Privacy Policy

Important Notice Regarding HIPAA

KinoIQ LLC is a Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations. As a healthcare professional using the Platform to analyze patient movement data, you are a Covered Entity or Business Associate under HIPAA.

We have entered into a Business Associate Agreement ("BAA") with Google Cloud Platform, which provides the infrastructure underlying the Platform. Our handling of Protected Health Information ("PHI") is governed by HIPAA, applicable state law, and the terms of any BAA executed between KinoIQ LLC and your practice or organization.

Information We Collect

2.1 Clinician Account Information

When you create an account or join the KinoIQ Clinical beta program, we collect:

• Your name and professional credentials
• Email address
• Practice name and address
• Professional license information (if provided)
• Account login credentials (stored in encrypted form)

2.2 Patient Data — De-Identified by Design

KinoIQ Clinical is built on a privacy-by-design architecture specifically to minimize PHI exposure:

• Patient personally identifiable information (PII) — including name, date of birth, and contact information — is stored locally on your device only, in Apple CoreData. This information is never transmitted to KinoIQ servers.
• Patient records are assigned anonymous UUIDs (unique identifiers) for all server-side processing. These UUIDs cannot be reverse-engineered to identify any individual.
• Kinematic and biomechanical metrics derived from movement analysis are transmitted to and stored on KinoIQ servers using only the anonymous UUID, not patient identity.
• Video recordings captured for movement analysis are processed on secure servers. Video is deleted from our servers as soon as analysis completes successfully. If an analysis fails, the video is kept for a short period so it can be retried, then deleted automatically within 48 hours. Original video is retained on your device only.
• Video is uploaded as recorded, without audio, and may show the patient's face. It is stored under an anonymous patient UUID, is never linked to the patient's name or other identifying information on our servers, and is used only to compute movement measurements.

2.3 Movement Analysis Data

The Platform collects and processes the following types of movement data, all associated only with anonymous patient UUIDs:

• Joint angle measurements and kinematic metrics
• Movement quality scores and assessment results
• Limb Symmetry Index (LSI) calculations
• Session timestamps and assessment types
• Data quality indicators and frame quality metadata

2.4 Usage and Technical Data

We automatically collect certain technical information when you use the Platform:

• Device type, operating system version, and app version
• Session duration and feature usage patterns (aggregated and anonymized)
• Error logs and crash reports
• IP address and general geographic region

How We Use Your Information

We use the information we collect for the following purposes:

• Providing and operating the KinoIQ Clinical Platform and its features
• Processing movement analysis and generating assessment reports
• Training and improving the accuracy of our motion capture algorithms (using de-identified data only)
• Communicating with you about your account, updates, and support
• Ensuring platform security and preventing unauthorized access
• Complying with applicable legal and regulatory obligations, including HIPAA
• Responding to your inquiries and providing customer support

Data Storage and Security

4.1 Infrastructure

KinoIQ Clinical uses the following infrastructure providers, each selected for their security and compliance capabilities:

• Google Cloud Platform (Firebase / Firestore) — cloud database and authentication. Google Cloud has executed a HIPAA Business Associate Agreement with KinoIQ LLC.
• Modal Labs — secure GPU computing infrastructure for movement analysis processing.
• Anthropic Claude API — AI language model used for clinical interpretation and Smart Coach features. Data submitted to this service is de-identified.

4.2 Security Measures

We implement the following technical and organizational safeguards:

• Firebase Authentication with enforced session management for all clinician accounts
• Per-user concurrency locking to prevent unauthorized parallel access
• Encrypted data transmission (TLS) for all network communications
• Automatic video deletion from servers upon successful completion of analysis, and within 48 hours otherwise
• Video recorded without audio and stored only under an anonymous patient UUID
• Role-based access controls limiting data access to authorized users within a practice
• Rate limiting and bot protection on all API endpoints

4.3 Data Retention

We retain de-identified kinematic data for as long as your account is active or as needed to provide services. Video recordings are deleted from our servers as soon as analysis completes successfully, and within 48 hours if an analysis fails. Patient PII is never stored on our servers. You may request deletion of your account and associated data at any time by contacting [email protected].

Data Sharing and Disclosure

We do not sell, rent, or trade your information or your patients' information. We may share information in the following limited circumstances:

• Service Providers: We share data with our infrastructure providers (Google Cloud, Modal Labs, Anthropic) solely as necessary to operate the Platform, under appropriate data processing agreements.
• Legal Compliance: We may disclose information if required by law, court order, or government authority, or to protect the rights, safety, or property of KinoIQ LLC or others.
• Business Transfer: In the event of a merger, acquisition, or sale of KinoIQ LLC, patient data and clinician data would be transferred only under the same privacy protections described in this Policy.
• With Your Consent: We may share information in other circumstances with your explicit written consent.

Your Rights and Choices

6.1 Clinician Rights

As a clinician using the Platform, you have the right to:

• Access your account information and the data associated with your account
• Correct inaccurate information in your account profile
• Request deletion of your account and associated de-identified data
• Export your practice's assessment data in a portable format (contact us to request)
• Opt out of non-essential communications

6.2 Patient Rights Under HIPAA

Your patients have rights under HIPAA with respect to their PHI. Because KinoIQ Clinical stores patient PII only on your device and not on our servers, you as the Covered Entity or Business Associate are primarily responsible for fulfilling patient rights requests (access, amendment, accounting of disclosures). We will cooperate with you to the extent we hold any relevant de-identified data.

6.3 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at [email protected].

Beta Program Notice

KinoIQ Clinical is currently in a pre-launch beta phase. By participating in the beta program, you acknowledge that:

• The Platform is under active development and features may change
• Beta participants may be asked to provide feedback to help improve the Platform
• Feedback you provide may be used to improve KinoIQ Clinical without compensation
• This Privacy Policy governs all beta use and will be updated as the Platform matures

We recommend that beta participants exercise additional caution and follow your organization's policies regarding the use of beta software with patient data.

Children's Privacy

KinoIQ Clinical is intended for use by licensed healthcare professionals only and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If a clinician uses the Platform to assess a minor patient, that patient's identity is governed by your organization's consent and privacy procedures; KinoIQ does not store the patient's identifying information.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. We will notify you of material changes by posting the updated Policy in the app and on kinoiq.com and, where feasible, by email to your registered address. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the updated Policy.

Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or need to execute a Business Associate Agreement, please contact us:

This Privacy Policy is not legal advice. KinoIQ LLC recommends that healthcare practices consult with a HIPAA compliance professional or healthcare attorney regarding their obligations when using the Platform.