Health Data Privacy Policy

1. Categories of Health Data Collected

We collect and process the following categories of consumer health data:

2. Purposes for Collecting and Using Health Data

We collect and use health data strictly for the following purposes:

• Care Coordination: Organize, display, and track medications, appointments, lab results, and clinical documents for the care recipients in your care circle.
• AI-Assisted Clinical Decision Support: Generate critical finding alerts, medication reconciliation, lab trend interpretation, and document analysis summaries to help you advocate for better care.
• Document Processing: Extract text from uploaded documents via OCR, classify documents by type, and index content for search and retrieval.
• Notifications and Alerts: Send medication refill reminders, critical lab result alerts, prior authorization expiry warnings, and appointment reminders via email, push notification, or SMS.
• Caregiver Wellness: Compute burnout risk scores and care trend summaries from check-in data to support caregiver wellbeing.
• Service Improvement: Aggregate, de-identified usage patterns to improve product features. We never use identifiable health data for model training.

We do not sell your health data. We do not use your health data to train third-party AI models. We do not share health data with advertisers or data brokers.

3. Third Parties Who Receive Health Data

Health data is shared with the following categories of service providers, each bound by data processing agreements that prohibit use of your data for their own purposes:

We also share health data with members of your care circle according to their assigned role (co-caregiver, viewer, physician, or family guest). You control circle membership.

4. Data Lifecycle and Retention

Health data moves through three storage tiers based on age and access patterns:

Retention Schedule

We are a consumer caregiving tool, not a healthcare provider, so the 6–7 year medical-record retention rules that apply to hospitals and doctors do not apply to us. We keep your health data only while your account and the care recipient’s record are active. You can delete a care recipient’s records at any time, and we permanently delete that data — including from backups — on request. When you delete your own account, your personal account data is purged after the 30-day grace period; health records you shared in a care circle remain available to that circle’s other members until the care recipient is deleted.

5. Your Rights Under WA MHMDA and Applicable Law

You have the following rights with respect to your health data:

6. How to Exercise Your Rights

• Self-service: Use the Privacy & Data Consent section in Settings to toggle individual data processing permissions on or off.
• Account deletion: Use the Danger Zone section in Settings to request permanent account deletion with a 30-day grace period.
• Email: Send your request to privacy@kinguardian.app. We will verify your identity and respond within 30 days.

7. Deletion Process

When you delete your account or request data deletion:

1. Your account is immediately deactivated (soft-deleted).
2. A 30-day grace period begins, during which you may restore your account or request a full data export by contacting support.
3. After the 30-day grace period, your personal account data is permanently purged. Health records you shared within a care circle remain available to that circle’s other members; to permanently delete a care recipient’s records, delete the care recipient or contact us.
4. Audit logs are retained for at least 6 years per HIPAA requirements.
5. Backups containing your data expire according to our backup rotation schedule (within 30 days after purge).

Important: KinGuardian is a coordination tool, not an archive. Keep your original source documents (paper records, provider portal downloads) as your primary copies. Deleting your KinGuardian account will permanently remove all uploaded copies.

8. Breach Notification

In the event of a breach involving your health data, we will notify affected users without undue delay, and no later than 60 days after discovery, via email and in-app notification, consistent with the FTC Health Breach Notification Rule and applicable state law. The notification will include: the nature of the breach, the categories of data involved, the steps we are taking to address it, and recommendations for you to protect yourself. Where required by law, we will also notify the relevant regulatory authorities.

9. Security Measures

• All data encrypted in transit (TLS 1.2+) and at rest (AES-256 via AWS KMS).
• Application-layer access controls scope every request to the care circles you are authorized to view, within an isolated VPC network.
• Internal AWS service traffic uses private VPC endpoints where available; all traffic is encrypted in transit (TLS 1.2+).
• Authentication via AWS Cognito with JWT tokens in httpOnly cookies.
• Automatic session timeout after a configurable inactivity period (default: 60 minutes).
• Full audit trail of all data access, modifications, and deletions.
• AWS Business Associate Agreement (BAA) covering all HIPAA-eligible services used.

10. Minors

KinGuardian accounts may only be created by individuals 18 years of age or older. Care recipients of any age may have records managed by an adult caregiver. We do not knowingly collect health data directly from individuals under 13. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Health Data Privacy Policy from time to time. When we make material changes, we will increment the version number, update the effective date, and require re-acceptance of the policy through our in-app consent flow. You will not be able to continue using KinGuardian until you have reviewed and accepted the updated policy.

12. Contact Us

For questions, concerns, or requests related to this Health Data Privacy Policy: