Privacy statement

Kinovo is operated by Kinovo Pty Ltd, ACN 703 060 440, ABN 41 703 060 440, based in Queensland, Australia. In this statement, Kinovo, we, us and our refer to that company. Our privacy contact is privacy@kinovo.com.au.

This is Kinovo’s privacy policy. It explains how we collect, hold, use and disclose personal information when you visit our website, request optional typed help, download resources, contact support, create an account or use a care-team workspace. It also covers people whose information is added by someone else, including participants who do not have a Kinovo account.

Kinovo is a shared care coordination workspace, not a medical record, clinical treatment service, emergency service or plan-management system. Providers and professionals may have their own privacy and recordkeeping obligations for the information they handle outside Kinovo.

This statement explains our practices; it is not a request for blanket consent or a waiver of your rights. We provide additional notices or seek consent where required for a particular activity. Our Terms of Use set out responsibilities for using the service. Nothing in either document removes protections that apply under the Privacy Act 1988 (Cth) or other applicable law.

What we hold depends on how you use Kinovo and what authorised people contribute. It can include:

• Account and profile information: name, email address, authentication and account status, optional phone number and profile photo, professional role, organisation and preferences.
• Subscription and billing information, if you choose a paid plan: payer and billing contact details, the chosen plan and account or care-team reference, recurring-payment consent, trial and coverage dates, cancellation and change requests, processor customer/subscription/invoice/payment identifiers, and payment or support status. Stripe collects and handles card details on its hosted pages; Kinovo does not receive your full card number or card security code.
• Participant and care-team information: participant details, relationships, invitations, membership, roles, permissions, preferences and routines, care protocols, goals, tasks, messages, comments, updates and activity history.
• Documents and other contributions: uploaded reports, plans, images and other files, their names and descriptions, versions, access records, and invoice or payment-related documents shared for coordination. These may contain health, disability, family, support, financial or other sensitive details.
• Meetings and calls: invitations, agendas, attendance, notes and agreed outcomes; when you join an embedded call, display names, participant and room identifiers, connection/session metadata, and audio, video or screen-sharing content you choose to transmit. The current meeting feature does not enable call recording, saved transcripts or AI processing.
• Enquiries, resources and support: the contact details, broad role, interests, feedback, issue description, attachments and correspondence you provide, relevant page or workspace context, support actions and email-delivery records.
• Technical and usage information: network and device information, IP-related service logs, browser details, timestamps, authentication and security events, cookies, controlled product events, and notification subscription and delivery information. Section 8 explains analytics separately from care content and operational logs.

We collect information directly when you enter account details, complete a form, accept an invitation, upload a file, send a message, update a task or profile, or contact us. Technical information also arises when your browser connects to the service or uses its features.

We also receive information from authorised care-team members, a participant’s representative, people inviting someone to join, and service providers that support functions such as authentication, security and email delivery. A family member or professional can create a participant profile without that participant having an email address or login. Team members may add information about other people involved in care.

You can browse public resources without creating an account. Where practicable, you can make a general enquiry without identifying yourself or by using a pseudonym. Technical connection information may still be processed. We need enough reliable information to operate a secure account, verify an invitation or respond to a personal-information request; we will explain when anonymity is not practicable.

If required information is not provided, we may be unable to create an account, establish authorised workspace access, provide the requested feature or respond to a request. Optional profile details, marketing choices and optional enhanced analytics are not required for ordinary account access.

Care-team information can reveal a person’s health, disability and other sensitive circumstances. We seek to collect only information reasonably needed for the service and obtain consent where required, unless another legal basis permits collection. Consent must relate to the particular handling of information; an account or invitation does not give unrestricted permission to share it.

Before adding someone else’s information, explain the purpose, likely recipients and relevant privacy choices to them in a way they can understand, and ensure you have consent or other lawful authority. Share the relevant parts of this statement. Do not upload unrelated records, identity documents, passwords or payment-card details simply because a file can be attached.

For children or a person receiving decision-making support, involve them in decisions as appropriate and check the representative’s actual authority. Being a relative, professional or Team leader does not automatically confer legal authority, and disability does not by itself mean a person cannot make privacy decisions.

Where handling depends on consent, you can withdraw it for future handling by contacting us. We will explain the effects on the relevant feature and any information we must or may lawfully retain. Withdrawal does not undo lawful handling that has already occurred or automatically erase shared records.

If we receive information we did not request or information that appears to have been shared without authority, we will assess whether we may lawfully hold it and take appropriate steps, including restricting access, seeking clarification, or deleting or de-identifying it where lawful and reasonable. Contact us promptly if information has been added in error.

Kivo is an optional AI helper powered by Anthropic’s Claude through Amazon Bedrock. When you ask a care-team question, Kinovo may send your question, limited recent conversation context and relevant records you are already permitted to see. This information may include sensitive personal or health information.

Kivo is configured for AI processing in Sydney and Melbourne. Claude is developed overseas. AWS and the model provider do not use these inputs or outputs to train their models.

Kivo conversations and unsaved drafts are private to the person using it. Kinovo retains this history for up to seven days after the last interaction, with an absolute limit of 30 days from creation. Records you choose to save follow Kinovo’s separate retention rules.

The Team leader can turn care-team AI off, and individual members can choose not to use it.

We use information to provide the workspace you request: manage accounts, profiles, invitations and permissions; store and display authorised contributions; coordinate tasks and messages; deliver notifications; and support export, correction and account or workspace lifecycle requests.

We also use relevant information to respond to enquiries, provide support, diagnose faults, prevent misuse, protect accounts and the service, investigate incidents and complaints, meet legal obligations and establish or respond to lawful claims. Access for those purposes is limited to what is reasonably needed.

Controlled usage events and aggregate reporting help us understand whether people can set up a workspace, find information and complete useful work. Section 8 explains what is collected and which additional observations are optional. Requested resource emails and separately chosen marketing communications are explained in section 9.

Optional product feedback is linked to your account and visible only to authorised Kinovo staff, not your care team. We store the questions, answers, written comment, role context and any permission to contact you about that submission. Coarse daily workspace-use and contribution milestones help us choose when to show one feedback invitation; they do not copy care content. Research email invitations require a separate optional preference, available in Settings through Manage research emails or give feedback, and can be unsubscribed from without signing in. Permission to discuss one submission does not subscribe you to research emails. Please leave private care information out of feedback.

Kinovo does not sell personal information or use care-team information for advertising. Kinovo does not use care-team content to train AI models. We do not use this statement to authorise unrelated secondary uses of sensitive information.

Within a care team, access depends on current membership, role, permissions and the visibility of the particular item. Team leaders manage membership and authorised settings. Later-added members may see existing shared records according to those controls. Receiving an alert is separate from having permission to read an item.

Kinovo does not publish private care-team workspaces as public pages. However, authorised members can view and sometimes download or copy information. Removing access stops future authorised requests; it cannot recall information someone has already seen or copied. Professionals may need to retain their own lawful records and remain responsible for their handling of those copies.

Authorised Kinovo personnel may access relevant information for support, administration, incident response or legal purposes when needed. We do not promise that staff can never access care information. We use service providers for hosting, storage, authentication, communications and security, as described below.

We may disclose information with appropriate consent, where required or authorised by law, or where a legal exception permits necessary action to address a serious threat, investigate unlawful activity or protect legal rights. We assess the authority and scope of a request rather than treating every request as permission to disclose an entire workspace.

If ownership or operation of Kinovo changes, including a transfer to a company, any disclosure or transfer must have a lawful basis and appropriate confidentiality and privacy safeguards. We will notify affected users of a material change and obtain consent where required. A change of operator is not permission to use care information for unrelated purposes.

Kinovo uses cloud services. Our primary application hosting on Fly.io and care-workspace database, authentication and private file storage on Supabase are configured in Sydney, Australia. This does not mean every copy, support process, email or technical record stays in Australia.

Supporting services may process information overseas, including in the United States. Cloudflare also describes processing in the European Economic Area and access through its global operations. Other locations can depend on provider support services, subprocessors and your chosen browser or email service. The provider notices below give further detail; contact our privacy contact for information about a particular data flow.

We limit information supplied to what is needed for the relevant service and take reasonable steps to select and manage providers and protect information in line with applicable obligations. Overseas laws may differ from Australian law. This statement does not ask you to waive Australian privacy protections or release Kinovo from responsibilities for overseas disclosures.

Cookies and browser storage support sign-in, security, saved preferences and some local interface state, such as whether guidance has been shown. Some features may keep draft or device-specific state in your browser. On a shared device, sign out and protect the browser profile. Clearing browser data may remove preferences or unsaved local work; blocking essential cookies can prevent sign-in or security checks.

Marketing attribution uses a first-party cookie named kinovo_acquisition. It holds a random journey identifier, recognised campaign tags, landing-page paths, referring website hostnames and first- and last-seen times. It is signed, not encrypted, and expires no later than 90 days after the first visit in that journey. It does not contain care content, full referring URLs or arbitrary query strings.

Baseline first-party measurement records controlled events such as page visits, selected actions, resource requests, account confirmation and useful workspace milestones. Limited signup-step observations can occur before sign-in. Where a journey leads to an enquiry or newly confirmed account, its identifiers and acquisition context can be linked to those records. Product events may include account or workspace identifiers: pseudonymous does not mean anonymous.

Help improve Kinovo is a separate optional preference, initially off, for additional signed-in journey observations. If enabled, it records controlled steps, action and outcome categories, broad device-size categories and validation reason codes to help find confusing or unfinished flows. You can turn it off in Settings at any time to stop new optional collection without losing access. It does not switch off essential operations, security logging or the baseline measurement described above.

Our analytics event fields exclude names, email addresses, care text, messages, document names, filenames, form values and other free-text care information. We use aggregate reporting and suppress small groups. This restriction applies to analytics events, not to the account, support, operational or care records needed to deliver the service, or network signals handled by security providers. Kinovo does not run session replay. Optional Google Ads measurement is described below and is separate from private care-team analytics.

Optional Google Ads measurement is off until you allow it on the public website. The preference cookie kinovo_ad_measurement lasts up to 180 days. If allowed, an isolated public measurement page uses Google Ads cookies to connect ad clicks with a server-verified confirmed signup or first paid subscription. Google receives click identifiers, a pseudonymous event reference, a payment value when relevant, and browser, device and network information, including IP address. It may process that information overseas. We do not send account names, email addresses, phone numbers, care-team or participant identifiers, care content or private page URLs. We keep advertising personalisation, remarketing and enhanced conversions off.

You can refuse this measurement and still use Kinovo. Use Ad measurement preferences on the public website to change your choice. Refusing stops new Google measurement frames and removes accessible Google click cookies. The kinovo_ad_measurement_sent cookie holds pseudonymous delivery markers for up to 180 days to reduce repeat delivery. Google uses stable event references to deduplicate conversions. Browser restrictions, withdrawn consent, different devices and a payment made without another visit can leave Google with fewer conversions than Kinovo's verified internal reporting. Internal billing, retention and revenue reporting remain the source of truth. Google's privacy information is at https://policies.google.com/privacy.

You can block or clear cookies through your browser. Clearing an attribution cookie does not delete records already stored or prevent a new cookie on a later visit if cookies remain allowed. Contact us about access or deletion of information linked to you. The retention periods below also apply to analytics records.

We send account, invitation, security, support and care-coordination communications needed for the service. Email systems process recipients, message content and delivery metadata such as delivery, bounce and complaint status. Support messages can include the issue description or correspondence you provide, so avoid unnecessary sensitive details and ask for a secure way to share evidence when needed.

New accounts receive a limited set of practical setup reminders by default. We check whether the relevant step still needs attention, limit the sequence and keep care-team details out of setup guidance. Optional setup and first-cycle guidance can be turned off in Settings → Notifications. Account, security and access communications are managed separately.

Creating an account does not subscribe you to newsletters, sales campaigns, product updates or research invitations. When you explicitly submit a resource or marketing form, we record the choices, consent wording and version, source and time. For optional resource emails, Resend may receive your email address, first name, broad role and selected topics; we do not send your coordination-problem text or care-team content for marketing.

You can unsubscribe from optional marketing emails without signing in. An unsubscribe does not stop required account, security or operational messages, and a previous unsubscribe is respected by the current resource-signup workflow. Change care-coordination notification preferences in Settings where those choices are available.

If you enable browser or device notifications, we store the push subscription endpoint and encryption keys associated with your account, device/browser information needed to manage it, and delivery status. Your browser or operating-system push provider carries the notification. You can choose Hide details, Sender only or Sender and details separately on each device. Sender and details is the default for new registrations and can show permitted message excerpts, task or document titles, changes and relevant dates. These previews may reveal sender or care information on your Lock Screen, depending on your device settings. We preserve a device’s recorded preview choice when reconnecting that account. Details already displayed by your device cannot be guaranteed remotely erased. Support replies and access-withdrawal notices remain limited. You can change preview choices or disable notifications in Kinovo or your device/browser settings.

Messages, reminders and notifications are not an emergency channel and delivery is not guaranteed. Contact the responsible person or emergency service directly for urgent concerns.

We keep information for as long as reasonably needed for the purpose it was collected, including providing an active workspace, preserving necessary shared history, resolving requests and meeting legal obligations. When it is no longer needed and no lawful retention requirement applies, we take reasonable steps to delete or de-identify it.

Leaving or being removed from a care team ends access to that workspace, not the account or shared history. Messages, task activity, comments, documents and completed work can remain for the life of the originating workspace. Account closure removes or de-identifies private account details while shared history uses a neutral former-member attribution; the content of a shared contribution can still identify people mentioned in it.

Archiving is not deletion: archived documents and workspaces remain available to authorised people in read-only form and can be restored. Scheduled document or workspace deletion and account closure end normal access immediately, with a 30-day cancellation period before permanent deletion processing. Completion is reported only after the required live-file and database cleanup is verified; the deadline alone does not prove deletion succeeded.

Subscription, payment and recurring-consent records may be retained where needed to administer a subscription, resolve a billing dispute, support accounting or meet legal obligations. Stripe also retains records under its own privacy policy and legal obligations. Closing a Kinovo account does not necessarily erase records a payment provider is legally required to keep.

Support correspondence, consent and unsubscribe evidence, account-attribution records and security records have purposes distinct from short-lived analytics. Their retention depends on continuing service needs, requests, disputes and legal obligations. The analytics periods below are not a blanket promise that every record is removed after 30 or 90 days. Contact us about a particular record or an urgent deletion request.

Information may remain outside ordinary use in disaster-recovery backups until those backups age out under the provider’s configured lifecycle. If a restore reintroduces completed deletions, we must reapply them before normal service resumes. A verified legal or security reason may require a restricted, recorded hold. Lawfully downloaded copies held by team members or other recipients are subject to their own obligations.

We take reasonable steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. Controls include authentication, role and membership checks, item-visibility rules, private file access, database access policies and restricted administrative access. Normal application traffic uses HTTPS.

Kinovo is not end-to-end encrypted: authorised application services must process information to provide the workspace. No online service can guarantee absolute security. This limitation does not remove our legal obligations, and a service provider’s certification is not certification of Kinovo.

Protect your password and email account, secure your devices, review team access and check visibility before sharing. Report unexpected access, an incorrect recipient, a lost device or a suspected data breach promptly. Do not send passwords, identity documents or sensitive care records in the initial report.

We assess suspected incidents, take steps to contain and investigate them, and notify affected people and regulators where required by law, including the Notifiable Data Breaches scheme where applicable. We will explain practical protective steps where relevant. A privacy report is not an emergency response channel.

You can:

• Choose what optional profile information to provide and share only care information needed for the team’s purpose.
• Check item visibility and recipients before posting. Ask the Team leader to review membership or access if someone’s involvement changes.
• Manage available notification settings, turn off optional setup guidance, disable device notifications and unsubscribe from optional marketing separately.
• Keep Help improve Kinovo off, or turn it off later in Settings, without losing ordinary access.
• Export your account data from Settings → Account and data. Team leaders can also export an authorised workspace before archiving or deletion.
• Leave a workspace, request account closure or contact us about access, correction, consent withdrawal or deletion. These actions have different effects, as explained above.

Email privacy@kinovo.com.au with a description of the information or issue and a safe way to contact you. You do not need a Kinovo account to make a request about your personal information. An authorised representative can act for you; we may need to verify identity and authority using information proportionate to the request.

We aim to respond to access and correction requests within 30 days. If a request is complex, we will explain any delay and the next step. There is no fee to make a request or to correct information. If a lawful, reasonable charge for providing access is necessary, we will explain it before proceeding.

Access rights concern your personal information, not unrestricted access to another person’s account or an entire care-team workspace. Where permitted or required by law, we may redact another person’s information, provide an alternative form of access or refuse part of a request. We will explain a refusal and available complaint options unless the law prevents us from doing so.

Tell us if information is inaccurate, out of date, incomplete, irrelevant or misleading. Where appropriate, we can help correct it or associate a statement of disagreement if a requested correction is not made. We will consider reasonable steps to notify relevant recipients of a correction where required. You can ask us to assess deletion, but applicable law and necessary shared history may affect what can be removed.

Address a privacy complaint to Kinovo’s privacy contact at privacy@kinovo.com.au. Explain what happened, when, how it affected you and the outcome you are seeking, without attaching unnecessary sensitive information. We may ask for further details through an appropriate channel.

We will acknowledge the complaint, assess the relevant records and handling, and aim to provide a substantive response within 30 days. We will explain our findings, any action we propose and how to seek further review. If more time is needed, we will explain why and keep you informed.

If you are not satisfied with our response, or have not received a response within 30 days, you can contact the Office of the Australian Information Commissioner (OAIC). The OAIC can explain whether your complaint falls within its jurisdiction and how to lodge it. You can also exercise any other applicable legal or complaint rights.

• OAIC privacy complaint guidance

We review this statement as the service, providers and legal requirements change and publish a dated update here. For a material change affecting how we handle personal information, we will take reasonable steps to bring it to affected people’s attention, such as an email or prominent in-product notice, before the change where practicable.

An update does not itself supply consent for a new use that requires consent or remove rights relating to earlier handling. We will seek fresh consent where required. Contact us for a copy of this statement in another accessible format, help understanding it, or information about an earlier version.