Regional Privacy Addenda

These addenda supplement our Privacy Policy with region-specific rights and commitments. Where an addendum grants you more protection than the general policy, the addendum controls for residents of that region.

• Texas (United States)
• Michigan (United States)
• Ontario and Canada
• Portugal and the European Union (GDPR)
• Versão portuguesa (Portugal / UE)

Texas (United States)

Texas Medical Records Privacy Act (HB 300)

• Electronic record access within 15 business days. If you request an electronic copy of your health records that we hold, we provide it within 15 business days. In practice you can export instantly from Settings at any time.
• Authorization before electronic disclosure. We obtain your recorded authorization before each electronic disclosure of your health information, except where law permits otherwise. See our Notice of Electronic Disclosure.
• No sale of health information. We do not sell protected health information, ever.

Texas Data Privacy and Security Act (TDPSA)

Health records are sensitive data under the TDPSA. We process sensitive data only with your consent, we do not sell personal data, and we do not process it for targeted advertising or profiling. Kureon currently operates as a small business as defined by the U.S. Small Business Administration; even where the TDPSA's full obligations do not apply to small businesses, we honor its no-sale rule for sensitive data and the rights described on our data rights page.

Breach notification

If a breach of system security affects your unencrypted personal information, we will notify affected individuals without unreasonable delay and in any event within 60 days, and we will notify the Texas Attorney General within 30 days if 250 or more Texas residents are affected.

Michigan (United States)

Michigan has no comprehensive consumer privacy statute today. Our commitments to Michigan residents:

• Breach notice. Under the Michigan Identity Theft Protection Act, we will notify you without unreasonable delay if a security breach affects your unencrypted personal information and creates a risk of identity theft or fraud. Michigan SB 360-364, amendments to the breach law that would add attorney-general notification, are pending in the legislature; we will update these commitments if they are enacted.
• Behavioral health records. Michigan law treats mental health and substance-use records with heightened confidentiality. We apply that heightened care platform-wide: such records receive the same strict consent-before-disclosure handling as all other records, and we never use them for any secondary purpose. Michigan mental-health records also receive the platform's behavioral-health sensitive-class treatment: they are hidden from shared viewers by default, disclosed only with your explicit per-share consent, and shares that carry them include the federal redisclosure-prohibition notice.
• Medical Records Access Act. Michigan clinics using our provider portal remain responsible for the fee schedule and access timelines of the Michigan Medical Records Access Act when patients request records from them. Your own exports from Kureon are always free.

Ontario and Canada

• PIPEDA applies. The Personal Information Protection and Electronic Documents Act governs our handling of Canadian users' personal information. We are a consumer service, not a health information custodian under Ontario's PHIPA.
• Privacy officer. Our designated privacy officer is Meer Feerasta, reachable at [email protected].
• Express consent. Health information is sensitive, so we rely on express consent for its collection, use, and disclosure. You can withdraw consent at any time, subject to legal or contractual restrictions, and we explain the consequences of withdrawal when you do.
• Access and correction. We respond to access and correction requests within 30 days.
• Cross-border transfers. Your data is stored in the European Union (Germany). AI processing you consent to occurs with processors in the United States. While in another jurisdiction, your information may be accessible to that jurisdiction's courts, law enforcement, and national security authorities under local law.
• Complaints. You may complain to us first, and you may also complain to the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.
• PHIPA note for Ontario clinics. Where an Ontario health information custodian uses our provider portal, we act as an electronic service provider to that custodian and comply with the statutory restrictions on such providers: we use personal health information only as necessary to provide the service, and we do not use or disclose it for our own purposes.
• Quebec. The Service is not offered in Quebec at this time.

Portugal and the European Union (GDPR)

Controller

The controller of your personal data is Kureon, operated by Meer Feerasta. Contact: [email protected].

Legal bases

We process your personal data on the basis of your consent (Article 6(1)(a) GDPR) and, for health data, your explicit consent (Article 9(2)(a) GDPR). We record each of these consents separately: storing and organizing your health records, AI features (one consent covering AI summaries, explanations and imaging AI reads), caregiver sharing, and product emails, plus a separate consent before scanning your email for bills, and a consent given each time you record a visit. Storing records and AI features are needed to use the service; the others are optional. You can withdraw consents in Settings; AI consent checks are being extended to every AI feature.

Your rights

• Access to your data, and a copy of it (export ZIP and FHIR export in Settings).
• Rectification of inaccurate data.
• Erasure (delete individual records or your whole account in Settings).
• Restriction of processing and objection to processing.
• Data portability in a structured, machine-readable format.
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
• The right not to be subject to solely automated decisions with legal or similarly significant effects. AI features on this platform draft and explain; they never decide anything about you.
• Complaint to the Portuguese supervisory authority, the CNPD (Comissão Nacional de Proteção de Dados), at www.cnpd.pt, or to your local EU supervisory authority.

International transfers

Your data is hosted in Germany (EU). Some features use U.S. processors (Anthropic for AI text, Modal for imaging AI, ElevenLabs for voice calls, Resend for email). For Resend, whether a data processing agreement with the European Commission's Standard Contractual Clauses has been accepted for our account is being confirmed. We do not yet have a signed data processing agreement, including Standard Contractual Clauses, with Anthropic, Modal or ElevenLabs; transfers to them happen only for the AI and voice features you consent to, and you can withdraw that consent at any time. See the full list on our subprocessors page.

