclosure of your health data (sensitive health data) at any time.
• Health data is encrypted at rest and in transit with encryption and TLS 1.3.
• Access to health data is restricted to authorised personnel on a need-to-know basis.
• Audit logs record all access to health data for security and compliance review.
• In the event of a breach involving unsecured sensitive health data, we will notify affected individuals without unreasonable delay and, where required by the HITECH Act Breach Notification Rule (45 CFR §§ 164.400–414), HHS OCR and applicable state regulators — in no case later than 60 calendar days from discovery.

US users are primarily protected by US privacy and the HITECH Act. California residents have CCPA/CPRA rights. Users in other jurisdictions retain rights under applicable local privacy laws to the extent required.

6A. Other US state consumer privacy laws

In addition to US privacy and CCPA/CPRA, Kynthai complies with the following state-level privacy statutes that grant consumers rights over their personal information:

• Virginia — Consumer Data Protection Act (VCDPA): Virginia residents have the right to confirm whether we process their personal data, correct inaccuracies, delete their personal data, obtain a copy of their personal data in a portable format, and opt out of the processing of personal data for targeted advertising or sale. You may exercise these rights by contacting privacy@kynthai.app.
• Colorado — Privacy Act (CPA): Colorado residents have the right to know what personal data is collected, correct inaccuracies, delete personal data, obtain a copy of their data, and opt out of targeted advertising, profiling, or sale. To exercise these rights, submit a request to privacy@kynthai.app.
• Utah — Consumer Privacy Act (UCPA): Utah residents may request confirmation of data processing, access to their data, correction of inaccuracies, and deletion of their data. Opt-out rights apply to targeted advertising and sale. Submit requests to privacy@kynthai.app.
• Connecticut — Data Privacy Act (CTDPA): Connecticut residents have the right to confirm processing, access their data, correct inaccuracies, delete personal data, and opt out of targeted advertising or sale. Requests may be submitted to privacy@kynthai.app.

Nondiscrimination: We will not discriminate against you for exercising any of your privacy rights under these laws.

7. Data retention

• Active accounts: for the duration of your subscription or until you delete your account.
• After account deletion: we erase personal data within 30 days, except where retention is required by law (tax retention under US federal law: 7 years for tax records).
• De-identified data: information stripped of all 18 US privacy identifiers per 45 CFR § 164.514 may be retained indefinitely as it no longer constitutes sensitive health data.
• Backups: encrypted backups may contain deleted data for up to 90 days for disaster recovery, after which they are permanently purged.

8. Security

We implement layered technical and organisational controls appropriate to the sensitivity of the data we process.

• Encryption in transit: All API and web traffic is protected with TLS 1.3.
• Encryption at rest for high-sensitivity data: Government-issued identity fields are encrypted with encryption (256-bit key, 128-bit IV, 128-bit authentication tag) before being written. Data is decrypted only when required for a specific authorised operation.
• Encryption at rest — general health data: Column-level encryption encryption for general health columns (medications, lab results, AI chat logs, prescription images) is being rolled out. This will mirror the approach for identity fields. We will update this policy once rollout is complete.
• Password storage: Passwords are hashed with bcrypt (cost factor 12).
• Session tokens: Authentication sessions use HTTP-only, Secure, SameSite cookies. Session tokens are HMAC-SHA256 hashed before storage. Session TTL is 30 days from last activity; if fewer than 7 days remain it is automatically extended. Password reset tokens expire after 30 minutes. You can end all sessions by logging out or changing your password.
• Access control: Role-based access control restricts data access to authorised personnel on a need-to-know basis.
• Audit logging: All access to health data is logged for security and compliance review.
• Rate limiting: API rate limits are enforced to prevent abuse and credential-stuffing attacks.
• Content-Security-Policy: CSP headers are applied to reduce injection risk.
• Account lockout: Repeated failed login attempts result in temporary account lockout.

Access to production systems is restricted to authorised personnel. We follow secure deployment practices and review our infrastructure configurations regularly.

8A. FDA Software as a Medical Device (SaMD) & platform status

Kynthai is not a medical device. Kynthai is a health-technology platform that provides general wellness and health-management tools (medication reminders, appointment scheduling, lab bookings, prescription management, AI chat, symptom analysis, medicine identification, drug-interaction checking, and health insights). These features provide informational content only and do not constitute medical advice, diagnosis, treatment, or a substitute for professional healthcare under applicable federal and state law.

