Your health information deserves a clear explanation.

For the direct-to-consumer Companion service, the controller is Kinvectum AB, organisation number 559435-3715, incorporated in Stockholm, Sweden.

Privacy and data-rights contact: info@kinvectum.com.

Companion is a patient-side consumer service that helps you prepare for healthcare visits, record conversations you choose to record, create transcript-grounded visit memories, keep a patient-maintained medication list, remember questions and share selected information. A Care Circle can also let separately authenticated family members or trusted people follow or help manage a person's care profile.

Companion is not intended to diagnose, triage, prescribe, recommend treatment or replace a healthcare professional. It is not your healthcare provider's EHR or legal medical record.

A paused visit draft remains as raw audio in local browser IndexedDB until you finish the visit. When cloud processing succeeds, Companion is designed to replace those local recording parts with AssemblyAI's PII-redacted audio; if the privacy-safe replacement cannot be stored, Companion removes that local raw part rather than silently keeping it.

Companion currently uses browser storage that is necessary to provide the service, including Supabase authentication cookies, IndexedDB for local recordings and the service-worker/cache storage needed for the PWA. The current codebase does not include advertising or behavioural-analytics SDKs. If we introduce non-essential tracking technologies later, this notice and any consent controls will be updated as required.

You can withdraw health-data consent for future processing. Because cloud health features require health-data processing, withdrawing consent means those features can no longer be provided; you can still request an export or deletion.

Companion sends only the information needed for the feature you invoke. We do not sell your health information or use it for advertising.

PII detection is automated and can make mistakes, so redaction reduces exposure but should not be treated as a guarantee that every identifying reference will be detected. Companion deliberately does not redact medically useful categories such as medication names, medical conditions, procedures/tests or treatment durations merely because they are health information.

Processors can retain limited security, billing or operational metadata under their own contractual retention rules even after content deletion.

We prefer European processing where it is available: the Companion Supabase project is in Stockholm, Vercel Functions are configured for Stockholm, and AssemblyAI requests use its EU endpoint.

OpenAI and other provider operations may involve processing outside the EU/EEA unless the relevant account/project is enabled for European data residency. Where a transfer outside the EU/EEA requires a transfer mechanism, Kinvectum must apply the mechanism required by GDPR for that provider relationship, such as an adequacy decision or Standard Contractual Clauses, together with supplementary measures where appropriate.

• Account and care-profile state: while the relevant account/care profile is active, unless information is deleted earlier or retention is required by law.
• Care Circle invitations: invitations expire automatically; accepted/revoked invitation and membership metadata can be retained while needed to administer and evidence access.
• Visit recordings: a paused raw draft stays local until the visit is finished. During processing, the raw audio is temporarily uploaded to private storage. After AssemblyAI's redacted audio is safely stored, Companion deletes that raw cloud upload and replaces the local raw recording with the redacted version where possible.
• Push subscriptions: kept while notifications are enabled for that browser/account. Companion removes its stored subscription when the user disables notifications or signs out; expired browser endpoints are also removed when delivery reports them as gone.
• Temporary shares: inaccessible after expiry/revocation and scheduled for hard deletion from the share-transfer table on an hourly cleanup cycle.
• AssemblyAI transcript artifacts: Companion requests deletion after the redacted transcript/audio has been retrieved. Redacted-audio download URLs are provider-temporary. Provider-side deletion processing and limited metadata retention may take additional time.
• OpenAI API content: Companion requests use store:false. Standard API abuse-monitoring retention may be up to 30 days unless Zero Data Retention is enabled for the OpenAI project.
• Backups/security records: limited copies or metadata may persist for the period required for security, disaster recovery, billing or legal obligations and are not used to restore a deleted account as an active user.

Care Circle access is persistent account-to-account access. Each family member or trusted person signs in with their own Companion account. A patient/helper can invite someone as Keep me informed (read-only) or Help manage (can make changes). Access can later be changed or removed.

