Privacy Policy

Introduction

Kentra Health LLC ("Kentra Health", "we", "our", or "us") respects your privacy and is committed to protecting it through our compliance with this policy. This policy describes how we collect, process, retain, and disclose personal data about you when providing services to you through our websites, applications, and services that link to this policy (our "Services") and our practices for using, maintaining, protecting, and disclosing that information.

This policy applies only to information we collect:

• Through the Services; and
• In communications, including email, text, chat, and other electronic messages, between you and the Services.

It does not apply to information collected by us through any other means, including on any other website operated by any third party that does not link to this policy, or any third party, including through any application or content that may link to or be accessible from or through the Services.

Please read this policy carefully to understand our policies and practices regarding your information and how we treat it. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Services after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Children's and Minors' Data

Kentra is only for people 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from someone under 18, we will delete it.

If you believe someone under 18 has given us personal information, please contact us at support@kentrahealth.com and we will delete it.

The Personal Data That We Collect or Process

"Personal data" is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, home address, or personal health information you upload to our Services.

The types and categories of personal data we collect or process include:

Account and Contact Information

• Name, email address, phone number, and mailing address
• Date of birth and age
• Account credentials and authentication information
• Username and other contact information you provide us

Demographic Information

• Age and gender
• Content and information you elect to provide as part of your profile

Health and Medical Information

• Medical history and health conditions
• Medications, treatments, and prescriptions
• Appointments, provider names, and visit documents or recordings you choose to upload
• Vital signs and health metrics
• Reproductive and sexual health details you choose to share (for example, contraception or pregnancy history)
• Health goals and wellness data

Voice and Sensor Data

• Voice recordings, when you use voice input (transcribed to text; recordings you attach to a doctor visit or a chat are stored with your records until you delete them). We do not create voiceprints or use voice data to identify you.
• Sleep, health, or exercise data

Device and Technical Information

• IP address and device identifiers
• Operating system and version, hardware identifiers
• Browser type and information
• Usage data and interaction patterns
• Approximate location you provide (such as ZIP code or address) and, if you allow location access, your device's approximate location, which is used to find nearby care options and is included in requests to the AI assistant

Some of the information identified above, including biometric information and health data, may be considered sensitive data under certain laws. If required under applicable law, we will collect and process sensitive personal data only with your consent. If you choose not to provide or allow us to collect some information, we may not be able to provide you with requested features, services, or information.

If you are a California resident, to access our supplemental California privacy statement, visit our CCPA Privacy Notice.

Statistical and Aggregated Information

Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific Services feature. If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal information.

Technical Information

Technical information includes information about your internet connection and device, and the crash, error, and performance data the app sends to Sentry, such as the screen that was open, the date and time, response times, and download errors. A crash or error report can include the recent screens you visited and the buttons you tapped just before the error, so we can find its cause. We use this only to diagnose problems and measure app stability and performance, never for advertising.

How We Collect Your Personal and Other Data

You Provide Information to Us

We collect information about you when you interact with our Services, such as when you create or update an account, or interact with our Services.

Automatically Through Our Services

When you use the app, our servers receive your IP address, device and operating system details, and app version with each request, the app sends crash reports, error reports, and performance data to Sentry (described under Error Monitoring & Crash Reporting below), and, in app versions that include product analytics (being introduced from late 2026), unless you turn it off, the app sends a limited set of product analytics events to PostHog (described under Product Analytics below). The app does not use advertising identifiers (such as Apple's IDFA or Google's advertising ID), does not show Apple's App Tracking Transparency prompt, and does not contain advertising trackers.

Our website, kentrahealth.com, is hosted on Cloudflare, which processes your IP address to deliver and protect the site, and it loads fonts from Google Fonts, which receives your IP address when a page loads. When ad measurement is turned on, the website also uses advertising tags from Google, Meta, and TikTok, described under Website Ad Measurement below.

Third-Party Collection

Apart from the service providers described under Third-Party Services below and, on our website only, the advertising tags described under Website Ad Measurement, no third party collects information about you through Kentra. The Kentra app does not show ads, does not use advertising trackers, and does not let third parties track your activity across other websites or apps.

Third-Party Services

We use the following third-party services to operate and improve Kentra Health. Our service providers are engaged under agreements that limit their use of your data to providing services to us; Apple and Google process push delivery and sign-in under their own developer terms and privacy policies, linked below. Kentra Health is a direct-to-consumer wellness application and is not a HIPAA "covered entity" or "business associate"; we apply safeguards such as encryption, least-privilege access and per-user data isolation to all health information you give us. Service providers who process data for Kentra — Microsoft Azure OpenAI, Sentry, Google Firebase Cloud Messaging, Google Maps Platform, PostHog, Firecrawl, Supabase, Resend, and Render (which hosts our application servers) — are bound by agreements requiring them to give your data the same or equal protection as described in this policy.

Backend Services

AI Features (Consent Required)

Kentra's AI features run only after you consent to AI processing by Microsoft Azure OpenAI. The app asks for this consent with a separate checkbox that names the provider, and asks again before a feature that needs it if you have not given it. Voice transcription — voice input, doctor-visit recordings, and feedback voice notes — has its own consent, Voice Input, which is separate from AI chat consent and is asked for before your first recording. Photos you send in chat from your camera or photo library have their own consent too, Image Analysis, which is asked for before your first photo. With Image Analysis consent, those photos are sent to Microsoft Azure OpenAI so it can read the health information in them (such as prescriptions, medication labels, and health documents), and what it reads can be saved to your Kentra profile. The photos are stored with your conversation in your Kentra account and are deleted when you delete your account. Without Image Analysis consent, Kentra does not send your photos to the AI. All three consents name Microsoft Azure OpenAI, which transcribes your recordings under the Voice Input consent. When you consent, the profile and health information in your Kentra account (including readings imported from Apple Health or Health Connect), your chat messages, your recordings, and photos or documents you choose to upload are sent to the AI provider below to generate a response. If you allow location access, your approximate location (rounded to about 1 km, or your city or ZIP code) may also be included in AI chat requests to Microsoft Azure OpenAI so the assistant can suggest nearby results such as clinics and pharmacies. AI responses are general wellness information, not medical advice; check with your healthcare provider. Kentra is not a medical device and does not diagnose, treat, cure, or prevent any condition; it provides general wellness information and helps you keep your records. Always talk to a qualified clinician about medical decisions. You can turn off AI chat, Voice Input, or Image Analysis consent, each on its own, at any time under Profile > Privacy & Account.

Push Notifications & Reminders

Sign-In Providers

Error Monitoring & Crash Reporting

Product Analytics

Website Ad Measurement

Transactional Email

Device Health Connections (Optional)

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data, to:

• Provide you with the Services and any contents, features, information, products, or services that we make available through the Services.
• Fulfill any other purpose for which you provide it.
• Improve our Services, including by analyzing your information and creating aggregated data derived from your information to develop, maintain, analyze, improve, optimize, measure, and report on our Services and their features. Our analysis may include the use of technology like machine learning and large language models. This does not apply to your health information, including data imported from Apple Health or Health Connect, which we never use for analytics, model development, or aggregated data. Diagnostics are collected through Sentry and usage analytics through PostHog, as described under Error Monitoring & Crash Reporting and Product Analytics.
• Measure whether our ads lead people to our website's app store buttons and which campaigns lead to installs, as described under Website Ad Measurement and Product Analytics. We never use health information for this.
• Carry out our obligations and enforce our rights arising from any contracts entered into between you and us.
• Notify you when Services updates are available and about changes to any products or services we offer or provide through them.
• Send you medication and appointment reminders, check-in prompts, health information, and important updates by push notification, in-app message, or email, according to your notification settings.
• Comply with healthcare regulations, legal requirements, and law enforcement requests.
• Protect against fraud, unauthorized access, and other harmful activities.
• For any other purpose with your consent.

The usage information we collect helps us improve our Services and deliver a better and more personalized experience by enabling us to estimate our audience sizes and usage patterns, store information about your preferences, speed up your searches, and recognize you when you return to our Services.

Who We Disclose Your Information To

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. This does not apply to your health information, including data imported from Apple Health or Health Connect, which we never include in aggregated or de-identified disclosures.

We may also disclose personal data that we collect or you provide as described in this privacy policy:

• To contractors, service providers, and other third parties we use to support our organization and who are bound by contractual obligations to keep personal data confidential and use it only for the purposes for which we disclose it to them.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Kentra Health's assets.
• To other people only when you direct us to (for example, by exporting or sharing a report yourself).
• To third-party services you ask the assistant to use, such as Walgreens (prescription refill links) — only the details needed for that request.
• To Firecrawl, when you ask Kentra to look up the wellness benefits or rewards of your health insurance plan — only the name of your insurance company and plan, so Firecrawl can search public web pages about that plan. Firecrawl does not receive your name, account details, or any health information.
• To Google Maps Platform (Google Places), when you look for nearby care through the assistant or from Kentra's care screens (find nearby care) — your approximate location and the care topic you are searching for. Google Maps Platform receives this information only when you ask to find nearby care.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal data:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our Terms of Use and other agreements.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, our members, or others.

We do not sell your personal information.

How We Protect Your Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure:

• Encryption of data in transit and at rest using industry-standard protocols
• Secure authentication and access controls
• Per-user data isolation (row-level security) and least-privilege access for our team
• Automated removal of health information from error and diagnostic logs
• Incident response procedures for potential security breaches

However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal data transmitted to, through, using, or in connection with the Services. Any transmission of personal data is at your own risk.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data against unauthorized use, disclosure, and access.

How We Retain Your Personal Data

We keep the categories of personal data described in this policy for as long as reasonably necessary to fulfill the purposes described or for as otherwise legally permitted or required, such as maintaining the Services, operating our organization, complying with our legal obligations, resolving disputes, and for safety, security, and fraud prevention.

This means that we consider our legal and business obligations, potential risks of harm, and nature of the information when deciding how long to retain personal data. At the end of the retention period, personal data will be deleted, destroyed, or deidentified.

