سياسة الخصوصية

This Privacy Policy explains how Kureon ("we", "us") collects, uses, discloses, and protects personal and health information when you use our application and related services (the "Service"). If a clinic or healthcare provider accesses records through our provider portal, protected health information handled in that context is also governed by our Notice of Privacy Practices.

1. Information we collect

• Account information: name, email address, and a hashed password.
• Sign in with Google or Apple: if you choose it, Google or Apple shares only your name, email address (or an Apple private relay address) and a sign-in identifier with us. We ask you for your date of birth to confirm your age and do not keep it. We never send Google or Apple any of your health information.
• Health information you provide: imaging studies, AI-generated reports, medications, conditions, allergies, immunizations, surgeries and procedures, family medical history, follow-ups, vital measurements, journal and incident entries (including photos you attach), and pregnancy, dental, vision, and hearing records for you and family members you add.
• Genetic information: if you upload raw DNA or pharmacogenomic data, it is parsed and stored on our own server only and is never sent to any cloud AI provider.
• Insurance and financial information you provide: policy details, claims, explanations of benefits, prior authorizations, medical bills and receipts, coverage deadlines you track, and records-request letters you generate. Payment card numbers are never collected.
• Connected sources: if you connect a third-party account (e.g. WHOOP, Oura, Hospital CUF, PocketHealth, or a hospital EHR via SMART-on-FHIR), we retrieve the records and metrics you authorize, such as reports, labs, imaging, recovery, sleep, heart rate, heart-rate variability, strain, and blood-oxygen.
• Technical data: IP address, device/user-agent, and access logs used for security and audit purposes.

2. How we use information

• To provide, operate, and secure the Service.
• To display your health information to you and authorized members of your account.
• To generate AI analyses of your records when you request them.
• To automatically organize new records when AI features are enabled: classifying uploaded documents, extracting explicitly recommended follow-ups, and preparing plain-language explanations of new reports.
• To maintain audit logs and detect/prevent unauthorized access (security).

3. AI analysis and where data is processed

Consultation audio transcription (Whisper) and the TorchXRayVision chest X-ray classifier run on the same self-hosted machine that stores your records, with no third party involved. Our MedGemma 27B model runs on a private deployment at Modal (United States): it reads the scans and photos you send to an AI feature, and, while your AI-features consent is granted, it also reads images you upload so they can be sorted and filed automatically. The Merlin, Sybil and CheXagent imaging models also run on Modal. Location and camera details are removed from image files (JPEG, PNG, WebP) before any AI model receives them, and patient identifiers in a scan's header are removed before a whole scan is sent to Modal. Text-based AI features (summaries, explanations, document classification, translation, questions you ask) are processed by Anthropic (United States). These providers process the content transiently to return a result, and each AI feature is gated by the consent you give in the app. Some AI processing runs automatically when a new document arrives (classification, follow-up extraction, plain-language explanation); this automatic processing only happens while your AI-features consent is granted, and withdrawing that consent turns it off. AI output is research-grade and is not a medical diagnosis (see Medical Disclaimer).

4. How we share information

We do not sell personal or health information. We share it only: (a) with the service providers listed below, who process data for us; (b) when you choose to share records via a secure link or portal grant; (c) as required by law. Secure share links are short-lived and access is logged.

• Hetzner Online GmbH (Falkenstein, Germany, EU): hosts the physical server our self-hosted infrastructure runs on.
• Anthropic (US): AI text processing of record-derived content when you use AI features.
• Modal (US): GPU compute for our private MedGemma 27B deployment and the Merlin, Sybil and CheXagent imaging models: scans and photos you send to an AI feature, and, with your AI-features consent, uploaded images it sorts and files automatically.
• ElevenLabs (US): processes call audio and call content for the optional voice concierge, only when you use it.
• Resend (US): delivers transactional email (which includes names and email addresses).
• Consensus: receives the text of evidence-search queries only.
• UptimeRobot: receives automated uptime pings to a public health endpoint only; no health or account data.
• Cloudflare: protects and delivers the site. All traffic passes through Cloudflare encrypted and is decrypted at its edge, so it handles what you view, upload and share in transit; pages with health data are marked not to be cached. It also relays insurance claim and EOB emails you choose to forward to your private claims inbox; mail is passed through, not stored by Cloudflare.
• Google (Google Drive, US): stores our off-site backups. Backups are encrypted on our server before upload, so Google holds only ciphertext and never the key.

Public health-data lookups. Some features query public government databases from our server. These services are not subprocessors and receive minimal data: the U.S. National Library of Medicine (RxNorm, DailyMed) and openFDA receive medication names only, for drug information and interaction checks; the FDA drug-shortage list is downloaded in full and matched against your medications on our own server, so no medication names are sent for that feature; CMS provider-data services (Care Compare) receive only the zip code or state you type into a facility search; ClinicalTrials.gov receives only the single condition term you choose to search; and Open Food Facts receives only the food name or barcode you look up when logging food. None of these queries include your name, account, or records.

5. Cookies

We use strictly necessary cookies only: session authentication, CSRF protection, the share-link viewer token, the caregiver view-as cookie, and the cookies that remember the interface language you chose. We use no analytics cookies, no advertising cookies, and no third-party trackers of any kind. Because no non-essential cookies are set, no cookie consent banner is required.

