Consumer health data privacy

What health data we collect

• Blood type.
• Allergies, medications, and medical conditions — free text you write yourself.
• Implants and devices, such as a pacemaker or metal hardware.
• Whether you take blood thinners.
• Organ donor status.
• Your weight, if you enter it.
• Free-text notes you choose to add.
• Health insurance details you choose to add: provider, member number, and an insurer phone line.

Where it comes from

From you, typed into your own dashboard, and from nowhere else. We do not buy it, receive it from a data broker, infer it, or import it from a clinic, an insurer, a pharmacy or a device. There is no other source.

Why we collect it

To show it to whoever scans your tag after a crash — that is the entire purpose of this service and there is no second one. We do not use it for advertising, for profiling, for research, for training any model, or for anything that could be described as a product improvement. It is not analyzed. Nobody at KINTAG reads it in the ordinary course of running the service.

What is shared, and with whom

We never sell your health data. Under Washington law, selling consumer health data requires your signed authorization; we do not ask for one because we do not sell it, and we will not.

It is SHARED in exactly one way, and you control it: the fields you switch on in your Privacy settings are shown on your public tag page to whoever scans your QR code. That page is a public web address. Every field starts off. Switching one on is you publishing it, deliberately, because a stranger holding your phone after a crash needs it.

Until September 12, 2026 some fields could not be shown to a scanner at all, whatever you switched on — your weight, your date of birth, your full insurance member or policy number. They can be now, and only if you switch each of them on yourself. They start off, they are grouped on their own on the Privacy page, and the page says beside them that they identify you rather than help treat you. Your weight is the one with a clinical reason to be there: doses are sized by it.

Beyond that, the only parties that touch it are our own infrastructure: the hosting provider that runs our database, and nobody else. It is encrypted there — see below. Our email provider never receives it. The bot-check provider never receives it, and never runs on the page a rescuer opens. We share it with no affiliate, no advertiser, no analytics service, no insurer, and no government body except where the law compels us and we are able to tell you.

How it is protected

Every health field in this list is encrypted in the database itself with AES-256-GCM, tied to your record so it cannot be moved to someone else's, under a key that is not stored with the data. What that defeats, precisely: someone who obtains the database alone — a stolen backup or snapshot, or over-broad access at our hosting provider. What it does not defeat: our own server, which has to be able to decrypt, because your tag has to open for a stranger with a phone and no key. We would rather say that plainly than imply a protection we do not have.

Your rights over it

All of these are self-serve, which is deliberate: a right you have to ask us for is a right that depends on us answering. If you want to exercise one another way, or you believe we have got something wrong, write to us through the contact form. We will answer within 45 days, and if we refuse a request you can ask us to reconsider by replying to that answer. The privacy notice sets out how we check that an account is yours before acting on a request that did not come from inside it.

• Withdraw consent: turn any field off in your Privacy settings, or delete the field's contents in your dashboard. Both take effect immediately.
• Delete: erase your account and every health field with it, from your Privacy settings, in one click. It is a real delete, not a hidden flag — see the privacy notice for what that means for backups.
• Access: download everything we hold, health data included, as a JSON file from the same screen.
• Correct: edit any field in your dashboard, at any time.

How long we keep it

We keep it while your account exists and not one day longer than that. There is no separate clock for health data and no archive of it: deleting your account deletes every field on the list above, in the database, at the moment you press the button.

The one thing that outlives that is a backup, as it is for everything else we hold. A deleted account survives in ours for at most 30 days and then it is gone. Backups are never used to bring an account back; if we ever restore one after a failure, the deletions are re-applied first. And what a backup holds of your health data is the same ciphertext the database holds — the key that opens it is kept somewhere the backups are not.

Consent

When you register you tick a box, separate from accepting our terms, agreeing that KINTAG may store the health details you enter. That box is the consent this policy is about; the terms and the privacy notice are accepted by a different box, and neither is bundled with the other. Your account records which version of this policy you accepted.

What we never do

• We never sell health data, to anyone, at any price.
• We never use it for advertising or share it with advertisers.
• We do not use geofencing around hospitals, clinics, pharmacies or any other health facility, for any purpose.
• We do not build profiles, infer conditions you did not type, or enrich what you gave us from any outside source.

Changes

If we change this policy materially we will publish a new version here. Your account records the version you accepted.

Contact

Questions or requests about health data: write to us — show our address.