Privacy Policy

NephroKin — Privacy PolicyLast updated: September 20, 2026 · Effective date: September 20, 20261. IntroductionThis Privacy Policy explains how NephroKin ("we," "our," or "us") collects, uses, stores, and shares information through our mobile application (the "App") and our website at nephrokin.com (together with the App, the "Service"). NephroKin is a personal health-tracking and community app for families and caregivers managing Nephrotic Syndrome and related kidney conditions.The Service is operated by NephroKin LLC, an Arizona limited liability company, at 4539 N 22nd St, Ste N, Phoenix, AZ 85016, United States. NephroKin LLC is responsible for the collection and handling of information described in this Policy. This Policy covers our Service offered to adults in the United States and India. Country-specific provisions supplement the rest of the Policy; they do not limit mandatory rights under applicable law.This Policy does not govern independent third-party services you reach through the Service or what a recipient does with a file you export and share yourself. It continues to govern copies of information that we hold.If applicable U.S. consumer health data laws protect your information, including the Washington or Nevada laws, please also see our separate Consumer Health Data Privacy Policy. That policy supplements this Policy and controls for covered consumer health data if the two conflict. Applicable protections are not necessarily limited to residents of those states.2. Who This Policy Covers, and Our Consent ProcessNephroKin accounts are for adults aged 18 or older. An adult (the "Account Holder") creates and controls the account to track their own health information or that of their child (the "Care Recipient"). Children are not permitted to create accounts or use adult accounts themselves. Our current onboarding offers self-tracking and parent-or-guardian child-tracking; being a caregiver alone does not establish legal authority to consent for another person.During account setup, the Account Holder must separately check two boxes, both unchecked by default, before continuing: (1) confirmation that they are at least 18 years of age, and (2) confirmation that they consent, as the parent, legal guardian, or account holder, to our collection and use of the health information they choose to log. Each confirmation is independently recorded with a timestamp. If the Account Holder is tracking their own information, our sign-up flow also enforces a date-of-birth requirement consistent with being at least 18.These confirmations are obtained separately from, and are not bundled into, your acceptance of our Terms of Use or of this Policy. Accepting our Terms of Use is not, by itself, consent to our collection or use of health data. The Account Holder also represents that they have the legal authority to provide the Care Recipient's information and to consent to its collection and use.Information about a child is entered by their adult parent or legal guardian, not collected through a child-facing account. Our processing still includes personal information about that child.2.1 Children's InformationThe App is not directed to children, including children under 13 in the United States. A parent or legal guardian may review and correct the child's information using available App tools, or contact us for assistance. They may request deletion of a child's information by contacting us, or delete the account as described in Section 9.If you believe someone under 18 has created an account or directly submitted information without appropriate adult authority, contact [email protected]. We will investigate, restrict unauthorized use, and delete improperly collected information, subject to legal preservation requirements.For India, the DPDP Act defines a child as a person under 18. An adult-held account does not remove protections for the child's information. Our current confirmations record the adult's statements; they are not a claim that independent identity or parental-age verification has occurred. We will apply legally required parental verification before processing subject to that requirement, when it becomes applicable, and explain any additional verification data before collecting it. We do not serve targeted advertising to children or monitor a child's online behavior. Parent-entered health logs are distinct from tracking a child's browsing or app activity.2.2 Choosing Not to Provide Information and Withdrawing ConsentYou may decline to provide health information or consent to its processing. We cannot provide health-tracking features without the information and consent necessary to operate them. Optional information and community participation are not required for private health tracking.You may withdraw health-data consent at any time through Profile → Delete account, or by emailing [email protected] from your account email with your request. You do not need to use a particular subject line. If you want to withdraw consent for a particular use rather than delete the whole account, tell us which use you want stopped. We will explain which features can remain available.Withdrawal does not affect processing lawfully performed before it. We will stop the relevant consent-based processing and arrange deletion, including with processors acting for us, subject to the limited retention exceptions in Section 9. Uninstalling the App, signing out, or disabling reminders does not by itself delete your account or withdraw health-data consent. Export anything you want to keep before requesting deletion.3. Information We Collect3.1 Account Information (Adult Account Holder)• Email address and password-based authentication information, managed via Supabase Auth. If you sign in with Google or Apple, we receive the identifiers, tokens, and profile information authorized through that sign-in, which may include your name and email address; we do not receive your Google or Apple password