Health information you enter or import is retained until you delete it or delete your account, except for the raw device-health import upload described above (deleted within 7 days, or 30 days after a failed import) and where a longer retention period is required by law.

If you are a California resident, visit our CCPA Privacy Notice for more information about the retention periods that apply to the personal data categories we collect.

Your Rights and Choices About Your Information

This section describes mechanisms you can use to control certain uses and disclosures of your information and rights you may have under state law, depending on where you live.

Cookies and Tracking Technologies Choices

The Kentra app does not use advertising or tracking cookies; in app versions that include product analytics, you can turn it off in the app's settings. When ad measurement is turned on, our website uses the advertising cookies and tags described under Website Ad Measurement. To stop them, turn on Global Privacy Control in your browser or opt out under Your Privacy Choices; the opt-out is saved in that browser. You can also set your browser to refuse or alert you to cookies.

Your State Privacy Rights

Depending on your state of residency, you may have certain rights related to your personal data, including:

• Access: You may confirm whether we process your personal data and request a copy of it. The app does not offer a full-account export, but individual lists can be shared as a PDF from the app; for a full copy, email support@kentrahealth.com from the address on your account and we will send you a copy.
• Correction: You may request that we correct inaccuracies in your personal data that we maintain, taking into account the information's nature and processing purpose.
• Deletion: You may request that we delete personal data about you that we maintain, subject to certain exceptions under applicable law.
• Targeted Advertising, Profiling, and Sales: We do not sell your personal data or use it for profiling that produces legal or similarly significant effects about you. Our website's ad measurement tags, described under Website Ad Measurement, may be considered targeted advertising under some state laws; you can opt out with Global Privacy Control or under Your Privacy Choices. We never use health information for advertising.

Important: The exact scope of these rights vary by state. There are also several exceptions where we may not have an obligation to fulfill your request.

To exercise any of these rights, please contact us at support@kentrahealth.com. To appeal a decision regarding a consumer rights request, please reply to the response email with your appeal.

Some browsers and browser extensions support the Global Privacy Control ("GPC") that can send a signal to process your request to opt out from certain types of data processing, including data "sales" and "sharing" as defined under certain laws. When our website detects a GPC signal, it treats it as a request to opt out and does not load the Google, Meta, or TikTok advertising tags in that browser.

If you are a California resident, additional information applies to you. To access our supplemental California privacy statement and learn more about California residents' privacy rights, visit our CCPA Privacy Notice.

Using Kentra as a Guest

You can try Kentra's AI chat as a guest, without an account, after you confirm that you are 18 or older and agree to AI processing. As a guest:

• Your messages and the AI's replies are stored on Kentra's servers, and your messages are sent to Microsoft Azure OpenAI to generate the replies, as described under AI Features above. Guests can send text only, not photos or recordings, and guest chats are not added to a Kentra health record.
• Your guest chats are linked to a random identifier that the app creates when it is installed and keeps on your device. It is not derived from your device's hardware or other identifiers. We use it to keep your guest chats together, to count your free guest messages (up to 10 a month), and to prevent abuse. We do not use it for advertising or to track you across other apps.
• A guest conversation is deleted automatically 90 days after its last message, and you can delete a guest conversation in the app at any time. The count of guest messages sent from a device is deleted after 6 months.
• If you report an AI reply as a guest, we keep a copy of that reply, the reason you chose, any details you add, and the device identifier so we can review it. A report is kept after the conversation itself is deleted.

Account Deletion

You have the right to delete your account and all associated data at any time. Deletion from the app takes effect immediately. When you delete your account:

• Your account credentials and profile information will be permanently deleted
• Your health data, including readings imported from Apple Health or Health Connect, medications, conditions, and allergies will be permanently removed
• Your chat history and AI conversation data will be deleted
• Your consent records, preferences, settings, and account activity log will be removed
• Documents, recordings, photos, and feedback attachments you uploaded are removed from storage before the account itself is deleted

How to delete your account: Open the Kentra Health app, go to Profile > Privacy & Account > Delete Account. You will be asked to confirm this action. Account deletion is permanent and cannot be undone. Instructions are also at kentrahealth.com/support#delete-account.

If you no longer have the app, email support@kentrahealth.com from your account email and we'll delete your account and data within 30 days. You can send the same request by email even if you still have the app.

Note: Deleted data may persist for a limited time in routine encrypted backups, which are overwritten on a rolling basis. Deleted data is purged from these backups within 30 days of deletion, except where the law requires us to keep records.

Changes to Our Privacy Policy

We may update this policy from time to time, and we will provide notice of any such changes to the policy as required by law. The date the privacy policy was last updated is identified at the top of the page.

We will notify you of changes to this policy by:

• Updating the "Last Updated" date and posting the updated policy on the Services
• Sending email or in-app notifications for material changes

We may email or otherwise communicate reminders about this policy, but you should check our Services periodically to see the current policy and any changes we have made to it. Your continued use of the Services after we make changes is deemed to be acceptance of those changes.