Consumer health data, handled with care.

Kulaya can process the following categories when an eligible user chooses a Health, Nutrition, device, import, or related family feature during prelaunch testing:

• Health conditions and care. Allergies, symptoms or notes, vaccines, appointments, clinicians, medical specialties, sex, family health history, care reminders, and related family records.
• Labs and measurements. Lab test names, values, units, reference ranges, dates, notes, height, weight, and other measurements entered or imported by an authorized user.
• Nutrition and wellness. Meals, photos of food, calories, macronutrients, dietary preferences, nutrition goals, meal plans, activity, sleep, weight, and wellness routines.
• Device-health summaries. Daily summaries selected from Apple Health, Garmin, Samsung Health, or similar exports, such as steps, sleep, heart rate, heart-rate variability, respiratory rate, blood oxygen, active energy, distance, or workouts.
• Health-related files and communications. Selected photos, documents, voice transcripts, Calendar or email information, and text a user submits for a health or nutrition feature.
• Inferences. Health, nutrition, wellness, or family-care classifications and suggestions generated from information an authorized user provides.
• Related identifiers. The family member, account, device, session, date, source, and technical records needed to associate, secure, synchronize, or troubleshoot the information.

Kulaya does not create or use a faceprint, voiceprint, or other biometric identifier from an ordinary family photo or voice transcript for identification or authentication.

• you, the person the information concerns, or another authorized family member;
• a file, photo, document, voice transcript, device-health export, or connected service you select;
• Google Calendar, Gmail, or an internet calendar feed when an authorized user connects or imports it;
• a device, browser, or operating-system service used for a feature;
• an inference, classification, summary, or suggestion produced by a non-AI Kulaya feature; and
• service, security, support, or synchronization records generated while the feature operates.

Kulaya processes consumer health data only for the purposes described here:

• to provide the health, nutrition, meal, wellness, reminder, import, or family feature requested;
• to display information to the applicable person and authorized family members;
• to organize, classify, summarize, synchronize, and back up family records;
• to provide manual organization, calculations, summaries, and other non-AI features the user requests;
• to authenticate users, apply roles, secure the Service, prevent abuse, and troubleshoot failures;
• to respond to support, privacy, safety, and legal requests; and
• to comply with law and enforce the Terms of Use.

Kulaya does not use consumer health data for targeted advertising, data-broker activity, employment, credit, insurance eligibility, or an automated decision that produces a legal or similarly significant effect. Kulaya does not sell consumer health data.

Depending on the feature and the user's direction, health data can be disclosed to:

• Authorized family members. The applicable profile, record, or summary can be visible in the shared family space according to the person selected, the member's role, and the feature. An adult's authority to administer a family does not automatically authorize every use or disclosure of another adult's health information.
• Supabase. Account identifiers, family/member associations, entered health and nutrition records, saved summaries, files, access records, and related technical information for authentication, database, synchronization, and private storage.
• Vercel. Requests, IP address, device or browser information, route and error details, and content passing through server-side application features for hosting and delivery.
• OpenAI API. When an eligible adult with a current AI permission invokes a Health or Nutrition AI feature, Kulaya sends the health, meal, nutrition, family, image, document, or instruction needed for that request. AI permission does not replace health-data consent or another person's authority. Children and teens cannot use health or nutrition AI; their optional Learning helper receives no saved health records. Guest accounts cannot use AI. AI output is not medical advice.
• User-directed connected services. Google or another service when the user deliberately connects, imports, exports, or shares information through that service.
• Safety, legal, and business recipients. A regulator, court, adviser, successor, or other recipient when disclosure is legally required or reasonably necessary to protect people, investigate abuse, secure Kulaya, or complete a business transaction with appropriate safeguards.

The current core-provider list and processing purposes are maintained in our Service Provider and Connected Services List. No corporate affiliate currently receives consumer health data from Kulaya.

Google receives the automatic font-delivery request described in our provider list when Kulaya web pages load and operates across other websites. Apart from that automatic request and a connected or AI service a user deliberately invokes, Kulaya does not knowingly permit a third party to collect consumer health data through Kulaya over time and across unaffiliated websites or online services.