• Full name and country; phone number if you provide it. Country may initially be suggested or populated from your device's region setting and can be corrected
• Account and authentication records, including sign-in timestamps and the consent and terms-acceptance records described in Section 23.2 Care Recipient Information• Name, date of birth, diagnosis date, and relationship to the Account Holder3.3 Health Tracking Data• Urine protein readings, weight, swelling location/severity, active medications and adherence, and free-text notes, together with the alerts, trends, and reports generated from that information3.4 Community Content• Posts, replies, and reactions you choose to share, including posts marked anonymous3.5 Basic Technical Data• Device type and model, operating system version, App version, device region and local preferences, IP address, and event timestamps, used to operate the App and maintain its security and stability. Some preferences remain on your device; network and authentication services also generate technical recordsWe do not currently collect payment information. The App is free.3.6 What We Do Not Collect About a ChildOur child-profile fields do not request a child's email address, phone number, mailing address, photographs, government identification, school information, precise location, advertising identifiers, or login credentials. Do not put these details, Aadhaar numbers, or other government identifiers into notes, community posts, or support emails. Free-text information you choose to submit is nevertheless received by us.We do not collect biometric templates, contacts, or data from Apple HealthKit. Optional device biometric authentication is performed by your device; NephroKin does not receive your facial image or biometric template.3.7 Sources of InformationWe receive information from you; from a parent or legal guardian about their child; automatically from the device and services used to operate the App; and from Apple or Google when you choose their sign-in options. We also receive support messages and community reports submitted by users. We do not purchase personal information or obtain it from data brokers or public-record searches.3.8 Support and Privacy-Request RecordsIf you contact us, we receive your contact details, message, and any information you include. We also keep records needed to handle privacy requests, complaints, consent, and account deletion. A deletion receipt may contain an account identifier, a protected keyed hash of your email address, timestamps, sign-in provider names, and revocation results. A hashed identifier is not necessarily anonymous. Do not send passwords or unnecessary medical details in a support request.4. How We Use InformationWe use the information above to operate the App's tracking, calendar, and export features; enable community posting and moderation; generate in-app alerts based on your own data; communicate with you, including account, security, and support emails; and improve the App. We also use information to secure the Service, to prevent fraud and abuse, to enforce our Terms of Use, and to comply with legal obligations. We do not use your health information for advertising, and we do not sell your personal information.We may create de-identified or aggregated information that cannot reasonably be linked to you, and use it to understand how the Service is used and to improve it. We will maintain that information in de-identified form and will not attempt to re-identify it. Information that can still reasonably be linked to an individual remains subject to this Policy.4.1 Information and Purpose SummaryAccount details, country, and authentication records
Create and secure your account, select appropriate defaults, communicate about the Service, and record your choices.Care Recipient profile and health logs
Associate records with the right person; provide tracking, calendars, reminders, trends, alerts, and exports you request.Community posts, replies, reactions, and reports
Display your contributions and operate and moderate the community.Technical records and device preferences
Run the Service, troubleshoot faults, protect accounts, and maintain local settings.Support, consent, complaint, and deletion records
Answer requests, document their handling, investigate abuse, and meet applicable legal duties.We limit identifiable health-data use to the requested features and related support, safety, and legal purposes described here. Posting health details to the community is a separate choice, not a condition of using private health logs. A materially different optional use requires an additional explanation and any consent required by law; accepting this Policy is not blanket permission for unrelated processing.We do not sell your personal information, we do not share it for cross-context behavioral advertising or targeted advertising, and we do not use it for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

5. Third-Party Service ProvidersWe currently use the following third-party providers to operate the App:• Supabase: database hosting, authentication, and storage
• Resend: transactional email delivery (e.g., password resets, account confirmation, and optional feature-interest notifications you request)
• Apple: app distribution through the App Store, and authentication if you sign in with Apple