Care Circle invitations can be bound to a specific email address or created as a single-use private invitation link. A shareable Care Circle link is a bearer credential: the first signed-in person who successfully claims it receives the access level selected by the inviter and the invitation is then consumed. A recipient who does not yet have Companion can create an account and continue the invitation after email confirmation. Because possession of an unused link can lead to persistent Care Circle access, send it only through a channel and to a person you trust. Companion does not use an unbound bearer link to assign the patient/subject role; patient activation remains email-bound.

A separate general Companion referral link can be shared without adding anyone to a Care Circle. That link only opens signup/sign-in and does not itself grant access to a care profile or health information.

For privacy by default, a read-only Keep me informed member receives a sanitized care-profile view: processed visit memories can be shown, but Companion does not expose the raw transcript, recording identifiers or recording-storage paths through that access level. A Help manage member can access and change the shared care-profile information needed to help operate the service.

Assisted setup does not make a helper the patient. A helper can create a pending care profile and configure the person's name, language, Simple mode and invitations. While the profile is pending, Companion blocks health-state storage and health features such as recording, medication entry, preparation and AI processing for that profile. A competent adult becomes the subject and unlocks those features only by activating the profile through their own Companion account.

Companion does not treat the helper's acceptance of their own Terms or health-data consent as consent by another competent adult. Ordinary assisted setup is practical technology help, not a legal-representative or guardianship mechanism.

Temporary encrypted shares remain separate from Care Circles. They are patient/user-created bearer links: the selected snapshot is encrypted in the browser and the decryption key is placed in the URL fragment. Anyone who receives an active share link or QR code can view that selected snapshot until it expires, so treat it like a sensitive credential.

If you opt into push notifications, Companion uses deliberately generic notification text such as “A new visit memory is ready in your Care Circle” rather than placing diagnoses, medication names or visit details on the device Lock Screen. Notification permission can be withdrawn in Companion/device settings.

You decide when a recording starts. Recording laws, confidentiality duties and healthcare-provider policies vary by country and setting; tell participants and follow the rules that apply where you record.

Depending on the circumstances, GDPR gives you rights to information, access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent. You can download a machine-readable export and delete your cloud account from Companion. You can also contact info@kinvectum.com.

Your personal data export concerns data about you. Membership in another person's Care Circle does not turn that person's health record into your own data-portability export.

We may need enough information to verify that the request concerns your account. We respond without undue delay and ordinarily within one month; GDPR allows an extension in certain complex cases.

You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): submit a complaint to IMY ↗.

See the Privacy & Data Rights page →

Companion clearly identifies AI-guided preparation and AI-organized content. The current product is not intended to make solely automated decisions that produce legal or similarly significant effects about you. AI output can be wrong; the privacy-redacted transcript/recording remains available as source material to the patient/authorized helper where applicable.

Companion is not currently designed for a child to create and manage an independent account without appropriate adult/legal authority. The ordinary assisted-setup flow is designed for a competent adult who wants practical help using technology; it is not a substitute for a parent, guardian, power-of-attorney or other legal-representative process.

If you use Companion while helping another person, you are responsible for having the authority or permission required for information you enter, record or share. Where the person can consent for themselves, Companion's subject-activation flow is designed so they use their own account rather than sharing credentials with the helper.

If a patient/subject deletes their own Companion account, Companion deletes the care profile whose subject they are, including its shared care state and Care Circle memberships. This prevents relatives from retaining an active patient profile after the patient has deleted it through the service.

If a helper deletes only their own login, another person's activated care profile is not deleted merely because that helper originally helped set it up. The helper's membership disappears with their account. Abandoned pending assisted-setup profiles can be removed when no other active member depends on them.

We may update this notice as the product, processors or law changes. Material changes will be presented in the product and, where appropriate, by email. A new consent will be requested when a change requires it rather than treating continued use as explicit consent.