Kinjay Consumer Health Data Privacy Policy

At a user’s direction, Kinjay may collect:

• name, date of birth, sex recorded at birth, relationship, photo, and profile notes;
• conditions, health history, allergies, medications, supplements, and dose records;
• vital signs, physical measurements, lab observations, and report-provided ranges;
• appointments, immunizations, providers, insurance information, emergency details, contacts, and care notes;
• uploaded laboratory, imaging, prescription, clinical-letter, and other health documents, including their contents and metadata;
• AI-proposed transcriptions, user corrections, source records, and information derived solely to organize or arithmetically compare the user’s records; and
• household permissions, authority attestations, sharing selections, and access/security events associated with health records.

Kinjay does not intentionally collect precise location to infer visits to healthcare facilities, genetic sequence data, or biometric identifiers unless a future feature is separately disclosed and valid consent is obtained first.

Consumer health data comes from:

• you and the forms, choices, corrections, and documents you submit;
• another adult authorized to manage or share a person’s record;
• the contents of uploaded reports and documents;
• approved service providers that store or transcribe information on our behalf; and
• limited technical and security events generated when health-record features are used.

We collect and use consumer health data to:

• provide the record-storage and organization features you request;
• show recorded values and arithmetic changes over time;
• transcribe uploaded lab reports after your separately recorded approval and present the proposed values for human review;
• support household collaboration, export, and user-directed sharing;
• preserve data lineage and explain the source of displayed information;
• secure the Service, prevent misuse, troubleshoot, and respond to support requests;
• honor access, correction, withdrawal, and deletion requests; and
• comply with law and protect legal rights.

We do not use consumer health data for targeted advertising, data brokerage, employment or insurance decisions, or unrelated profiling. We do not sell consumer health data.

Depending on your choices, we may share:

• selected household and health records with household users you authorize according to their role;
• emergency-card or health-summary information made available by a public link you create; a summary link can also open a source report that contributes to a displayed result;
• an uploaded lab report, its metadata, and task instructions with the disclosed AI providers when you choose to extract results from that report;
• account and health information needed by hosting, database, storage, authentication, security, support, communications, and deletion providers acting for us; and
• information required by valid law or necessary to protect rights and safety.

We share only the categories reasonably necessary for the disclosed purpose. Kinjay does not share consumer health data with advertising networks or data brokers.

The categories of recipients are:

• household collaborators and public-link recipients selected by a user;
• cloud hosting, database, authentication, and private object-storage providers;
• AI document-transcription providers;
• security, logging, communications, support, and deletion providers;
• payment processors for subscription records that do not require health content; and
• government authorities or transaction counterparties where law permits.

Kinjay uses Supabase for authentication, database, and object storage, and routes user-requested lab-report AI transcription through Lovable’s AI Gateway to a Google Gemini model. Happlace LLC has no affiliate with which it shares Kinjay consumer health data. We will update this Policy before using a different provider, region, retention arrangement, or data flow when required.

Kinjay requests clear, affirmative consent before collecting consumer health data and a separate account-level approval before AI transcription. A lab report can be uploaded and privately stored without transcription. When you choose extraction, Kinjay does not ask again for that report while the account approval remains current. Manual result entry remains available without uploading a report. Consent to create a public disclosure is requested separately for each new public link. Withdrawing the required AI approval makes authenticated Kinjay features unavailable until the approval is granted again.

You may withdraw consent by contacting us as described below. Withdrawal does not change processing already completed lawfully, but it stops the covered future processing after we authenticate and implement the request. You may also revoke active sharing links.

Subject to applicable law and authentication, you may request to:

• confirm whether we collect, use, or share your consumer health data;
• access the data, including a list of relevant recipients where required;
• correct inaccurate data;
• withdraw consent and stop covered collection or sharing;
• delete consumer health data from our active systems and instruct applicable processors to delete it, subject to lawful exceptions; and
• appeal a refusal of your request.

You may exercise rights for a person whose record you are legally authorized to manage. We may ask for information necessary to verify identity and authority. We will not discriminate against you for exercising an applicable right.

Email privacy@kinjay.com with the subject “Kinjay Privacy Request” and state whether you seek access, correction, withdrawal, deletion, recipient information, or an appeal. Do not email health documents or detailed diagnoses. We will provide a secure method if supporting information is needed.

We will authenticate the request, respond within the time required by applicable law, and explain any denial and available appeal or regulator-contact method. Authorized agents may submit requests where applicable, subject to verification of their authority.

We retain consumer health data while needed to provide the requested record service, until the user deletes the applicable record or account, or for a shorter disclosed period. Public links expire or can be revoked. A completed deletion removes active data and is propagated to applicable processors; inaccessible backup remnants expire under the documented backup schedule. Separate legal, billing, fraud, and security records are retained only when justified and are not used as active health records.

We restrict health-data access to people and processors that need it for the authorized purpose and use safeguards designed to protect confidentiality, integrity, and availability. The general Privacy Policy describes security in more detail.

Kinjay does not authorize advertising or analytics providers to collect consumer health data over time across Kinjay’s authenticated pages or public share pages and unrelated websites. Infrastructure and security providers may process limited technical data to deliver and protect the Service, subject to contract and this policy.

We will update the date shown above when this policy changes. Before collecting, using, or sharing an additional category of consumer health data, or using it for a materially different purpose or undisclosed recipient, we will update the policy and obtain affirmative consent when required. Our records preserve the policy you accepted and when you accepted it.

Contact Happlace LLC at privacy@kinjay.com.