Because our AI features are not intended to diagnose, cure, mitigate, treat, or prevent disease, they are not regulated as Software as a Medical Device (SaMD) under 21 CFR Part 870, nor do they require FDA 510(k) clearance, De Novo classification, or PMA approval. Kynthai makes no claims of FDA clearance or approval for diagnostic, therapeutic, or monitoring functions. The FDA may regulate health software in the future; Kynthai will comply with any applicable FDA requirements as they develop.

Independent healthcare professionals: Doctors and labs available through Kynthai are independent healthcare providers. Kynthai does not employ, supervise, or control their medical decision-making. These professionals are solely responsible for compliance with applicable federal and state healthcare laws, including but not limited to EMTALA, Medicare/Medicaid conditions of participation, and state medical-board regulations.

9. Data storage & cross-border transfers (Privacy-compliant)

Data storage (Privacy-compliant): sensitive health data of US users is stored and processed on Privacy-compliant cloud infrastructure with Business Associate Agreements (BAAs) in place with all subprocessors that handle sensitive health data. Cross-border data transfers (where applicable) are subject to appropriate safeguards (BAA provisions and Standard Contractual Clauses) to ensure continued comprehensive protection of sensitive health data.

Kynthai may transfer data to cloud service providers and subprocessors operating outside the United States for data processing purposes. Such transfers are protected by appropriate contractual safeguards including standard data protection clauses and encryption in transit and at rest.

10. Your rights (US — US privacy)

As an individual whose sensitive health data is held by Kynthai, you have the following rights under US privacy law, HITECH, and applicable US state law:

• Right of access (US privacy § 164.524): Request a copy of your sensitive health data. Use Profile → Export Data (GET /api/user/data-export). Delivery within 30 days as permitted under US privacy law.
• Right to amendment (US privacy § 164.526): Request correction of inaccurate or incomplete sensitive health data via your profile settings or email to privacy@kynthai.app.
• Right to request restriction (US privacy § 164.522): Request restrictions on certain uses and disclosures of your sensitive health data.
• Right to delete account: You may delete your account and all associated sensitive health data at any time via Profile → Delete Account (DELETE /api/user/account). A 7-day cooldown applies before permanent deletion.
• Privacy complaint (45 CFR § 164.530): File a complaint with our Privacy Officer at privacy@kynthai.app. We acknowledge within 5 business days and resolve within 30 days. You may also file a complaint directly with HHS OCR at hhs.gov/ocr/privacy.
• Escalation: Appeal unresolved complaints to the HHS Office for Civil Rights (OCR) at hhs.gov/ocr/privacy.

If you are a California resident, you have additional rights under the CCPA/CPRA, including the right to know, delete, and opt out of the sale of personal information. We do not sell your personal information. California residents have rights under CCPA/CPRA (we do not sell personal info). Other jurisdictions: you may also have additional rights under applicable laws in your jurisdiction. We will respond to valid requests within 30 days (extendable by 30 days for complex requests, with notice).

11. Your rights regarding health data

Health data is classified as Protected Health Information (sensitive health data) under US privacy law. We apply heightened safeguards:

• sensitive health data is used and disclosed in accordance with US privacy's TPO framework, or with your explicit Privacy-compliant written Authorization for purposes beyond TPO.
• You may request access to, amendment of, or restrictions on the use and disclosure of your health data (sensitive health data) at any time.
• Health data is encrypted at rest and in transit with encryption and TLS 1.3.
• Access to health data is restricted to authorised personnel on a need-to-know basis.
• Audit logs record all access to health data for security and compliance review.
• In the event of a breach involving unsecured sensitive health data, we will notify affected individuals without unreasonable delay and, where required by the HITECH Act Breach Notification Rule (45 CFR §§ 164.400–414), HHS OCR and applicable state regulators — in no case later than 60 calendar days from discovery.

US users are primarily protected by US privacy and the HITECH Act. California residents are additionally protected by the CCPA/CPRA. Users in other jurisdictions retain rights under applicable local privacy laws to the extent required. (Note: All regulatory references in this section reflect US/US privacy standards.)

12. Data sharing & subprocessors

Kynthai shares personal data only with the minimum number of processors necessary to deliver the service. Each sub-processor listed below has executed (or in the case of open-source components, is covered by) a data-processing agreement imposing obligations no less protective than those in this policy. You may request a current copy of any DPA in force by emailing privacy@kynthai.app.

Cloud infrastructure providers (primary hosting, databases, object storage) operate under data-processing agreements with encryption-in-transit and access-control requirements. Government-issued identity fields (Tax ID/SSN) are end-to-end encrypted before they reach storage, so cloud infrastructure providers cannot read these values under strict data protection agreement requirements.

