Your information,
handled with care.

Who we are

Kinto is provided by [Legal entity name — TODO] (“Kinto”, “we”, “us”). [Company number, registered office address and ICO registration number — TODO].

This policy covers:

• the Kinto apps for iPhone and Android, where people talk with Sarah;
• the kinto.you website, including the “Talk to Sarah” voice demo;
• the Kinto care workspace used by care homes and care teams; and
• conversations with Sarah through any other channel we offer, such as WhatsApp.

Questions about this policy can go to support@kinto.you.

Controller or processor

Who is responsible for your information depends on how you use Kinto.

• When a care provider uses Kinto (for example, a care home recording residents’ care notes, medicines and observations), the care provider decides what is recorded and why. The care provider is the controller of those records and Kinto acts as its processor, handling the information only on the care provider’s instructions and under a data processing agreement. If you are a resident, a relative or a member of staff and have a question about these records, the care provider is usually the best first contact; we will help them respond.
• When you use Kinto directly — for example, you create an account, talk to Sarah in the app or on our website, or sign in to the care workspace — Kinto is the controller of your account information and your conversations with Sarah.

What we collect

We do not use advertising, and we do not sell personal information. The website and apps do not use analytics or tracking tools.

Sarah and our AI providers

To understand you and reply, Sarah sends the conversation — together with the context she needs, such as what she remembers about you and, for residents, relevant details from their profile — to an AI model provider. We currently use:

• OpenAI (United States) — generates Sarah’s replies in text and voice conversations, transcribes and responds to live voice calls, searches documents, and helps care staff turn spoken notes into draft care observations. When care staff ask Sarah questions in the care workspace (Ask Sarah), the question, the recent chat and the resident records Sarah looks up to answer it — limited to what the question needs — are sent to OpenAI.
• ElevenLabs (United States) — turns Sarah’s replies into speech, and, for some voice calls on the website and in the apps, carries the call audio and transcribes what you say.

These providers act as our processors. Under our agreements and their API terms they may not use this information to train their models, though they may keep it for a short time for abuse monitoring under their own policies. Confirm: OpenAI and ElevenLabs data processing agreements signed; zero-data-retention / EU residency options enabled where available.

Voice and speech

• Live voice calls with Sarah. Your microphone audio is streamed to OpenAI or ElevenLabs (see above) so Sarah can hear and answer you. We do not record or keep call audio. We keep a text transcript of what was said so Sarah can remember the conversation.
• Dictation in the apps. When you speak instead of typing, the apps use your phone’s built-in speech recognition. On iPhone this is Apple’s speech recognition and on Android it is Google’s; depending on your device and settings, audio may be processed on the device or sent to Apple or Google under their privacy policies.
• Sarah calling you. On iPhone, Sarah can ring you like a phone call. To do this we send a notification through Apple’s push notification service (APNs) containing a call identifier — not the content of your conversations.
• Staff voice notes. Care staff can record a spoken note to draft a care observation. The audio is processed to produce text and is not kept unless a member of staff attaches it to a handover note.

How we use it and why

Under UK data protection law (UK GDPR and the Data Protection Act 2018) we rely on:

• Contract — to create and run your account, provide conversations with Sarah, deliver the care workspace to care providers, and keep it working.
• Legitimate interests — to keep Kinto secure, prevent abuse (for example, rate-limiting the public voice demo), fix problems and improve the service in ways you would reasonably expect. We balance these interests against your rights.
• Consent — for the website voice demo and for wearable data. You can withdraw consent at any time; for the demo, choose “Forget me” (which deletes your demo conversations straight away) or simply stop using it.
• Legal obligation — where we must keep or disclose information by law.

For care records, the care provider determines the lawful basis, typically the provision of health or social care.

Health information

Care records, and sometimes things people tell Sarah, include information about health. This is “special category” data and gets extra protection under UK GDPR.

• Care providers process care records for the provision of health or social care (UK GDPR Article 9(2)(h)), under the duty of confidentiality that applies to care professionals.
• When you use Sarah directly and choose to share health information, we process it with your explicit consent so Sarah can respond and remember what matters to you. You do not have to share health information to use Sarah.
• Only members of a care organisation with the right role can see its care records. Family members do not have access to care records in the care workspace.

Wellbeing notes from conversations with Sarah

When a resident’s Kinto app account is linked to their record at a care home, Sarah may record wellbeing observations from their conversations. If the resident mentions how they are feeling, how they slept, a symptom such as pain or dizziness, whether they have taken their medication, or something about their general wellbeing, Sarah can save a short note about it to the resident’s care record. Each note has a type (for example mood, sleep, symptom or medication), a short description in Sarah’s words, a level (normal, concerning or urgent), sometimes a simple measure such as hours slept, the time, and a link to the conversation it came from. It is marked as recorded by Sarah (AI), not by a member of staff.