Retention

We keep your data while your account is active. When you delete a record or your account, it is deleted, and we instruct processors to do the same; limited security and audit logs are retained only as long as the law requires. Retention periods are determined by the purpose of processing and applicable legal obligations.

Data collected from hospital portals (Article 14 notice)

When you connect a hospital or clinic portal (for example MyCUF), we collect your health records from that source at your direction. The categories collected are the ones you see in your account: appointments, reports, lab results, imaging, and related documents. The source is the portal you connected, and you can disconnect it at any time.

Access traceability (Lei 58/2019, Article 29)

Portuguese law requires that access to health data be traceable. We meet this by design: your access history page shows every access to your records, by you or anyone you authorized, and we notify you of third-party accesses.

Your information is yours (Lei 12/2005)

Portuguese law (Lei 12/2005) recognizes health information as the property of the person it concerns, with healthcare providers acting as its custodians. That principle is the founding principle of this platform: your records belong to you, and everything here exists to put them in your hands.

Versão portuguesa: Portugal e União Europeia (RGPD)

Esta secção é a tradução portuguesa da adenda relativa a Portugal e à UE. Em caso de divergência, prevalece a versão inglesa.

Responsável pelo tratamento

O responsável pelo tratamento dos seus dados pessoais é o Kureon, operado por Meer Feerasta. Contacto: [email protected].

Fundamentos jurídicos

Tratamos os seus dados pessoais com base no seu consentimento (artigo 6.º, n.º 1, alínea a) do RGPD) e, quanto aos dados de saúde, no seu consentimento explícito (artigo 9.º, n.º 2, alínea a) do RGPD), prestado separadamente para cada finalidade: armazenamento e organização dos seus registos, resumos e explicações por IA, leituras de imagiologia por IA, funcionalidades de voz, partilha e acesso de cuidadores. Cada consentimento pode ser recusado ou retirado sem afetar os restantes.

Os seus direitos

• Acesso aos seus dados e obtenção de uma cópia (exportação ZIP e exportação FHIR nas Definições).
• Retificação de dados inexatos.
• Apagamento (elimine registos individuais ou toda a conta nas Definições).
• Limitação do tratamento e oposição ao tratamento.
• Portabilidade dos dados num formato estruturado e legível por máquina.
• Retirada do consentimento a qualquer momento, sem afetar a licitude do tratamento anterior.
• Direito de não ficar sujeito a decisões exclusivamente automatizadas com efeitos jurídicos ou similarmente significativos. As funcionalidades de IA desta plataforma redigem e explicam; nunca decidem nada sobre si.
• Reclamação junto da autoridade de controlo portuguesa, a CNPD (Comissão Nacional de Proteção de Dados), em www.cnpd.pt, ou junto da autoridade de controlo do seu país da UE.

Transferências internacionais

Os seus dados estão alojados na Alemanha (UE). Algumas funcionalidades utilizam subcontratantes nos Estados Unidos (Anthropic para texto por IA, Modal para IA de imagiologia, ElevenLabs para chamadas de voz, Resend para email). As transferências para a Resend assentam nas Cláusulas Contratuais-Tipo da Comissão Europeia. Ainda não temos um acordo de tratamento de dados assinado, incluindo Cláusulas Contratuais-Tipo, com a Anthropic, a Modal ou a ElevenLabs; as transferências para estas só ocorrem nas funcionalidades de IA e de voz em que consente, e pode retirar esse consentimento a qualquer momento. Consulte a lista completa na nossa página de subcontratantes.

Conservação

Conservamos os seus dados enquanto a sua conta estiver ativa. Quando elimina um registo ou a sua conta, este é eliminado e instruímos os subcontratantes a fazer o mesmo; registos limitados de segurança e auditoria são conservados apenas pelo tempo exigido por lei. Os prazos de conservação são determinados pela finalidade do tratamento e pelas obrigações legais aplicáveis.

Dados recolhidos de portais hospitalares (informação nos termos do artigo 14.º)

Quando liga um portal de hospital ou clínica (por exemplo, MyCUF), recolhemos os seus registos de saúde dessa fonte por sua indicação. As categorias recolhidas são as que vê na sua conta: consultas, relatórios, análises, imagiologia e documentos relacionados. A fonte é o portal que ligou, e pode desligá-lo a qualquer momento.

Rastreabilidade dos acessos (Lei n.º 58/2019, artigo 29.º)

A lei portuguesa exige que o acesso a dados de saúde seja rastreável. Cumprimos isto por conceção: a sua página de histórico de acessos mostra todos os acessos aos seus registos, por si ou por quem autorizou, e notificamo-lo de acessos por terceiros.

A sua informação é sua (Lei n.º 12/2005)

A lei portuguesa (Lei n.º 12/2005) reconhece a informação de saúde como propriedade da pessoa a quem diz respeito, sendo os prestadores de cuidados de saúde os seus depositários. Esse princípio é o princípio fundador desta plataforma: os seus registos pertencem-lhe, e tudo aqui existe para os colocar nas suas mãos.