Privacy

• We store the care information you and your circle put into KoraCommand, so we can show it back to your family.
• Only people your circle's Owner has invited can see your circle. We do not sell or rent your data, ever. The one measurement we do is an advertising pixel on our public pages, which never runs inside the command center — see below.
• Documents you upload are read by Anthropic, the AI provider we use as a subprocessor, so their content can become plan items; the assistant runs on Anthropic too. Visit recordings are optional and need the doctor's consent and yours: the audio goes to OpenAI's transcription service and is discarded once it is a transcript.
• If you pay for a plan, Stripe processes the payment and receives your billing details directly. We never see or store your card number.
• You can export your circle's data or delete it, and deletion means deletion.
• Care plans are health-related information and we treat them that way. KoraCommand is still not a healthcare provider and not a HIPAA covered entity — it coordinates; it never advises.

• Your records stay in your family's circle. Only the people you invite can see them.
• A visit is recorded only when the doctor says yes, out loud, first. Illinois law requires everyone's consent, and Kora will not start without it.
• The recording is deleted after it becomes your written summary.
• Your family's information is never sold. Ever.
• Nothing about your family is used to train models unless you say yes. The default is no. You can export or delete everything, anytime.

How we keep these promises

Account information. Your name, email address, and a password that we store only as a salted scrypt hash — we never see or store the password itself.

Care information you enter. Everything you or your circle add: the person being cared for, medications, appointments, bills, tasks, notes, contacts, and activity history.

Documents you upload. Medication lists, discharge papers, insurance statements, bills, and photos, along with what our AI stack extracted from them.

Patient-portal connections, if you choose to connect one. You can link a patient portal — MyChart (Epic), an Oracle Health or MEDITECH hospital portal — or Medicare's Blue Button instead of uploading paperwork. You sign in on the portal's own page and pick what to share — medications, upcoming appointments, conditions and allergies, care team; for Medicare, coverage and processed claims (we never keep the Medicare number). We receive a read-only access token for exactly those sections and store it encrypted (AES-256-GCM) on our servers; it is never sent to the browser or to an AI provider, and it is excluded from the copies we keep of your circle. We never see your portal password, and we never write anything to your chart. Everything the portal returns becomes a suggestion card that a family member approves or sets aside — nothing lands on the plan by itself. You can disconnect in the app at any time, which deletes the token; the portal also lists KoraCommand under its linked apps, where you can revoke access on that side.

Circle and invite information. Members, their roles, invitations sent, and who accepted, declined, or was removed.

Basic operational logs our servers create — request times and error records — used to keep the service running and secure.

The advertising pixel, and where it stops. To tell whether an ad brought a family here, an advertising pixel from Meta may run on our public marketing pages — the home page and the pricing, about, security, help and cost pages. It never runs inside the command center, on the pages where you create an account or sign in, on the account or invite pages, on the sample, on a link someone shared with you, or on any page that shows care information, and it never receives anything you put into your circle. The pages it may load on are a fixed list in our code, and our build fails if that list ever grows into the command center. We do not use session recording or any other third-party analytics.

Access is controlled by four roles, and there is exactly one Owner per circle. Collaborators can edit the plan; Contributors can add notes, tasks, and documents and can suggest changes to medications, appointments, and bills; Viewers can only read. Nobody outside your circle can see it.

Our team does not read your care data as a matter of course. We access it only when you ask us to for support, or when we are legally required to. If we ever need to look at something to fix a problem you have reported, we will do the minimum required to solve it.

When you upload a document or use the assistant, the relevant content is sent to one AI provider, who processes it on our behalf: Anthropic. That is the entire list for documents and the assistant. This is how a photo of a pill bottle becomes a medication in your plan. No other model provider can receive your documents or your conversations with the assistant — the list is enforced in our code, not just in this policy, and if Anthropic is unavailable the app falls back to on-server extraction rather than reaching for a different vendor. Voice typing, and the spoken commands that start and stop a visit recording, happen on your own phone or computer where the app offers them, and nowhere else: the sound of your voice is never sent to us or to anyone else, and the words it produces are treated like anything you type. Where your browser cannot do that on the device, the app offers buttons instead. The spoken commands listen only after both recording consents are given. “Read it to me” uses only the voices built into your device, so what it reads never leaves it. If you add KoraCommand to your home screen, the app keeps a copy of your plan on that phone so today's plan opens without signal; the copy is removed when you sign out, and a browser tab never keeps one.