Doctors and labs you choose to consult or order from receive only the data necessary for that consultation or order. They act as independent data controllers for that data once received.

Authorities may receive data where required by law, court order, or to protect the rights, property, or safety of Kynthai, our users, or others.

We never sell your personal or health data. We never share health data for advertising purposes.

13. Cookies & local storage

Kynthai uses:

• Essential cookies: a single kynthai_session HttpOnly, Secure, SameSite cookie used for authentication. This cookie expires 30 days after your last activity; if fewer than 7 days remain it is automatically refreshed for a further 30 days. You can terminate the session at any time by logging out or changing your password. (No consent is required for this strictly necessary session cookie under applicable US and state privacy law.)
• Local storage: to remember your theme preference, onboarding state, and selected currency. This stays on your device and is never transmitted to our servers.
• Service worker: installed for offline caching and push notifications. You can uninstall it from your browser settings.

We do not use third-party advertising cookies, tracking pixels, or cross-site advertising networks. You can clear all cookies and local storage via your browser settings at any time.

14. Children's privacy

Kynthai is not directed at children under 16. Family profiles for minors may be created and managed by a parent or legal guardian who consents to the processing on the child's behalf. The parent may request deletion of a minor's profile at any time. We do not knowingly collect data from children under 16 without verified parental consent, consistent with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506) and applicable US child-protection framework. If you believe we have collected data from a child without consent, contact hello@kynthai.app for immediate deletion.

14A. Marketing communications

We will not send you marketing emails or SMS without your explicit consent. You can opt in or out at any time via your account settings or by clicking the unsubscribe link in any email. Your consent status is stored and audited.

15. Data breach notification

In the event of a breach of unsecured Protected Health Information (sensitive health data), Kynthai will act in accordance with the HITECH Act Breach Notification Rule (45 CFR §§ 164.400–414):

• Affected individuals (HITECH § 164.404): We will notify affected individuals without unreasonable delay. For breaches affecting 500+ individuals, HHS OCR and prominent media are notified without unreasonable delay. In all cases, notification is within 60 days of discovery.
• Affected individuals: All affected individuals whose unsecured sensitive health data was acquired in a breach will be notified without unreasonable delay and in no case later than 60 calendar days from discovery.
• Remediation & HHS notification: We will contain the breach, assess its scope, notify HHS OCR where required, and take reasonable steps to prevent recurrence. A post-incident review will be conducted within 30 days.

16. Automated decision-making & AI transparency

Kynthai uses AI to provide health information, identify medicines, check drug interactions, and offer insights. AI outputs are advisory only and do not constitute medical advice. You always have the option to consult a qualified healthcare professional through Kynthai.

AI Incident Reporting: If you believe an AI response was incorrect, misleading, or potentially harmful, report it immediately toai-incidents@kynthai.app. Include the AI feature used, the query/input, and the output received. We review all reports, track patterns, and use findings to improve AI accuracy. All reports are logged and reviewed within 72 hours.

Kynthai uses AI (large language models, vision models, speech recognition) for chat, symptom analysis, medicine identification, prescription scanning, drug-interaction checking, and insights. These features provide advisory information only and do not make automated decisions with legal or similarly significant effects about you. All AI outputs are clearly labelled as AI-generated, and a qualified healthcare professional should be consulted before making medical decisions. You may request human review of any AI-generated output by contacting your doctor or hello@kynthai.app.

17. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email and in-app at least 30 days before they take effect. Continued use after the effective date constitutes acceptance. A version history is available at kynthai.app/privacy/history.

18. Contact & Privacy Officer

Kynthai Health Technologies
Address (United States): United States (correspondence via email)
Email: hello@kynthai.app
Support: hello@kynthai.app

Privacy Officer:
Name: Privacy Officer
Email: privacy@kynthai.app
Address: United States

Privacy Officer / Privacy Contact:
Name: Privacy Officer
Email: privacy@kynthai.app
Address: United States
Acknowledgment: all complaints are acknowledged within 5 business days. Standard complaints are resolved within 30 calendar daysof acknowledgement. Where a complaint is complex or requires additional investigation, we will notify you in writing of any delay, the reason, and the expected final resolution date. Escalation: unresolved complaints may be referred to the HHS Office for Civil Rights (OCR).

Correspondence is handled primarily via email at privacy@kynthai.app. Physical correspondence may be directed to the registered US address in the Terms of Service.