Security

1. Where your data lives

All KareGO account data and health data is stored on servers in the United States. Encrypted backups are held in the same region.

The complete list of companies that process any of your data — and what each one receives — is published on our Data Protection page.

2. Encryption

In transit. All communication between the KareGO app and our servers uses TLS over HTTPS.

At rest. The database and all backups are encrypted at rest.

Passwords. Your password is stored only as a cryptographic hash. We cannot read it, cannot recover it, and cannot tell you what it is. If you forget it, you reset it — nobody at KareGO can look it up.

2.1 What this means in practice

Encryption in transit and at rest means a stolen disk or backup does not yield readable records. Our servers do process your data to provide KareGO's features, which is why access to them is tightly limited and logged (section 5).

Encryption does not remove every risk. Your unlocked phone, a reused password, a Medical ID link you share, or anything you export yourself still sit outside that cryptographic guarantee. Section 10 names those plainly.

3. Your account

• Authentication uses signed JWT access tokens with limited lifetimes. Sessions expire and must be re-established.
• Password resets are sent to your registered email address and expire after a short window.
• Permissions on your device — camera, microphone, photo library, location, health data, notifications — are requested individually, only when a feature needs them, and can be revoked by you at any time in your device settings. KareGO continues to work with any of them switched off; only the specific feature stops.
• Apple Health and Android Health Connect access is read-only. KareGO never writes to your health data on your device.

4. Connected health records

If you connect a US health insurer, provider or the national health information exchange:

• You sign in with that organisation, or verify your identity with CLEAR, ID.me or Persona, in a secure browser window run by your phone's operating system. KareGO never sees or stores your password for those services.
• The connection is made through Flexpa (Flexpa USA Inc.). KareGO's app never receives the access tokens; they are held only on our servers, encrypted with AES-256-GCM using a key reserved for this purpose, and tied to your connection so they cannot be reused for another account.
• Imported records are checked against your name and date of birth. Records for other people on your plan, such as a spouse or children, are discarded and never stored.
• You can disconnect any source at any time. We revoke access at Flexpa straight away, delete the stored tokens and ask Flexpa to delete its copy.
• Every connection, import and disconnection is recorded in our audit log.

5. Who at KareGO can access data, and when

• Our servers process your health data to provide KareGO's features. Staff access to production systems is the exception, not the rule.
• Access to production systems (for account operations, infrastructure and encrypted data management) is limited to a small number of named personnel with a specific operational need.
• Administrative access requires multi-factor authentication.
• Access to production systems is logged and reviewable.
• Everyone with access is under binding confidentiality obligations.
• Consent actions and access events are recorded in a server-side audit log.

Infrastructure access happens for two reasons: investigating a fault a user has reported, and responding to a security incident. It does not happen for analysis, product research, curiosity, or any commercial purpose — and every access is logged.

6. Backups and recovery

Backups are encrypted and stored in the same United States region as your primary data. We operate a rolling 7-day window.

A short window is a deliberate trade-off. Longer retention makes recovery easier for us and means deleted medical data survives for months after someone asked us to destroy it. Seven days is enough to recover from genuine failure and short enough that deletion means what it says.

When you delete your account, your data is removed from live systems immediately and disappears from backups within seven days.

7. AI infrastructure

KareGO's text model, vision model and speech recognition run on our own servers in the United States.

This matters for security as much as for privacy. Every external AI API call would be a copy of your medical record leaving our infrastructure and entering someone else's, subject to their retention, their logging, their staff and their breaches. We eliminated that category of risk by not making the call.

8. Application security

• Third-party dependencies are kept current and monitored for known vulnerabilities.
• Changes to production code are reviewed before release.
• Credentials and secrets are held in managed configuration, never in source code.
• Uploaded files are validated before processing.
• The app checks the patient name on uploaded documents against your profile, and imported records against your name and date of birth, reducing the risk of another person's records entering your account.

9. What we deliberately do not have

Some of the strongest security decisions are subtractions. KareGO contains:

• No advertising SDKs. Advertising libraries are among the most common sources of data leakage in mobile apps.
• No tracking of your health data. We use Google Firebase Analytics only if you opt in, to count which app screens and features are used. It never receives your health records, documents, AI conversations or anything you type, and it is off until you agree.
• No data enrichment or identity resolution services.
• No external AI provider.
• No third-party tracking in our emails. No pixels, no open tracking.

