Plain-English summaries, with the detail underneath. This page describes how KareGO is designed to meet leading privacy regimes. It is provided for transparency and is not legal advice; for organisational agreements (DPAs/BAAs) contact us directly.
1. Our approach to compliance
Privacy by design first; compliance is the floor, not the ceiling.
We engineer privacy in from the start rather than bolting it on. Our zero-knowledge architecture means many risks the law is designed to mitigate simply cannot occur with your encrypted records. On top of that foundation, we maintain documentation, data-protection impact assessments, vendor due diligence, and regular reviews so we meet — and aim to exceed — the requirements of the GDPR/UK GDPR, HIPAA (where applicable), and US state privacy laws.
2. GDPR / UK GDPR
For consumer accounts we are the controller; health data is processed on an explicit lawful basis.
Where the EU or UK GDPR applies, Lumivant LLC acts as data controller for the personal data of our users. We process special-category health data only on a valid Article 9 basis (typically your explicit consent, or to protect vital interests in an emergency). We apply data minimisation, purpose limitation, storage limitation, integrity and confidentiality, and accountability. Where we process data on behalf of an organisation, we act as a processor under a Data Processing Agreement (DPA), which we are happy to provide.
3. Your GDPR rights
Access, rectify, erase, restrict, object, port — plus withdraw consent.
- Access — get a copy of your personal data.
- Rectification — fix inaccurate or incomplete data.
- Erasure — delete your data ("right to be forgotten").
- Restriction — limit how we process data in certain cases.
- Objection — object to processing based on legitimate interests.
- Portability — receive your data in a portable format or have it transmitted onward.
- Withdraw consent — at any time, without affecting prior lawful processing.
- Automated decisions — we do not subject you to legally significant decisions based solely on automated processing.
4. HIPAA
When we handle PHI for a covered entity, we sign a BAA and apply HIPAA safeguards.
Where KareGO handles Protected Health Information (PHI) on behalf of a HIPAA covered entity (such as a clinic or health system), we are prepared to act as a Business Associate and enter into a Business Associate Agreement (BAA). In that role we apply the administrative, physical, and technical safeguards required by the HIPAA Security Rule, restrict uses and disclosures per the Privacy Rule, and follow the Breach Notification Rule. To request a BAA, contact privacy@karego.ai.
Note: when you use KareGO as an individual to store your own records, that consumer relationship is generally governed by our Privacy Policy and applicable consumer-privacy laws rather than HIPAA, which applies to covered entities and their business associates.
5. CCPA / CPRA & other US state laws
We don't sell or "share" your data, and you have full rights regardless.
For residents of California and other US states with comprehensive privacy laws, you have the right to know what personal information we collect, to access and delete it, to correct it, and to limit the use of sensitive personal information. We do not sell your personal information and do not "share" it for cross-context behavioural advertising, so there is nothing to opt out of on that front — but you may still exercise all of your other rights. We will not discriminate against you for exercising them.
6. Making a data request
Email us; we verify identity; we respond within legal timeframes.
To access, correct, export, or delete your data, email privacy@karego.ai or use the controls in the app. We verify your identity before acting and aim to respond within the timeframes required by law — generally within one month under GDPR (extendable for complex requests) and within 45 days under applicable US state laws. Authorised agents may submit requests with proof of authorisation.
7. Transfers & safeguards
SCCs and equivalent safeguards keep protection intact across borders.
For international transfers of EU/UK/EEA personal data, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, supported by transfer risk assessments. Details are available on request.
8. Breach response
Detect fast, notify the right parties within legal deadlines.
We maintain a documented incident response process. In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the competent supervisory authority and affected individuals without undue delay, consistent with GDPR (including the 72-hour authority notification where applicable), HIPAA's Breach Notification Rule where relevant, and US state breach-notification laws.