• Google: authentication if you sign in with GoogleSupabase and Resend receive the information needed for the services they provide to us. We require providers acting as our processors to protect that information and limit processing to our instructions and permitted service purposes. Apple and Google may also act independently for their own accounts, authentication services, platform security, and app distribution under their respective privacy policies. Using their services does not give them access to your private health logs merely because they distribute the App or provide sign-in.Medication and log reminders. Device notifications are scheduled locally rather than sent through a remote push service. Lock-screen reminder text is generic, such as "You have a log reminder" or "You have a medicine reminder," and does not include health readings, medication names, or a Care Recipient's name. This does not mean that medication records or reminder preferences used by the account are necessarily stored only on your device. The signed-in App's inbox may show more detailed information, including a medication name. You can control notifications in App and device settings.Planned, not yet live: As NephroKin grows, we plan to introduce Retool, an internal administrative dashboard for customer support, which is not active today. We will update this Policy and provide notice before it goes live.5.1 Other DisclosuresWe may also disclose information: (a) to comply with applicable law, legal process, or a governmental request; (b) to enforce our Terms of Use or investigate a suspected violation; (c) to protect the rights, property, or safety of any person, including in an emergency; (d) in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, in which case we will require the recipient to honor this Policy or will give you notice and an opportunity to delete your account before your information becomes subject to a different policy; and (e) with your consent.These are not permissions to disregard applicable privacy law. We assess the legal basis and limit each disclosure to information needed for its purpose. Where disclosure requires your permission, we obtain it; where law requires disclosure without consent, we comply with that law. We do not routinely publish private health logs.6. How We Store and Protect InformationOur main application database is hosted through Supabase in the United States. Hosted data is encrypted in transit via HTTPS/TLS and at rest. Access-control policies, including row-level security, are designed to restrict access to private account and health records. Community content is intentionally visible as described in Section 12; these controls are not an absolute guarantee against unauthorized access. The App also offers an optional on-device Face ID lock, off by default, to protect access to the already-signed-in App.As with most apps, our own team can access data as needed to operate, maintain, and provide support for the Service. We do not routinely browse individual health records, and we never sell your data. We maintain a written information security program appropriate to the sensitivity of the information we hold, covering access controls, credential management, encryption, logging, and incident response. No system is completely secure, and we cannot guarantee that unauthorized access will never occur.6.1 Processing Outside IndiaIf you use the Service from India, your information, including the health information you choose to provide, is transferred to and processed in the United States. Providers may process supporting service information in other locations under their service arrangements. Overseas laws may differ from Indian laws, and information may be accessible to authorities through applicable legal procedures.For transfers governed by India's 2011 sensitive-personal-data rules, we require equivalent protection under those rules and a permitted basis, such as contractual necessity or consent. We will observe applicable Indian transfer restrictions as they take effect. This Policy does not itself constitute transfer consent or waive your rights. You may contact us about recipients or transfer arrangements, or decline processing as explained in Section 2.2.7. HIPAA StatusNephroKin is not a "Covered Entity" under HIPAA (45 C.F.R. § 160.103): we are a software company, not a healthcare provider, health plan, or healthcare clearinghouse.NephroKin is also not a "Business Associate" under HIPAA: we do not perform services on behalf of, or under contract with, any healthcare provider, health plan, or clearinghouse, and we have no electronic health record integrations. When you export and share your logs with your healthcare provider, that sharing is initiated and controlled by you directly, using your device's own share function. If we later contract with a healthcare provider, health plan, or clearinghouse to perform a function involving protected health information, we would become a Business Associate as to that engagement. We will update this Policy and enter into a business associate agreement before doing so.8. Breach Notifications and Regulatory OversightUnited States. NephroKin is subject to the FTC Act's prohibition on unfair or deceptive practices. For breaches subject to the FTC Health Breach Notification Rule, we notify affected individuals without unreasonable delay and within 60 calendar days of discovery. FTC notification is simultaneous for breaches involving 500 or more individuals; smaller breaches are reported within 60 calendar days after the calendar year ends. Required media notices and state-law notices also apply. A shorter applicable legal deadline takes precedence.India. We comply with applicable incident-reporting duties, including CERT-In requirements for reportable incidents. Those regulator-reporting duties are distinct from notices to affected users; the U.S. 60-day limit is not an Indian waiting period. Once applicable, DPDP breach rules require notices to affected individuals and the Data Protection Board without delay, with further Board details within 72 hours unless an extension is permitted. Notices will explain the incident and protective steps as legally required.9. Data Retention and Account DeletionWe generally retain account and health-tracking information while needed to provide your active account and requested features, subject to deletion requests and the limits below.We keep information only as long as necessary for the purposes described in this Policy, and we do not retain it indefinitely. We maintain a written retention schedule that states, for each category of information, the purpose for retaining it and the period for which it is retained.9.1 In-App DeletionYou may permanently delete your account from within the App. This requires you to re-authenticate — by re-entering your password, or by re-authenticating through Google or Apple if that is how you signed in — and to type a confirmation phrase. Deletion is then processed through a secure, authenticated server-side request that removes ordinary account-owned data before your login credentials are deleted, subject to Section 9.3.9.2 Retention TimelineSuccessful in-app deletion removes your profile, Care Recipient profile, health logs, and community posts and replies from the active application database as part of the deletion process, except information that must be preserved under Section 9.3. Replies other users posted on your posts are also removed with those posts. Deletion is not merely hiding your account or anonymizing its ordinary health logs. Save anything you want to keep first.Our current application-database configuration does not include automatic database backups. This does not mean every provider log, support email, or legally retained record disappears with an account. If we enable backups, we will disclose the applicable retention period before doing so; backup copies will not be used to restore deleted accounts for ordinary use. Accounts inactive for more than 24 consecutive months may be flagged for deletion after advance notice to your email.9.3 Limited Retention After DeletionWe may retain deletion receipts, request-handling records, and information required for a legal obligation, legal hold, or a specific dispute. Access is restricted, retention is limited to the applicable purpose and period, and retained records are not used for advertising or to reactivate the account.Where India's intermediary rules apply, registration information must be retained for 180 days after cancellation; certain removed content and associated evidence also require preservation. Applicable cybersecurity duties may separately require security-log retention. These exceptions do not authorize indefinite retention of all health logs. We will explain a restriction on a deletion request where legally permitted. Any additional retention requirements that later become applicable will be reflected in our retention practices and notices.10. Your Choices and RightsYou may access or correct your information within the App. You may delete your account and associated data at any time as described in Section 9, or by contacting [email protected].Depending on where you live, you may also have the right to confirm whether we process your personal information and to obtain a copy of it, to correct inaccuracies, to delete it, to obtain it in a portable format, to opt out of sale, targeted advertising, and certain profiling, and to limit our use of sensitive personal information. We do not sell personal information, engage in targeted advertising, or conduct profiling of the kind these laws address.To exercise a right, use the tools in the App or email [email protected]. We verify identity and authority proportionately, normally using your account email and authentication, and request more information only when reasonably needed. An authorized agent may submit a request with proof of authorization. Do not send government identification unless we explain why it is needed and provide an appropriate submission method.For U.S. requests, we generally respond within 45 days, with a further 45 days only where legally permitted and reasonably necessary and with notice. Shorter applicable deadlines control. India requests follow Sections 10.1 and 16, not this U.S. extension schedule.If we decline a U.S. request in whole or in part, you may appeal by replying to our response or emailing [email protected] with "Appeal" in the subject line. We respond in writing within 45 days or the shorter applicable period, explain our decision, and provide information about contacting the relevant regulator if an appeal is denied. India's complaint and escalation routes are in Section 16.We will not discriminate against you for exercising any of these rights, and we do not offer financial incentives in exchange for personal information. California residents: we have not sold or shared personal information in the preceding twelve months, and we use sensitive personal information only to provide the Service you have requested and for other purposes permitted without a right to limit.10.1 India: Current Choices and Phased Legal RightsYou may request review and correction of information you provided, withdraw consent, request deletion subject to lawful retention, and raise a grievance using [email protected]. We respond to India privacy requests within one month, or sooner if applicable law requires.India's Digital Personal Data Protection Act, 2023 and Rules, 2025 commence in stages. As of this Policy's update date, the principal processing duties and individual-rights provisions are scheduled to commence in May 2027; this Policy does not represent them as already fully enforceable. The Information Technology Act and its applicable rules continue to be relevant during the transition.When applicable, NephroKin LLC acts as the Data Fiduciary. DPDP rights include a processing summary and prescribed recipient information, correction and erasure, grievance redressal, and nomination of another individual for death or incapacity. Contact us to exercise applicable rights. Requests may be subject to lawful exceptions and identity or authority checks. We will publish the required procedures, notices, and language options as these duties become applicable. Nothing here postpones a right that is already in force.

