Health Data Privacy Policy

1. Categories of Health Data Collected

We collect and process the following categories of consumer health data:

2. Purposes for Collecting and Using Health Data

We collect and use health data strictly for the following purposes:

• Care Coordination: Organize, display, and track medications, appointments, lab results, and clinical documents for the care recipients in your care circle.
• AI-Assisted Clinical Decision Support: Generate critical finding alerts, medication reconciliation, lab trend interpretation, and document analysis summaries to help you advocate for better care.
• Document Processing: Extract text from uploaded documents via OCR, classify documents by type, and index content for search and retrieval.
• Notifications and Alerts: Send medication refill reminders, critical lab result alerts, prior authorization expiry warnings, and appointment reminders via email, push notification, or SMS.
• Caregiver Wellness: Compute burnout risk scores and care trend summaries from check-in data to support caregiver wellbeing.
• Service Improvement: Aggregate, de-identified usage patterns to improve product features. We never use identifiable health data for model training.

We do not sell your health data. We do not use your health data to train third-party AI models. We do not share health data with advertisers or data brokers.

3. Third Parties Who Receive Health Data

Health data is shared with the following categories of service providers, each bound by data processing agreements that prohibit use of your data for their own purposes:

We also share health data with members of your care circle according to their assigned role (co-caregiver, viewer, physician, or family guest). You control circle membership.

4. Data Lifecycle and Retention

Health data moves through three storage tiers based on age and access patterns:

Retention Schedule

5. Your Rights Under WA MHMDA and Applicable Law

You have the following rights with respect to your health data:

6. How to Exercise Your Rights

• Self-service: Use the Privacy & Data Consent section in Settings to toggle individual data processing permissions on or off.
• Account deletion: Use the Danger Zone section in Settings to request permanent account deletion with a 90-day export window.
• Email: Send your request to privacy@kinguardian.app. We will verify your identity and respond within 30 days.

7. Deletion Process

When you delete your account or request data deletion:

1. Your account is immediately deactivated (soft-deleted).
2. A 90-day export window begins. During this window, you may request a full data export by contacting support.
3. Imaging files and large document attachments are deleted first (within 14 days).
4. Clinical records, notes, and metadata are purged after the 90-day window.
5. Audit logs are retained for 6 years per HIPAA requirements, then automatically purged.
6. Backups containing your data expire according to our backup rotation schedule (maximum 30 days after purge).

Important: KinGuardian is a coordination tool, not an archive. Keep your original source documents (paper records, provider portal downloads) as your primary copies. Deleting your KinGuardian account will permanently remove all uploaded copies.

8. Breach Notification

In the event of a breach involving your health data, we will notify affected users within 30 days of discovery via email and in-app notification. The notification will include: the nature of the breach, the categories of data involved, the steps we are taking to address it, and recommendations for you to protect yourself. Where required by HIPAA, we will also notify the U.S. Department of Health and Human Services.

9. Security Measures

• All data encrypted in transit (TLS 1.2+) and at rest (AES-256 via AWS KMS).
• Database protected by row-level security policies and VPC network isolation.
• All PHI traffic routes through private VPC endpoints, never traversing the public internet.
• Authentication via AWS Cognito with JWT tokens in httpOnly cookies.
• Automatic session timeout after configurable inactivity period (default: 15 minutes).
• Full audit trail of all data access, modifications, and deletions.
• AWS Business Associate Agreement (BAA) covering all HIPAA-eligible services used.

10. Minors

KinGuardian accounts may only be created by individuals 18 years of age or older. Care recipients of any age may have records managed by an adult caregiver. We do not knowingly collect health data directly from individuals under 13. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Health Data Privacy Policy from time to time. When we make material changes, we will increment the version number, update the effective date, and require re-acceptance of the policy through our in-app consent flow. You will not be able to continue using KinGuardian until you have reviewed and accepted the updated policy.

12. Contact Us

For questions, concerns, or requests related to this Health Data Privacy Policy: