Understand who can access your care-team information.

Kinovo uses several layers of controls to support private care coordination. Each has a particular purpose. Their effectiveness also depends on correct configuration, maintenance, the security of connected services and the way people use the workspace.

The participant or an authorised representative directs the workspace, and Team leaders manage membership and available permissions. A professional account does not automatically open every participant’s information. Access depends on the specific team and item. Receiving a notification and having permission to view an item are separate things.

Team members must have authority to use the information they access and respect the confidentiality requirements of their care team. A confidentiality agreement sets expectations; it cannot technically prevent screenshots, copying, photographs or a person sharing something they have seen. Removing access prevents future authorised requests but cannot recall existing copies.

Authorised Kinovo personnel and service providers may need access to information to operate the service, provide support, investigate an incident or meet legal obligations. Kinovo does not promise that only invited team members can ever access information. Relevant access should be limited to the purpose and information reasonably needed.

Kinovo is responsible for its application controls and operating practices. Infrastructure providers operate their services, and care-team members are responsible for their own authority, devices and handling of information. Those responsibilities do not remove Kinovo’s obligations under applicable law.

Kivo works within the care-team access a person already has. Team leader approval and each member’s choice are separate controls. Answers and drafts need human review, and changes are saved through Kinovo’s usual permissions and workflows.

Kinovo uses Supabase for database, authentication and private file storage; Fly.io for application hosting; Amazon Bedrock for optional Kivo AI processing; Daily for embedded video and audio calls; Resend for email; and Cloudflare Turnstile for bot protection. Optional device notifications also use the relevant browser or operating-system push service.

Embedded calls use Daily to connect audio, video and any screen sharing you choose. Kinovo sends the meeting-room and participant identifiers and your display name needed to join. The current meeting feature does not enable call recording, saved transcripts or AI processing. Meeting agendas and manually written notes are separate workspace records with their own visibility.

Our primary application hosting on Fly.io and care-workspace database, authentication and private file storage on Supabase are configured in Sydney, Australia. Email, video-call infrastructure, provider support and other supporting operations may process information in other countries. We do not describe Kinovo as Australian-only data hosting. The Privacy Statement identifies current providers and explains overseas processing in more detail.

Kinovo is not end-to-end encrypted. Authorised application services must process information to provide the workspace, so protected connections should not be confused with a system where only participants hold decryption keys. We do not make an all-systems or all-connections encryption guarantee.

A provider’s security certification applies to that provider’s assessed services and controls. It does not certify Kinovo or replace our responsibility for the application, permissions and operating practices.

Leaving a care team, archiving a record and deleting information have different effects. Leaving ends access to that workspace; it does not erase shared contributions. Archiving preserves an authorised read-only record. Scheduled deletion and account closure have a 30-day cancellation period before permanent deletion processing, with completion dependent on verified cleanup.

Backups and legal or security holds can affect when all retained copies are removed. A backup is not a promise that every file, version or point in time can be restored. Read the retention and deletion section of our Privacy Statement for the applicable distinctions and how to request help.

Maintenance, faults, security incidents and provider outages can affect access. We do not promise uninterrupted service, a fixed recovery time or recovery of every record. Keep separate access to essential care instructions and contacts, and retain records required by your professional or legal obligations.

Kinovo supports coordination; it is not a medical record, emergency service or substitute for clinical, safeguarding or business-continuity arrangements. Messages, reminders, read indicators and task statuses do not guarantee delivery, understanding or action. In an emergency in Australia, call 000; for other urgent care concerns, contact the responsible person directly.

A few deliberate choices help the workspace controls do their job:

• Protect your account. Use your own login and a unique password, secure the email account used for sign-in, keep devices updated and sign out on shared devices. Never send someone your password, reset link or sign-in code.
• Check the person and the invitation. Verify an unexpected request through a contact method you already trust. An invitation, account label or profile is not proof of a person’s identity, qualifications or legal authority.
• Review membership as circumstances change. Team leaders should check recipients and roles before inviting people, review access when someone’s involvement ends and arrange any necessary handover.
• Share only what is needed. Confirm the workspace and available visibility setting before posting. Avoid unnecessary sensitive details in titles, support requests and notification-visible text. Do not upload passwords or payment-card details.
• Treat files and copies carefully. Private storage is an access control, not proof that an uploaded file is harmless or accurate. Do not assume every file has been malware-scanned. Verify unexpected files or links with the sender and protect copies you download.
• Use notification choices thoughtfully. Device previews use generic wording, but they may still reveal that you use Kinovo. Adjust notification settings and lock-screen previews for your circumstances; do not rely on notifications for urgent care.

Contact us if you notice unexpected access, a suspicious invitation, information shared with the wrong person, a lost device that could expose your account, or a possible weakness in Kinovo. You do not need to prove a breach before reporting a concern.

Include what happened, approximately when, the affected page or feature, and a safe way to reply. Use a description or redacted screenshot where possible. Do not include passwords, access tokens, full invitation links, identity documents or care records in the initial email. If sensitive evidence is necessary, ask us to arrange an appropriate way to receive it.

We assess reports, investigate the relevant facts and take proportionate steps to contain and address confirmed issues. Where required by law, we notify affected people and regulators, including under the Notifiable Data Breaches scheme where it applies. We may need to limit the detail we share to protect other people, an investigation or the service.

This reporting channel is not an emergency service or a continuously monitored care channel. We do not promise a particular response or resolution time. While waiting, take appropriate steps within your control to protect your account and contact the relevant care provider or emergency service directly if someone may be at risk.

If you believe you have found a technical vulnerability, use the security contact above. Provide the affected feature, a concise description, minimal reproduction steps using accounts and data you are authorised to use, and the possible impact. Do not send secrets or real care-team content as proof.

Do not access or change another person’s information, bypass permissions, disrupt the service, send phishing messages or continue testing once you encounter real private data. Stop and report it. Ask for written agreement on scope before carrying out security testing; this page does not itself authorise testing or establish a bug-bounty programme.

Please give us a reasonable opportunity to investigate and address a report before publishing technical details, and avoid disclosing personal information. This request does not restrict lawful reporting to a regulator or exercising a legal right.

This page describes safeguards and practical boundaries for Kinovo’s current service. It is not an independent security audit, certification, service-level agreement or promise that every risk has been eliminated. No online service can guarantee absolute security, and the presence of a control does not guarantee it will prevent every incident.

Kinovo does not claim NDIS approval, NDIS certification, HIPAA compliance or a Kinovo SOC 2 certification. Using Kinovo does not itself establish that a professional or organisation has met its own regulatory, clinical, recordkeeping or contractual requirements.

Kinovo remains an alpha-stage product. If your organisation requires a particular control, assurance report, retention arrangement or contractual service level, contact us to confirm what is actually available before relying on it. Future plans are not current safeguards, and this page does not offer a guarantee of suitability for every use.

We update this information as relevant practices change. The date above identifies this page revision, not the date of an independent audit. These explanations do not exclude rights, remedies or responsibilities that cannot be excluded under Australian law. Our Privacy Statement explains information handling and rights, and our Terms of Use explain the service agreement.