6. Security

We use encryption in transit (TLS), client-side encrypted off-site backups, access controls, scoped access tokens, login-attempt monitoring with lockout, automatic logoff, and audit logging. Full at-rest disk encryption of the live server is on our security roadmap and is not yet in place. No method of storage or transmission is 100% secure; we cannot guarantee absolute security.

7. Data retention

Your records are kept while your account is active. If you delete your account, your records are deleted within 30 days, except audit and security logs, which are retained for up to 6 years for security and legal-defense purposes. All copies, including encrypted backups, are deleted within 60 days of account closure; encrypted backups themselves are deleted after 30 days.

8. Your rights

• Access / export: export a full copy of your data from the app at Settings, using the Export button (ZIP archive), plus a structured FHIR export. Your access history is also visible at Settings.
• Deletion: delete your account and associated records from Settings using the Delete button. Certain logs are retained where required by law (see Data retention above).
• Disconnect sources: revoke connected device and portal access at any time.
• Depending on your jurisdiction, you may have additional rights (e.g. GDPR/CCPA). Contact us to exercise them.

We respond to access, correction, and deletion requests within 30 days, extendable where the law allows; if we need an extension we will tell you why and when to expect a response.

9. Children and teens

Accounts are for adults. You must be 18 or older to create a Kureon account. Sign-up asks for your date of birth and refuses anyone under 18; when it refuses, we keep nothing you typed. Children and teens never get a login, a password or their own notifications. A parent, guardian or other authorized adult adds them as a family member inside the adult's own account.

What we hold about a child, and where it comes from. Everything we hold about a child (for example name, date of birth, immunizations, growth measurements, medicines, allergies, visit notes, documents and images) is information the adult account holder enters, uploads or connects. We do not collect information directly from children. If we learn that a child under 13 has created an account or given us information directly, we close that account and delete the information.

How we use it. Only to provide the Service to the adult who manages the child's records: to store, organize and display them, to remind that adult about things like follow-ups and refills, and to share them when that adult chooses to. We never use a child's information for advertising or marketing profiles, and we never sell it. No page of the Service uses analytics, advertising or tracking tools, so no tracking company receives anything about a child.

Who receives it. The service providers listed in section 4 process it only to run the Service. A child's records reach an AI provider only when the account holder has turned on AI features and uses one on those records; switching AI features off in Settings stops this. A child's records go to a caregiver, clinician or other person only when the account holder shares them.

How long we keep it. A child's records are kept while the account holder keeps them. The account holder can delete any record at any time. When the account is deleted, the child's records are deleted with it, within 30 days from our live systems and within 60 days from all copies, including encrypted backups. Access and security logs, which show who opened a record but hold no medical content, are kept for up to 6 years.

The parent's rights. The account holder can see, correct, export (Settings, Export) and delete a child's records at any time. To remove a family member's profile together with all of its records in one step, or to ask what we hold about a child, write to [email protected]; we answer within 30 days.

When a child grows up. When a family member becomes an adult, they can create their own account, and the account holder can export their records for them.

10. International users & your regional rights

We serve users in the United States, Canada, Pakistan, and Portugal. Data is processed and stored on our server in the European Union (hosted by Hetzner Online GmbH in Falkenstein, Germany); by using the Service you consent to such cross-border processing. We will move all Kureon hosting to Canada, and will update this policy and tell you before the move. Depending on where you live you may have specific rights:

• United States: for personal accounts, HIPAA does not apply; instead, the FTC Health Breach Notification Rule and state privacy laws (e.g. CCPA/CPRA in California) protect you. HIPAA applies only when a clinic or provider accesses records through our provider portal under a Business Associate Agreement.
• Canada: access and correction rights under PIPEDA and applicable provincial health-privacy laws. Your data is stored in the European Union (Germany) and processed by AI providers in the United States; while outside Canada, it may be accessible to the courts, law enforcement, and national-security authorities of those jurisdictions. For Canadian users, if a breach of security safeguards creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, and we keep records of all breaches of security safeguards for at least twenty-four months.
• European Union / Portugal: GDPR rights: access, rectification, erasure, restriction, portability, and objection.
• Pakistan: rights under applicable personal-data-protection law.

FTC Health Breach Notification Rule (US personal accounts): as a vendor of personal health records not covered by HIPAA, we are subject to the FTC Health Breach Notification Rule (16 CFR Part 318). If there is a breach of security involving your unsecured identifiable health information, we will notify you, the Federal Trade Commission, and, where required, the media, within the timelines the Rule sets.

To exercise any of these rights, contact us, or use the Settings page to export or delete your data directly. Cross-border transfers from the EU need appropriate safeguards (such as Standard Contractual Clauses); our subprocessors page states, for each provider, whether one is in place or still being confirmed.

11. Washington "My Health My Data" Act

If you are a Washington consumer, additional rights and disclosures about "consumer health data" apply. See our Consumer Health Data Privacy Policy.

12. Changes

We may update this policy; material changes will be posted with a new effective date.

13. Contact

Questions or requests: [email protected].