Introduction
This notice supplements our Privacy Policy and is designed to align with consumer health privacy laws including the Washington My Health My Data Act and similar state-level frameworks that have followed its lead. Kira ASI Inc is a productivity platform and not a healthcare provider. We are not a HIPAA covered entity, and this notice is not a HIPAA disclosure. It is a dedicated explanation of how we handle a specific and sensitive category of information that can appear naturally in the content you create while using the platform.
We are publishing this as a distinct, standalone notice rather than folding it quietly into our general Privacy Policy for a specific reason. Laws like Washington's explicitly expect this kind of information to be presented separately and clearly, not buried inside a longer document covering many unrelated topics where someone specifically concerned about health-adjacent data would have to read through sections that do not apply to their question before finding the one that does. If you are looking for a complete and dedicated answer to how Kira handles health-related information, this page is it.
What We Mean by Consumer Health Data
Consumer health data is defined more broadly under laws like Washington's than most people expect when they first encounter the term, and it is worth walking through that scope carefully rather than assuming it only covers clinical diagnoses, medical records, or information explicitly labeled as health-related.
The category includes information that could identify your past, present, or future physical or mental health status. But it extends considerably further than that. It also covers bodily functions, biometric information, and precise location data that could reveal an attempt to seek health services, a location signal near a specific kind of clinic or pharmacy, for example, even when no explicitly health-related text is attached to that location data at all.
The part that surprises most people is that this category also includes data that is merely inferred from other information, even information that was not health-related on its own. If a pattern in your calendar entries, your notes, your meal plans, or your messages allows a reasonable inference about your health status, that inference itself can qualify as consumer health data under the law, regardless of whether you ever explicitly wrote down anything about your health directly.
You might include this kind of information in content you create inside Kira without necessarily intending to and often without realizing it falls into this specific legal category. A calendar event near a medical facility. A note about a dietary restriction. A message referencing a medication. None of these feel like health disclosures in the moment, but they can fall within the legal definition of consumer health data depending on what information they contain or what inferences they make possible.
We do not require health information to use Kira, and we have not designed any feature specifically to capture it. But because Kira works with the actual content you create across email, calendar, notes, and other areas of the platform, this category of information can appear incidentally as a natural byproduct of how the product is used.
How We Collect This Information
Any consumer health data that appears within Kira comes directly from you, through the content you create, upload, or generate while using the Services. It arrives through the same channels as everything else you put into the platform. There is no separate health-specific collection mechanism we have built, and there is no background data collection happening outside of your direct use of the product.
We do not purchase, license, or otherwise acquire consumer health data about you from third-party sources, data brokers, or public records. We have no relationship with any data broker that would make that kind of acquisition possible even if we wanted to pursue it.
This matters because a significant category of privacy risk under laws like Washington's comes specifically from data brokers aggregating health-adjacent signals from multiple sources without a consumer's knowledge or meaningful ability to prevent it. That risk profile does not apply to how Kira operates. Our only source for this kind of information is what you yourself put into the platform while using it.
How We Use It
Consumer health data that appears in your content is used in the following ways and no others:
- To provide the specific features you have asked for, such as drafting a message that references health-related content, organizing a note, or building out a calendar entry. The feature works with the content you have provided to do what you asked it to do.
- To operate, secure, and support the service in the same way we use all data necessary to keep the platform running reliably and safely.
- We do not use your content, including any health-related content that appears within it, to train our AI models unless you have explicitly opted in to that. This commitment applies to consumer health data with the same force it applies to everything else you create in Kira.
Consent
We collect and process consumer health data only as needed to provide the features you have specifically requested, or with your specific and informed consent for anything beyond that scope.
Consistent with the standard established by laws like Washington's, consent here means a clear and affirmative opt-in action taken by you with full awareness of what you are agreeing to. It is not something obtained by bundling it into a broad Terms of Service acceptance that covers dozens of other topics simultaneously. It is not inferred from passive behavior like continuing to use the product, closing a notification without responding to it, or failing to opt out of something before a deadline you may not have noticed.
This is a meaningfully higher bar than how the word consent gets used in many privacy contexts, and we think it is the right standard given how sensitive this specific category of information is and how much the law has moved in the direction of requiring genuine informed agreement rather than passive non-objection.
