Kinjay Privacy Policy

Depending on how you use Kinjay, we collect:

• Account information: name, email address, authentication identifiers, account settings, and subscription status.
• Household and permission information: household membership, role, invitations, relationship to a managed person, authority attestations, and associated timestamps.
• Consumer health data: profile details, health history, conditions, medications, allergies, doses, vital readings, lab results, appointments, immunizations, providers, insurance information, emergency details, care notes, and documents you upload.
• Document and provenance information: filenames, document dates and types, issuing organization, extracted text and numbers, source links, corrections, reviewer identity, and processing-provider/model metadata.
• Sharing and activity information: invite and share-link creation, expiry and revocation, selected sharing scope, collaboration history, and security or access events where available.
• Technical and support information: IP address, browser/device details, timestamps, diagnostic and security logs, and communications you send to us.

We receive information directly from you; from another authorized household member; from documents you choose to upload; from authentication, hosting, storage, security, payment, and AI transcription providers; from your browser or device; and from people who contact us about an account, authorization, or support issue.

We use information to:

• create, authenticate, and secure accounts and households;
• store, organize, display, compare, export, and share records as requested;
• transcribe uploaded lab reports and preserve their source and review history;
• manage permissions, invitations, subscriptions, and customer support;
• detect misuse, investigate incidents, maintain backups, and improve reliability;
• comply with law and enforce our agreements; and
• analyze public-site performance using privacy-minimized data that is kept separate from authenticated health-record and share-link activity.

We do not use health information for targeted advertising, build advertising audiences from it, or sell personal or consumer health data.

We disclose information only as needed in these circumstances:

• At your direction: to household members, invited users, and people who receive a share link or exported record.
• Service providers: to approved companies that provide authentication, hosting, database, storage, security, communications, payments, support, AI document transcription, and public-page analytics under applicable terms and contracts. Our analytics provider, Google, receives public-page visit information only, as described in section 11, and never health records, account activity, or share links.
• Legal and safety: when required by valid legal process or reasonably necessary to protect rights, safety, and the integrity of the Service, subject to applicable law.
• Business transactions: as part of a merger, financing, acquisition, reorganization, bankruptcy, or transfer of assets, with notice and protections required by law.

Happlace LLC has no affiliate with which it shares Kinjay consumer health data.

When you choose to extract results from a lab report, Kinjay sends the report, its file metadata, and a transcription instruction through Lovable AI Gateway to Google Gemini. The provider returns proposed document fields and lab values. Kinjay records provider and model information, and a person must review the proposal before extracted observations are saved.

You may upload and privately store a lab report without this AI processing. Requesting transcription requires separately recorded approval. Manual result entry remains available without uploading a report. We do not use the feature to diagnose, recommend treatment, or make solely automated decisions with legal or similarly significant effects. Withdrawing the required AI approval makes authenticated Kinjay features unavailable until the approval is granted again.

A public sharing link permits anyone holding the link to view the information made available by that link type without signing in. A health-summary link can also open a source report that contributes to a displayed result. Recipients may save or redistribute what they receive. You can revoke a link, but revocation cannot erase copies already made outside Kinjay. Exports are files under your control after download.

We retain active account and health-record information while the account or managed record remains active, unless a shorter period is disclosed or required. When deletion is completed, information is removed from active systems and applicable providers, subject to verification and limited exceptions.

Inaccessible backup remnants may remain until scheduled backup expiry. We may separately retain limited billing, tax, fraud-prevention, security, dispute, or legal-compliance records where required or reasonably necessary. Backup remnants and security logs are retained only for their applicable scheduled expiry or as reasonably necessary for the purposes described in this Policy.

We use administrative, technical, and physical safeguards designed for the sensitivity of the information, including encrypted transmission, access controls, authentication, private object storage, row-level database authorization, and security monitoring. No system is perfectly secure, and we cannot guarantee absolute security.

Subject to verification and applicable exceptions, you may ask to access, obtain, correct, or delete information; withdraw consent; obtain information about collection and sharing; or appeal a denied request. You may revoke sharing links and household access through available controls.

Submit a request to privacy@kinjay.com. We may request information reasonably necessary to authenticate you and protect the person whose record is involved. We will not discriminate against you for exercising an applicable privacy right.

Kinjay accounts are for adults. An authorized adult may maintain a child’s record, but a child may not create or operate an account. If we learn that a child created an account or submitted account information directly, we will take appropriate steps to remove it.

Authentication and security technologies may be necessary to operate the Service. Any analytics or advertising technology used on the public marketing site must not receive health-record content, authenticated activity, email addresses, or share-link tokens. Kinjay does not permit third parties to track authenticated health activity across unrelated websites for advertising.

We use Google Analytics 4 on our public pages only—the home page and these legal policies—to count visits and see which pages people read. On those pages Google sets cookies and receives the page address without any query string, the page title, your approximate location derived from a truncated IP address, and general browser and device information. Google acts as our service provider for this measurement.

Analytics does not run on the sign-in page, anywhere inside a signed-in account, on upload or review screens, or on a public share link. It is switched off for anyone who is signed in, and we have disabled Google’s advertising and cross-site personalization features, so this measurement is not used to build advertising audiences and is not a sale or a share of personal information. If your browser sends a Global Privacy Control or Do Not Track signal, we do not measure your visit at all. A browser-level cookie or script blocker also prevents it.

Kinjay is intended for the United States. Information may be processed where our approved service providers operate, subject to their contracts and applicable law. We keep our provider and transfer disclosures consistent with the services we use.

We will update the date shown above when this policy changes and provide additional notice or obtain consent before a material new health-data category, purpose, or recipient is introduced when required. Our records preserve the policy presented to you and when you acknowledged it.

Contact Happlace LLC at privacy@kinjay.com.