The resident’s care team can see these notes in the care workspace: care staff, and read-only viewers such as a visiting GP, at that care home. Family members cannot. Concerning and urgent notes can also appear in shift handovers, weekly reports and alerts. A note is a summary, not a transcript of the conversation. The care team sees it when they next look at the resident’s record, so it is not an emergency alert: in an emergency, tell a member of staff or call 999. If an account is not linked to a care home, any notes stay with that account and no care team can see them.

Who we share it with

We share personal information only with the following, and only as needed:

Within a care organisation, care records are visible to its care team according to their role. We may also disclose information if required by law, to protect someone’s vital interests (for example, a safeguarding emergency), or as part of a business transfer, in which case this policy would continue to apply.

International transfers

Our main hosting is in the UK. OpenAI, ElevenLabs and Twilio process information in the United States. Where personal information leaves the UK we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement / Addendum, with a transfer risk assessment.

How long we keep it

• Accounts — for as long as your account is open. When you delete it, we delete your account straight away (see below).
• Conversations with Sarah and her memories — while your account is open, so Sarah can remember you, and deleted with your account.
• Website voice demo — your conversations with Sarah, call records and transcripts, scheduled calls and the link to your browser are deleted 30 days after your first conversation, by a daily deletion job. Choosing “Forget me” deletes them from our servers straight away. Rate-limiting records (a keyed hash of your IP address and the time) are kept apart from your conversations and deleted by the same daily job once they are 24 hours old, so within two days. Schedule the daily purge_expired_visitors job.
• Live voice transcripts held in the call record itself are erased after 24 hours; the conversation history they produced follows the rules above.
• Ask Sarah chats in the care workspace — deleted 30 days after the last message, or sooner if the staff member deletes the chat or their account. They are kept apart from residents’ conversations with Sarah and never added to her memories. Schedule the daily purge_ask_sarah_conversations job (the workspace also deletes expired chats when staff open their chat list).
• Care records — for as long as the care provider instructs, in line with the retention rules that apply to care records. When a care provider stops using Kinto, we return or delete its records as agreed in our contract.
• Backups and logs — deleted information can remain in encrypted backups and logs for a limited period before they are overwritten. Confirm Cloud SQL backup and log retention periods.

Deleting your account

You can delete your Kinto account at any time. See kinto.you/delete-account for how to do it in the app or on the web.

When you delete your account we permanently delete:

• your login, sessions and app/push-notification registrations;
• your conversations with Sarah, including messages, files and anything Sarah remembered about you;
• personal profiles that only you manage, and photos you uploaded; and
• family portal requests, messages and visit bookings you made.

Care records that belong to a care provider are kept, because the care provider is responsible for them and may be required to keep them. Where you wrote or changed those records as a member of staff, they stay but are no longer linked to your account. If you are the only owner of a care organisation, you will need to hand ownership to someone else first.

Your rights

You have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted;
• restrict or object to how we use it;
• receive your information in a portable format; and
• withdraw consent where we rely on it, without affecting what we did before.

Email support@kinto.you to use any of these rights. We will reply within one month. For care records held for a care provider, we will pass your request to the provider and help them respond.

Cookies and local storage

We do not use advertising or analytics cookies. The website stores a small amount of information in your browser’s local storage so it works:

• your sign-in token and basic account details, if you sign in to the care workspace;
• a random visitor identifier for the voice demo, so Sarah can remember you; and
• cached audio for the guided product tour.

Signing out, choosing “Forget me”, or clearing your browser’s site data removes these. Clearing site data does not delete your demo conversations from our servers (they are deleted after 30 days); choose “Forget me” first to delete them straight away. Our administration pages use strictly necessary session and security cookies.

Security

Information is encrypted in transit, our database runs in Google Cloud’s London region, and access is limited by role: within a care organisation only the care team can see care records, and viewers can only read them. Secrets are held in a managed secret store. No system is perfectly secure; if a breach affects you, we will tell you and the regulator where the law requires.

Automated decisions

Kinto calculates indicators such as early-warning scores, risk scores and mood trends to help care teams notice when someone might need attention. These are suggestions for trained people to review; Kinto does not make decisions about anyone’s care, and no decision with legal or similarly significant effects is made solely by automated means.

Children

Kinto is designed for adults and the people who care for them. It is not intended for anyone under 18, and we do not knowingly collect information from children. If you think a child has given us information, please contact us and we will delete it.

Changes to this policy

We will update this page when how we handle information changes, and change the “last updated” date at the top. If a change is significant we will tell you in the app or by email before it takes effect.

Contact and complaints

Contact us at support@kinto.you, or see kinto.you/support.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113. We would appreciate the chance to put things right first.