You may withdraw consent at any time by contacting support@kiraai.ai. Withdrawing consent does not affect the lawfulness of anything already processed before the withdrawal, but it does mean we stop any further processing that depended specifically on that consent going forward from the point you withdraw it.
No Sale of Health Data
Kira does not sell consumer health data under any circumstances, and we do not share it for cross-context behavioral advertising. This is an unconditional commitment, not a default setting that could be changed by a buried account option.
We also do not engage in geofencing around healthcare facilities or similar locations for data collection purposes. This specific practice is explicitly prohibited under laws like Washington's precisely because it can reveal sensitive health-seeking behavior through location signals alone, without a person ever explicitly disclosing anything about their health. Collecting data that way would undermine the entire principle behind consumer health privacy protection, and it is not something Kira does or will do.
Your Rights
You have the following rights over consumer health data associated with your Kira account:
- Access. You can request access to the consumer health data associated with your account to understand what information of this kind exists within our systems.
- Deletion. You can request deletion of your consumer health data, subject to limited legal exceptions that may prevent deletion in specific circumstances.
- Withdrawal of Consent. Where consent is the basis for processing, you can withdraw that consent at any time as described above.
The deletion right under laws like Washington's goes further than most people expect, and it is worth explaining specifically rather than leaving it as a general statement. If you request deletion of your consumer health data, we do not simply remove it from our own systems and consider the obligation fulfilled. We also notify any processor or third party who received that data on our instruction and direct them to delete it as well. This passthrough obligation means the deletion follows the data rather than stopping at the edge of our own systems. Here, that follow-through is our responsibility, not yours.
To exercise any of these rights, contact us at support@kiraai.ai. We respond within the timeframes required by applicable law. We will not require you to create a new account solely to exercise these rights if you already have an existing Kira account, consistent with the specific protection that laws like Washington's build in against that kind of unnecessary friction being used to discourage rights requests.
Security
Consumer health data is protected with the same security measures described on our Security and Compliance page. This includes encryption in transit using TLS 1.2 or higher, encryption at rest using AES-256, least-privilege access controls that limit who within our team can access what, and continuous monitoring of our systems.
There is no separate or lesser security standard applied to this category of information simply because it is discussed on its own dedicated notice. The full security posture described elsewhere on the site applies here in full, because information that falls within the consumer health data definition deserves at least as much protection as everything else on the platform, not a different standard arrived at separately.
References
Frequently asked questions
Quick answers to common questions.
No. Kira is a productivity platform, not a healthcare provider, health plan, or healthcare clearinghouse, so HIPAA generally does not apply to our operations. That said, any health-related content you create inside Kira is protected with the same security measures we apply to all data on the platform, regardless of whether HIPAA technically requires it.
No, under any circumstances. We do not sell consumer health data, we do not share it for cross-context behavioral advertising, and we do not collect it through geofencing or location-based tracking around health facilities. These are unconditional commitments, not configurable defaults.
No, not unless you have explicitly opted in to contributing your content for that purpose. This applies to health-related content with the same force as everything else you create in Kira.
More than most people initially assume. It includes clinical information, but also bodily functions, biometric data, and precise location information that could reveal health-seeking behavior. It also includes information inferred from non-health data if that inference reveals something about your health status. The scope is intentionally broad under laws like Washington's, and we apply that broad definition rather than a narrower interpretation that would be easier to comply with but less protective of your actual interests.
We delete it from our own systems and notify any processor or third party who received it on our instruction, directing them to delete it as well. The obligation does not stop at the edge of our own systems. Following through on deletion wherever the data went is our responsibility, not something we leave to you to manage separately.
No. If you already have an existing Kira account, we will use that to verify your identity and fulfill your request. Requiring a new account as a condition of exercising privacy rights is specifically prohibited under laws like Washington's, and it is not something we would do regardless.
Because laws like Washington's specifically expect consumer health data information to be presented as a distinct, standalone notice rather than folded into a longer general document where it would be easy to miss. We think that separation genuinely serves you as well, because it means anyone specifically concerned about health-adjacent data can find a complete and dedicated answer without reading through sections covering entirely different topics first.