Roster fields such as allergies and dietary preferences can be visible to people who have access to the shared family roster. More detailed health modules can apply additional role restrictions. Review family membership before adding health information and do not rely on a family role as proof that another adult has legally authorized disclosure of that adult's health information.

A supervised child or teen login can view only the Health information permitted for that person's own profile and role, and cannot add, change, import, or synchronize Health records. In Nutrition, the person can log or delete only their own meal intake, but cannot create or change shared family meal plans, nutrition profiles, or another person's record. Health and nutrition AI are unavailable to supervised children and teens. Separate AI permission for a narrow Learning helper does not allow a protected record to be changed or an external Google service to be connected. An owner or parent administrator remains responsible for deciding whether the information is appropriate to place in the shared family space.

During controlled prelaunch testing, entering, importing, or saving information is the user's instruction to process it for the selected feature. Kulaya does not treat acceptance of the general Terms or Privacy Policy, AI feature availability, or a supervised-access authorization as blanket consumer-health consent or authority over another person. The current product does not yet provide the complete state-specific health-consent ledger required for public launch; where applicable law requires a separate consent, that requirement still applies.

Sharing consent, when required, must be separate from collection consent and must identify the categories of data, purpose, and categories of recipients. You may withdraw a consent and ask Kulaya to stop the affected future collection or sharing by emailing support@kulaya.app. Withdrawal does not make prior lawful processing unlawful, but it applies to future processing covered by the withdrawal.

Subject to verification and applicable law, you may request to:

• confirm whether Kulaya is collecting, sharing, or selling consumer health data about you;
• access that data and receive a list of third parties or affiliates to which it was disclosed;
• correct inaccurate health data;
• withdraw consent and stop further collection or sharing covered by the withdrawal;
• delete consumer health data from Kulaya and request downstream deletion where required; and
• appeal a refusal to act on a request.

Email support@kulaya.app with the subject “Consumer health data request.” Include the Kulaya account email, the person whose data is involved, the right requested, and enough detail to locate the information. Do not email health records or identification documents unless we specifically request a secure verification method.

We will authenticate the requester and authority over the relevant person. We respond within the period required by applicable law. Email is Kulaya's current request channel. Different laws use different response, extension, processor-deletion, and backup rules.

If we deny or do not act on a request, you may appeal by emailing support@kulaya.app with the subject “Privacy appeal” and explaining why the decision should be reconsidered. We will respond in writing within the period required by applicable law.

If an appeal is denied, the response will explain the reason and provide the contact information for the applicable state attorney general or other regulator when required.

Individual health and nutrition records can be deleted in the applicable Kulaya module. A verified person may also request deletion as described above. Deleting the account or shared family space can remove broader categories of data, but the effect depends on whether the requester owns or joined the family and whether another person's rights are involved.

Active health records are generally kept while the family uses the requested feature or until an authorized user deletes them. Limited security, support, legal, dispute, and backup records may remain when necessary and permitted by law. A verified health-data deletion request is handled under the downstream and backup rules of the applicable law; Kulaya will not treat a backup exception as permission to restore deleted information for ordinary use.

Kulaya uses safeguards designed for the sensitivity of health information, including encrypted network connections, authenticated access, technical access restrictions, private file storage, encrypted Google OAuth tokens, and access limits for service providers and personnel. No security measure eliminates all risk, and an account or family role is not a substitute for obtaining another person's authorization.

If an incident triggers the FTC Health Breach Notification Rule or another applicable breach law, Kulaya will notify affected people, regulators, and others in the manner and time required by law.

Kulaya's health, nutrition, wellness, and AI features are for general information and family organization. They are not intended to diagnose, treat, cure, or prevent disease and are not a substitute for professional medical advice. Do not use Kulaya for an emergency. Call 911 in the United States or the appropriate local emergency service.

Unless Kulaya separately agrees in writing, it is not providing the Service for or on behalf of a HIPAA covered entity and is not acting as a HIPAA business associate. Other consumer-health and privacy laws can still apply.

We will not materially expand the categories, purposes, or recipients of consumer health data without providing the additional notice and obtaining the consent required by applicable law. The date at the top identifies the current version.