Trust Center

1. Five claims, and where to verify them

Your health records are stored in the United States.

Hosted by DigitalOcean in the United States. Encrypted at rest, with end-to-end encryption of health content, and encrypted backups in the same region.

→ Data Protection, Security

Exactly one company receives your health data: our hosting provider.

We use six external providers in total. The other five receive an email address, a crash trace, or a subscription identifier — never your medical records.

→ Data Protection, section 4

Our AI runs on our own servers.

Your records are never sent to OpenAI, Google, Anthropic or any external AI provider. This is expensive and it is the point.

→ Data Protection, section 1

There is no advertising business here, so there is nothing to profile you for.

We are funded by subscriptions. No advertising SDKs, no retargeting pixels, and no sale of health data. Website analytics on karego.ai is optional and only runs if you consent — see our Cookies Policy.

→ Cookies Policy

Deletion means deletion.

Removed from live systems immediately, gone from every backup within seven days. One step, no retention maze.

→ Data Protection, section 6

2. Why the business model is the real guarantee

Promises are cheap. Incentives are not.

Most health apps are free, which means the user is not the customer. Somewhere in the model there is an advertiser, a data broker, an insurer, or an acquirer buying the dataset. Those companies are not lying when they say they care about privacy — they simply have a structural reason to erode it, and structures win over intentions eventually.

Karego charges a subscription. You are the customer. If we mistreat your data, we lose revenue rather than gain it. That alignment is not virtue on our part; it is the only arrangement we would trust ourselves with.

It also means we can make commitments that a company with an advertising business could not survive keeping.

3. Commitments that do not expire

These bind us permanently, and they bind any future owner of Karego.

• We will never sell or share your health data with advertisers, brokers, insurers or employers.
• We will never show you advertising, or use your health data to target you with anything.
• We will never make deletion difficult or use retention dark patterns.
• We will never hold your medical records behind a paywall. If your subscription lapses, you keep access to your data and can export or delete it at no cost.
• We will never change how we use your data without telling you first, in advance, in plain language.
• If we ever shut down, you get 90 days' notice, a full export, and a refund of any unused subscription.

4. What we do not claim

An honest trust page has to include this, or the rest of it means less.

We have not been independently audited. No third-party security certification, no completed penetration test, no external accessibility audit. We intend to commission them and we will publish the results — including the failures. Until then, you have our description of our practices, not an outsider's verification of them.

We are a very small company. That has advantages: no bureaucracy between a problem and the person who can fix it. It also has real limits, and pretending otherwise would be the first dishonest thing on this page.

Our AI makes mistakes. It misreads numbers, mistranscribes drug names, and can be confidently wrong. Everything it produces needs checking with a clinician. Karego organises and explains your health information. It does not diagnose, treat, or replace a doctor.

Some risks are outside our control. Your unlocked phone. A reused password. A Medical ID link you shared and cannot recall. We name these on the Security page rather than leave you to discover them.

5. Transparency report

Updated quarterly. Current as at 1 August 2026.

Our position on legal requests: we will comply with valid, binding legal orders. We will challenge orders we believe are unlawful or overbroad. Where we are permitted to tell you, we will. We will report the numbers here whether they are flattering or not.

We also intend to publish the results of our quarterly user trust survey, including when the number moves against us. A trust metric only published when it is good is not a trust metric.

6. How to hold us to this

• Ask us anything about how your data is handled: privacy@karego.ai. A named person answers — Data Protection, section 2.
• Report a security flaw: security@karego.ai. We will not pursue researchers acting in good faith — Security, section 11.
• Report an accessibility barrier: accessibility@karego.ai. We will help you directly while we fix it.
• Complain to a regulator without going through us first — your national data protection authority in the EU, or the ICO in the UK.
• Take your data and leave, at any time, in a machine-readable format, whether or not you are a paying subscriber.

The last one is the most important. A company that makes leaving easy has to earn your staying.

7. Every document, in one place

8. What Karego is for

Karego is the place you keep your health, organised and explained. Not a medical advisor. Not a replacement for your doctor. A custodian that happens to be intelligent.

We are building for people who will still be using this in twenty years — through moves between countries, changes of doctor, and the illnesses none of us plan for. That timescale is the reason for every constraint on this page. A company optimising for the next eighteen months would make different choices, and you would be right not to trust it with this.

9. Contact

Privacy and data protection: privacy@karego.ai

Security: security@karego.ai

Accessibility: accessibility@karego.ai

Licensing and IP: legal@karego.ai

Everything else: support@karego.ai