11. U.S. State Privacy and Consumer Health Data RightsDepending on applicable state law and its scope, you may have rights concerning personal information or consumer health data, including access, correction, deletion, withdrawal of consent, and non-discrimination. General state privacy statutes and specific consumer health data laws are not identical.Our separate Consumer Health Data Privacy Policy explains covered health-data categories, sources, uses, recipients, and rights. We do not sell health data or share it with corporate affiliates. Exercise your rights through the App or [email protected]. The separate policy supplements this one; mandatory state protections remain applicable.12. Community Content VisibilityContent you post to the community feed is visible to other users. An anonymous-post setting hides your display name from other users; it does not make the post unidentifiable to NephroKin or prevent identification through what you write. Private health logs do not become community posts merely because you record them.Avoid identifying a child or sharing unnecessary medical details. Do not post another person's information without appropriate permission and authority. Other users may copy or save content before removal; we cannot delete copies outside our control. Account deletion removes posts and associated replies as explained in Section 9, subject to required preservation. Report privacy violations or harmful content to the contact in Section 16 or through available in-app reporting tools.13. Third-Party Links and Do Not TrackThe Service may contain links to third-party websites or resources. We are not responsible for their content or their privacy practices. We do not track you across third-party websites or services over time, and we do not currently respond to browser Do Not Track signals.14. Changes to This PolicyWe may update this Privacy Policy from time to time. We will notify you of material changes within the App or by email before they take effect. Where a change would materially expand our collection, use, or sharing of health data, we will obtain your affirmative consent before that change applies to you.We will also provide periodic policy reminders where required for our Indian community service. Continued use alone does not replace a legally required affirmative consent. Mandatory rights under applicable Indian or U.S. law are not waived by this Policy or our Terms of Use.15. Contact UsQuestions about this Privacy Policy can be sent to: [email protected]Mailing address: NephroKin LLC, 4539 N 22nd St, Ste N, Phoenix, AZ 8501616. Grievance Officer (India)For users located in India, our Grievance Officer can be contacted as follows:• Name: Vasanth Kumar Makam
• Email: [email protected]
• Address: NephroKin LLC, 4539 N 22nd St, Ste N, Phoenix, AZ 85016, United StatesThis contact handles privacy requests and community grievances. Email a description of the issue, a way to reply, and any relevant post identifier or link. Include only necessary supporting information. A person affected by content, or their authorized representative, may complain even without an account. You do not need a particular email subject line, and a dispute about health data does not require sending your complete medical history.• Privacy grievances: acknowledged within 24 hours and addressed within one month, or a shorter applicable period.
• Community grievances covered by India's intermediary rules: acknowledged within 24 hours and resolved within seven days; covered removal requests have a 36-hour deadline. Specified intimate or impersonation content is subject to reasonable and practicable removal or disabling measures within two hours.
• Escalation: eligible intermediary complaints may be appealed to the Grievance Appellate Committee, ordinarily within 30 days of the officer's decision; the statutory route also covers failures to resolve eligible complaints on time. Once applicable, a DPDP complaint may be escalated to the Data Protection Board after using our grievance process. Other lawful remedies remain available.The shortest applicable deadline governs. Our contact details do not mean we maintain an Indian office or have been designated a Significant Data Fiduciary or significant social media intermediary.