Visit recordings are the one exception, and they are optional. With the doctor's consent and yours, the audio is sent to OpenAI's transcription service to be turned into a transcript, then discarded. Anthropic reads the transcript to write the debrief, as it would a document, and only the transcript, a short summary and the two consents are kept.

Kora, the care navigator on our public website, is a separate assistant that answers general caregiving, paperwork and product questions for visitors. It explains; it never diagnoses or advises on medication. It runs on an open-weight model hosted by Groq. It has no access to any care plan, account or document, and it never receives your family's content — what you type into it is a public-website conversation, so do not paste a relative's records there.

We send the minimum needed for the task. We do not use your family's data to train our own models, and we choose providers on the basis that they do not train on data submitted through their business APIs. Provider terms are outside our control and can change; we will update this page and tell existing families if the list or the terms change materially.

If you would rather your documents were never sent to an AI provider, use quick-scan mode, which extracts what it can locally and never leaves our servers. Data pulled from a connected patient portal is already structured, so it is never sent to an AI provider for extraction at all; the assistant sees the plan itself, the suggestion cards waiting for review, and the portal record's one-line summary — the same things a family member sees on screen.

Your circle is stored on a persistent disk on servers we operate (our hosting platform is Railway, in the United States). A dated snapshot of that disk is written once a day and kept for fourteen days, and we periodically copy the whole store to storage that is not on the same host. That is the backup we have today; we do not yet keep a continuously mirrored copy with a separate database provider, and we will update this page when we do. Data is protected in transit with HTTPS. Sessions are signed tokens tied to your account, and they end when you sign out.

Stripe processes the payments for paid plans. You enter your card or other payment details on Stripe's own checkout page, and you update your payment method or cancel on Stripe's billing page, so Stripe receives your billing details directly. We send Stripe your name, your email address, the plan you chose and our reference for your account. On our side we keep the plan, its status, the date it renews or ends, and the IDs Stripe uses for you and your subscription. KoraCommand never sees your card number and never stores it.

We keep your circle's information for as long as the circle exists. When the Owner closes a circle, its care data is deleted from our systems, and the daily snapshots that still contain it age out within fourteen days. Closing your account deletes your account record; if you are the Owner of a circle, you will be asked to transfer ownership or close the circle first, so that your family is never locked out of a plan they depend on.

• See it. Everything we hold about your circle is visible in the app.
• Export it. Ask and we will send you your circle's data in a machine-readable file.
• Correct it. Edit anything in the plan directly, or ask us.
• Delete it. The Owner opens Care circle → "Close this circle" and the circle's care data is deleted; or email [email protected] and we will do it for you.
• Leave. Any member can leave a circle at any time; Owners transfer ownership first.

Depending on where you live — for example California, or the EU and UK — you may have additional rights to access, portability, correction, deletion, and to object to certain processing. We apply these rights to everyone rather than sorting families by geography. We will not discriminate against you for exercising them.

KoraCommand is built for adults coordinating care and is not directed to children under 13. We do not knowingly collect information from children. A care plan may of course contain information about a family member of any age, entered by an adult member of the circle.

We hash passwords with scrypt, sign sessions, rate-limit sign-in attempts, scope every action to your role on the server rather than trusting the browser, and serve the app under a strict content security policy. No system is perfectly secure. If we ever discover a breach affecting your information, we will tell affected families promptly and plainly, with what happened and what to do.

If we change this policy in a way that matters, we will say so in the product rather than quietly editing this page.

Questions, requests, or concerns: [email protected]. We answer privacy requests within 30 days.

This policy describes real product behavior and is written in plain language on purpose. It has not yet been reviewed by counsel; a lawyer should review it before KoraCommand accepts paying customers.