Privacy Policy

1. Introduction

This Privacy Policy describes how Kinsula (the mobile application, website at kinsula.app, and related services, collectively the "Service") collects, uses, discloses, and protects information about you. The Service is operated by the Company and its parent company, Suncture (suncture.io), together with their affiliates, officers, directors, and employees (collectively, "we," "us," or "our").

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, do not use the Service.

This Privacy Policy is provided for informational purposes and does not constitute legal advice.

2. Scope

This Privacy Policy applies to information we collect through:

• The Kinsula mobile application
• The kinsula.app marketing website
• Account registration, onboarding, and support communications
• Optional integrations with hospital care teams through Health Auth

It does not apply to third-party websites, apps, or services that we do not control, including care team portals operated by participating hospitals.

3. Information We Collect

We may collect the following categories of information:

Account and profile information

• Name, email address, and account credentials
• Care profile details you provide during onboarding (for example, diabetes type, discharge context, glucose targets, and related preferences)
• Authentication tokens used to maintain your signed-in session

Health and recovery logs

Information you enter or generate in the app, which may include:

• Blood glucose readings and related timestamps
• Medication and insulin logs
• Meal and nutrition entries
• Daily notes, symptoms, and recovery program activity
• Care Review summaries and Recovery Island program progress

Health Auth and care team data

If you choose to connect with a participating care team, we may process:

• Consent records and Health Auth scope selections you approve
• Identifiers and metadata needed to link your account to an authorized clinical team
• Structured summaries shared only according to your explicit consent

We do not access your hospital electronic health record unless you authorize sharing through Health Auth or a separate agreement with your care provider.

Device and technical information

We may automatically collect:

• Device type, operating system, and app version
• IP address and general location derived from IP (country or region level)
• Log data related to app performance, crashes, and security events
• Limited usage analytics to improve the Service, where enabled

We do not sell your personal information.

4. How We Use Your Information

We use information we collect to:

• Create, authenticate, and maintain your account
• Provide core app features, including logging, education, Care Review, and Recovery Island
• Sync your data across devices through our secure cloud backend
• Enable optional Health Auth sharing with care teams you authorize
• Respond to support requests and communicate about the Service
• Monitor, maintain, and improve security, reliability, and performance
• Comply with legal obligations and enforce our Terms and Conditions
• Detect, prevent, and address fraud, abuse, or unauthorized access

We use health-related logs primarily to provide the Service to you and, when you consent, to share structured information with authorized care teams. We do not use your health logs for third-party advertising.

5. How We Share Your Information

We may share information in the following circumstances:

With your consent — Health Auth and care teams

When you enable Health Auth, we share only the categories of data and scopes you explicitly approve with the care team or hospital program you select. You may revoke consent through in-app settings where available, or by contacting support.

Service providers

We use trusted vendors to host infrastructure, operate APIs, send transactional email, and support analytics or error monitoring. These providers process data on our instructions and under contractual confidentiality and security obligations.

Legal and safety

We may disclose information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of you, us, Suncture, or others.

Business transfers

If the Company, Suncture, or substantially all assets are involved in a merger, acquisition, or asset sale, your information may be transferred subject to this Privacy Policy or a successor policy with notice as required by law.

We do not sell personal information. We do not share your health logs with advertisers.

6. Data Storage and Security

We store account and clinical log data in secure cloud infrastructure operated for the Kinsula platform. Security measures may include:

• Encryption in transit (for example, TLS/HTTPS) for data sent between your device and our servers
• Access controls and authentication mechanisms, including token-based session management
• Monitoring and logging designed to detect unauthorized access
• Restricted internal access on a need-to-know basis

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for securing your device.

7. Your Rights and Choices

Depending on your location, you may have rights regarding your personal information, which may include:

• Access — requesting a copy of information we hold about you
• Correction — updating inaccurate account or profile information in the app or by contacting us
• Deletion — requesting deletion of your account and associated data, subject to legal retention requirements
• Withdrawal of consent — revoking Health Auth or other optional sharing where supported in the app
• Portability — requesting an export of your data where technically feasible

To exercise these rights, contact support@suncture.io from your registered email address. We may need to verify your identity before fulfilling a request. Some features may not be available in all pilot builds.

8. Data Retention

We retain information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you request account deletion, we will delete or de-identify personal information within a reasonable period, except where retention is required by law or legitimate business needs (for example, security logs or backup cycles).

9. HIPAA and Healthcare Relationships

Kinsula is a patient-facing recovery and logging tool. Unless we expressly state otherwise in a separate written agreement with you or your healthcare organization, we are not acting as a HIPAA Business Associate in connection with your individual use of the app.

If your hospital participates in a Kinsula pilot or clinical program, your relationship with that hospital, its privacy practices, and any Business Associate or data use agreements are separate from this Privacy Policy. Health Auth sharing occurs only with your explicit consent and according to the scopes you approve.

This section does not create any HIPAA-covered relationship by itself. Contact your care provider for questions about how your hospital handles protected health information.

10. Children's Privacy

The Service is not directed to children under 13 years of age (or under 16 where applicable local law requires a higher minimum age). We do not knowingly collect personal information from children below the applicable minimum age. If you believe we have collected information from a child in violation of this policy, contact support@suncture.io and we will take appropriate steps to delete it.

11. International Users

The Service is operated from the United States. If you access the Service from outside the United States, you understand that your information may be processed and stored in the United States or other jurisdictions where we or our service providers operate, which may have different data protection laws than your country of residence.

12. Third-Party Links

The Service may contain links to third-party websites or services (for example, Suncture or participating hospital portals). We are not responsible for the privacy practices of those third parties. Review their policies before providing information to them.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and update the "Last updated" date. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy, except where applicable law requires additional consent.

14. Contact Us

For privacy-related questions or requests:

Email: support@suncture.io

Website: kinsula.app

Parent company: Suncture

15. Governing Law

This Privacy Policy is governed by the laws of the applicable jurisdiction in which the Company operates, without regard to conflict-of-law principles. Any disputes relating to this Privacy Policy that are not subject to arbitration under our Terms and Conditions shall be resolved in the courts of that jurisdiction, except where prohibited by applicable consumer protection law in your place of residence.