Each of these is a company that never receives your data, an integration that cannot be breached, and a contract that cannot be changed by an acquirer.

10. The risks we cannot remove

An honest security page has to include this section.

Your device. If someone has your unlocked phone, they have your medical history. No server-side control prevents this. Use a device passcode or biometric lock.

Your password. If it is reused from a site that has been breached, your KareGO account is exposed. Use a unique password.

Your share link. The Medical ID card public link works for anyone who has it. Once shared, it can be forwarded, screenshotted or saved. You can revoke it, but you cannot recall what has already been seen.

What you export. Anything you print, export or send leaves our protection entirely.

Your connected accounts. Anyone who can open your KareGO account can also see the health plan, claims and records you have imported. Disconnecting a source stops future updates; it does not remove what was already imported unless you delete it.

Errors in source records. Imported records are shown as your insurer or provider sent them. If their records are wrong, ours will be too.

Software has defects. Ours will too. What we can promise is that we look for them, that we fix them quickly, and that we tell you honestly when one has mattered.

11. What you can do

1. 1Use a unique, strong password. A password manager makes this easy.
2. 2Lock your device with a passcode or biometric.
3. 3Share the Medical ID link deliberately, and revoke it when it is no longer needed.
4. 4Review your Medical ID card regularly. An out-of-date allergy list is a clinical risk, not just a data one.
5. 5Be careful with recordings. They may capture other people, and recording a clinician without consent is unlawful in some countries.
6. 6Contact us immediately at security@karego.ai if you think your account has been accessed by someone else.

12. Responsible disclosure

If you have found a security flaw in KareGO, we want to hear from you.

Contact: security@karego.ai

Our commitments to you

• We will acknowledge your report within 2 business days.
• We will give you an assessment and a remediation plan within 10 business days.
• We will keep you informed until the issue is resolved.
• We will credit you publicly if you would like us to, and respect your preference if you would not.
• We will not pursue legal action against you if you act in good faith and follow the guidelines below.

What we ask of you

• Do not access, modify or delete data belonging to any other user. If you can demonstrate a flaw with your own account, do that.
• Do not degrade the service, run denial-of-service tests, or send spam.
• Do not attempt social engineering against our staff or providers.
• Report the issue promptly and give us reasonable time to fix it before disclosing publicly.
• Do not exploit the flaw beyond what is necessary to demonstrate it.

We do not currently operate a paid bug bounty programme. We will say so honestly rather than imply otherwise, and we treat every report seriously regardless.

13. If something goes wrong

Our incident procedure

1. 1Contain — isolate affected systems and stop ongoing exposure.
2. 2Assess — establish precisely what data was involved, how many people, and the real risk to them.
3. 3Notify the supervisory authority within 72 hours of becoming aware, where UK or EU data protection law applies and the breach is likely to result in a risk to people's rights and freedoms.
4. 4Notify affected users directly and promptly where the risk to them is high.
5. 5If you are in the United States, we also notify affected users, and the Federal Trade Commission where required, under the FTC Health Breach Notification Rule and applicable state laws, no later than 60 calendar days after discovery.
6. 6Remediate and account publicly for what happened.

What we will tell you: what happened, when, what data was involved, the realistic risk to you, what we have done, and what you should do — in plain language, quickly, without minimising it and without waiting until we have a comfortable version of events.

We would rather publish an uncomfortable, accurate account early than a reassuring one late.

14. Training and credentials

Security at KareGO is not only infrastructure. The people who operate it complete formal training. This badge records completion of the Information Security Manager Course issued by National Cyber Security Centre training (mokymai.nksc.lt).

It is a cyber hygiene credential: a small certificate confirming the course was finished successfully. Issued 21 January 2026. Valid for one year from the issue date (365 days).

Criterion: completion of the SCORM package *Information Security Manager Course 2026*.

15. Contact

Security reports and vulnerability disclosure: security@karego.ai

Data protection: privacy@karego.ai

General support: support@karego.ai