Privacy Policy

Last updated: July 2026

Overview

Kinosis ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal and health information when you use the Kinosis health protocol management platform, including our WhatsApp assistant, our mobile app, and connected data sources such as wearables and health platforms.

By using Kinosis, you agree to the collection and use of information in accordance with this policy.

Information We Collect

We collect information that you voluntarily provide through the WhatsApp assistant or the mobile app, and — only with your explicit authorization — data from health platforms and wearables you choose to connect:

  • Health Information: Symptoms, meals, activities, moods, medications, and life events you share with us
  • Reproductive Health Data: If you choose to track it, menstrual cycle information (period dates, flow, cycle-related symptoms) and fertility information (fertile-window and ovulation estimates, LH test results, basal body temperature, and whether you are trying to conceive or pregnant). This is sensitive health data and is subject to the additional protections described in the "Reproductive Health Data" section below
  • Medical Documents: Lab reports, medical images, and other documents you upload
  • Connected Sources: With your consent, health and fitness data from wearables and platforms you link — including Oura, WHOOP, Apple Health, and the Google Health API (see the "Google Health API Data" section below)
  • Contact Information: Your phone number
  • Location Data: If you enable it, approximate location (latitude/longitude) used to add daily weather, UV, and air-quality context to your health history
  • Usage Data: Conversation history, timestamps, and interaction patterns

How We Use Your Information

We use your information to:

  • Provide and maintain our health memory service
  • Remember and organize your health information
  • Generate summaries and reports at your request
  • Improve and personalize our service
  • Send you reminders and check-ins (with your consent)

Data Storage and Security

We take the security of your health information seriously:

  • All data is encrypted in transit and at rest
  • We use secure cloud infrastructure with industry-standard protections
  • Access to your data is strictly limited to authorized systems
  • We do not sell or share your personal health information with third parties for marketing purposes

AI Processing

We use artificial intelligence (Claude by Anthropic) to understand your messages and extract health information. Voice messages are first transcribed to text by OpenAI. Your conversations are processed to:

  • Identify symptoms, meals, activities, and other health data
  • Analyze food photos for nutritional estimates
  • Extract information from medical documents
  • Generate conversational responses

Your data is not sold and is not used to train third-party AI models.

Google Health API Data

If you choose to connect a Google account through the Google Health API, Kinosis reads only the health data types you consent to, and only to provide features you have requested. Specifically, we may access:

  • Sleep — sleep sessions, stages, and duration, to build your sleep history and track sleep-related protocol targets.
  • Activity and fitness — steps, workouts, active energy, and distance, to track physical-activity targets and your adherence score.
  • Health metrics and measurements — such as weight, body fat, blood pressure, blood glucose, resting heart rate, heart-rate variability, and blood oxygen, to build your biomarker history and measure whether your protocol is working over time.
  • Nutrition — logged meals, calories, and macro/micronutrients, to complete your dietary history and correlate nutrition with your other health data.
  • Exercise location (GPS) — route and location data associated with your workouts, to add geographic and environmental context to your activity history.
  • Irregular rhythm notifications — heart-rhythm alerts recorded by your device, stored as part of your cardiovascular history.
  • ECG — electrocardiogram readings recorded by your device, stored as part of your cardiovascular history.
  • Basic profile — a user identifier and basic attributes, to link the connection to your Kinosis account and personalize evidence-based targets.

We access this data on a read-only basis. We use it solely to provide and improve the user-facing features of Kinosis described in this policy — your personal health history, protocol adherence and efficacy metrics, and personalized insights. We do not use Google Health API data for advertising, we do not sell it, and we do not transfer it to third parties except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition with your consent. We do not allow humans to read this data unless we have your affirmative consent to do so, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymized.

Kinosis's use of information received from the Google Health API and/or Google Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.

You can disconnect your Google account at any time from the Kinosis app. On disconnection we stop accessing new Google Health data. You may also request deletion of previously imported Google Health data, which we will remove from your Kinosis account. Data already synced remains part of your health history until you disconnect or request its deletion.

Data Retention

We retain your health information for as long as your account is active or as needed to provide you services. You can request deletion of your data at any time by contacting us. Health data imported from connected sources (including the Google Health API) is deleted when you disconnect the source and request its removal, or when you delete your account.

Your Rights

You have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request deletion of your data, including your reproductive-health data specifically
  • Withdraw your consent to health-data or cycle/fertility tracking at any time
  • Export your data in a portable format
  • Opt out of promotional communications

U.S. state privacy rights (including consumer health data). Depending on your state (for example under Washington's My Health My Data Act, Nevada SB 370, and the California Consumer Privacy Act as amended), you may have additional rights over your "consumer health data," including the right to confirm whether we collect or share it, to have it deleted, and to withdraw consent to its collection and sharing. We collect and share consumer health data only with your consent and only with the processors described above, and we do not sell it. To exercise any of these rights, contact us using the details below.

European Union. If you are in the European Union (GDPR), health data is treated as special-category data that we process only with your explicit consent, and you have rights of access, rectification, deletion, and objection, and the right to lodge a complaint with your data protection authority.

Third-Party Services and Data Processors

To provide the service we share data with the processors listed below. We do not sell your personal health information, and we do not share it for advertising. Each processor receives only the data needed for its function:

  • Twilio — delivers our WhatsApp and SMS messages and one-time login codes. Message content you send and receive passes through Twilio.
  • WhatsApp (Meta) — the messaging channel itself. Messages you exchange with us over WhatsApp are also processed by Meta under its own terms; if you prefer not to use WhatsApp, you can use the mobile app instead.
  • Anthropic — provides the AI (Claude) that understands your messages and extracts health information. Your conversation content and relevant health context are sent to Anthropic to generate responses. Anthropic does not use this data to train its models.
  • OpenAI — transcribes voice messages you send (speech-to-text) so we can log what you said.
  • Amazon Web Services (AWS) — cloud hosting, database, and file storage (documents, photos, reports) in the United States.
  • Push notification providers — when you use the mobile app, reminders and check-ins are delivered through Expo and the Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android).
  • OpenWeatherMap — receives only approximate coordinates (no identity) to return local weather, UV, and air-quality data.
  • Connected health platforms and wearables — where you link them: the Google Health API, Oura, WHOOP, and Apple Health.

These third parties have their own privacy policies, and we encourage you to review them.

Reproductive Health Data

Menstrual cycle and fertility data are among the most sensitive information we handle, and we treat them accordingly:

  • We never ask for it unprompted. Cycle tracking begins only when you bring it up, or if you accept a single, clearly optional offer. You are never required to track it.
  • Separate, affirmative consent. The first time you track cycle or fertility data, we show you a short notice and ask you to confirm ("yes"/"ok"). We record this data only after you agree.
  • Not contraception. Fertility and cycle estimates are provided for awareness and conception planning only. Kinosis is never a method of birth control, and we always state the basis and confidence of any estimate.
  • Your control. You can stop tracking, and ask us to delete your cycle and fertility data, at any time — separately from the rest of your account.
  • We do not sell it, use it for advertising, or share it for those purposes, and we will not disclose it to third parties except as strictly required by law. If we ever receive a legal demand for reproductive health data, we will resist over-broad requests to the extent permitted by law.

International Data Transfers

Kinosis stores and processes data on servers in the United States, and several of our processors (above) are located in the United States. If you use Kinosis from outside the United States, your information — including sensitive health data — is transferred to and processed in the United States. By using the service and, where applicable, providing your consent, you authorize this transfer. We apply appropriate contractual and security safeguards to data transferred internationally.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

privacy@kinosis.ai