Kinello Consumer Health Data Privacy Policy

Effective and last updated: August 9, 2026

This standalone notice supplements the Kinello Privacy Policy and applies to consumer health data, including data covered by the Washington My Health My Data Act and similar state laws. Contact: support@kinello.net.

Consumer health data collected

When an account holder affirmatively enables step sharing, Kinello collects an aggregate daily step total, the local date and timezone for that total, the health source, the time it synchronized, and the member's consent and sharing state. Kinello does not collect raw step samples, heart rate, routes, workouts, diagnoses, medications, or clinical records.

Kinello obtains the daily total from Apple Health or Health Connect through read-only permission granted by the member. Consent and sharing choices come directly from the member.

Why Kinello collects and uses it

Kinello uses a daily step total to show the member's private family step history, family leaderboard, weekly winner, and other step summaries the member chooses to join. Kinello also uses consent and synchronization metadata to enforce privacy choices, prevent duplicate uploads, troubleshoot requested features, and secure the service.

Family step sharing does not by itself send a total to an AI service. AI step insights use a separate two-key permission: an owner or admin must enable the feature for the family, and each member must separately allow AI analysis of their own totals. Only while both keys are on and both consent versions are current may an explicit `@Kinello` question in the family chat send that member's first name and aggregate total for the requested day, week, or month, or may the weekly newsletter send that member's totals as part of its weekly total or champion. Which AI system handles that request is named under "Who can receive it" below.

Kinello does not use consumer health data for advertising, profiling unrelated to the requested family feature, eligibility decisions, or sale.

Who can receive it

Invited members of the same family may see the daily total only while the account holder's current step-sharing consent is active.
Supabase processes the encrypted-in-transit total and consent state to host Kinello's database, authentication, and authorization controls.
The AI provider handling a request receives an opted-in member's aggregate step total with their first name only while the family AI-step key and that member's personal AI-step key are both current and on. Production Kinello keeps a short, ordered list of approved providers and sends each request to the first one on that list that is available, moving on to the next when a provider is unavailable or a request fails: Kinello's own self-hosted NVIDIA DGX Spark, OpenAI, and Anthropic. The DGX Spark is operated by Kinello in the United States; OpenAI and Anthropic are outside processors. Kinello asks every provider handling a request not to keep a copy of it, and does not give step data to anyone to train an AI model. Kinello will publish a new list with a new effective date and require a current personal AI-step consent before sending consumer health data to a provider that is not named here. Family step sharing remains a separate choice.
Apple Health or Health Connect remains the source on the member's device. Kinello does not send Kinello's stored family data back to those services.
Kinello may disclose data when legally required or necessary to protect members, the service, or others.

Kinello does not sell consumer health data. Kinello does not provide consumer health data to data brokers or advertisers.

Step collection and family sharing are off unless the member chooses to enable them. That choice does not enable AI analysis. An owner or admin controls whether AI step insights are available to the family, but cannot consent for a member. Each member controls "Allow AI to analyze my step totals" for themselves in Privacy and sharing settings, and may withdraw it without stopping family step sharing. Turning off either AI key immediately removes that member's totals from new `@Kinello` and newsletter prompts. Turning off family step sharing additionally stops future uploads and blocks other family members from reading prior totals under Kinello's active-consent rules.

A member can delete the account in Account settings. Account deletion removes stored step totals and consent records. A member may also email a consumer health data request to support@kinello.net.

Consumer rights

Subject to applicable law, a consumer may request:

confirmation of whether Kinello collects, shares, or stores their consumer health data;
access to the data and a list of third parties or affiliates receiving it;
correction;
deletion from Kinello and notification of the deletion request to covered processors; and
withdrawal of consent.

Email support@kinello.net from the account email with the subject "Kinello health data request." Kinello may verify identity. If a request is denied, reply with the subject "Kinello health data appeal" and explain why the decision should be reconsidered. Kinello will respond within the period required by applicable law. A Washington resident may also contact the Washington Attorney General.

Security and changes

Kinello protects step totals with encrypted transport, encrypted mobile credential storage, authenticated functions, per-family row-level authorization, explicit consent versions, and private-by-default sharing. Kinello will investigate suspected breaches and provide notices required by consumer health privacy and breach-notification laws.

Kinello will update the effective date and request renewed consent before a material change to the collection or sharing of consumer health data.