Kurate is separate from Kivira's patient app, clinician tools, EHR workflows and clinical decision support services. This notice applies to Kurate. The privacy policy for Kivira's other services is available at https://privacy.kivira.health.
If your organization has a separate written agreement with Kivira for Kurate, that agreement may describe additional or different privacy, security, retention, controller, processor or confidentiality terms for your organization's use.
1. What this notice covers
This notice covers information processed through Kurate, including:
- Kurate accounts and authentication
- research queries, prompts, follow-up questions and submitted material
- AI-assisted answers, summaries, citations, study-quality assessments, saved results and feedback
- usage allowance, rate-limit, security, diagnostic and operational records
- support requests and service communications
- future paid-plan, subscription, billing or enterprise-access information, if introduced
This notice does not cover third party websites, journals, databases, publications or services that you may access through links or references in Kurate.
2. Information we collect
2.1 Information you provide
Depending on how you use Kurate, you may provide:
- Account and contact information: name, email address, organization, role, country or region, communication preferences and account settings.
- Authentication information: login method, Google identity information if you use Google sign-in, password-related records, one-time code events and backup contact email if provided.
- Research inputs: queries, prompts, follow-up questions, search filters, selected conditions, topics, notes, uploaded or pasted material if enabled, and other material you choose to submit.
- Outputs and saved results: AI-assisted answers, citations, summaries, comparisons, study-quality ratings, saved result pages, exports, history and user feedback.
- Communications: support requests, security reports, account-closure requests, survey responses and other messages you send us.
- Future billing information: billing contact details, plan selections, purchase records, invoice information and payment status if paid services are introduced. We expect card or payment-account details to be handled by payment processors rather than stored directly by Kivira.
2.2 Information collected automatically
When you use Kurate, we may automatically collect:
- Device and browser information: device type, operating system, browser type, language, time zone and approximate location inferred from IP address.
- Usage and interaction data: pages viewed, searches started, searches completed, saved results opened, follow-ups used, clicks, feature use, session activity, timestamps and allowance counters.
- Log and diagnostic data: IP address, event logs, error logs, latency, model or retrieval errors, crash data and performance metrics.
- Cookies and similar technologies: cookies and local storage used for authentication, security, preferences, session continuity, analytics and abuse prevention.
2.3 Information from third parties
We may receive information from:
- Identity providers: for example, Google sign-in information needed to authenticate your account.
- Service providers: hosting, database, security, analytics, monitoring, support, email, AI, retrieval and infrastructure providers may generate operational records or return processing results.
- Organizations: if you use Kurate through an organization, we may receive your organization affiliation, access status, role, domain, plan, authorization or support context.
- Payment processors: if paid services are introduced, we may receive payment status, transaction identifiers and billing metadata.
3. Health, sensitive and confidential information
Kurate is a research and information tool. It is not offered as a channel for storing patient records, providing emergency assistance or submitting patient-identifiable information by default.
Your research queries may concern health, medicine, treatment evidence or other sensitive topics. Those queries may reveal information about your research interests, professional work or personal interests. We process that information as described in this notice.
Do not submit patient-identifiable information, personal health records, credentials, confidential information, trade secrets, unpublished proprietary research, special-category personal data or another person's personal data unless a separate written agreement with Kivira expressly permits that use. If such an agreement applies, we process that information according to that agreement and applicable law.
Kurate is not intended to collect Protected Health Information under HIPAA unless a separate written agreement, such as a Business Associate Agreement or customer agreement, expressly says otherwise.
4. How we use information
We use information to:
- Provide and operate Kurate, including accounts, authentication, evidence search, saved results, follow-ups, citations, exports and service communications.
- Manage access and allowances, including free-query limits, rate limits, abuse prevention, account validation and future paid or enterprise access if introduced.
- Generate and improve outputs, including retrieving evidence, applying quality rubrics, generating AI-assisted summaries, answering follow-ups and preserving source references.
- Improve Kurate, including testing, evaluating, validating, debugging, developing, training, fine-tuning and improving Kurate-controlled systems, retrieval methods, quality rubrics, AI-assisted features, user experience, safety controls and abuse-prevention systems.
- Review quality and safety, including human review by Kivira personnel, contractors or service providers where needed to troubleshoot, evaluate, improve, secure or protect the Service.
- Support users, including responding to requests, resolving account issues, investigating security concerns and processing account-closure or rights requests.
- Analyze usage, including product analytics, performance monitoring, reliability analysis and feature planning.
- Communicate with you, including email codes, password resets, security notices, service notices, Terms or Privacy Notice updates and, where introduced and permitted, marketing or product updates.
- Comply with law and protect rights, including enforcing terms, maintaining records, responding to lawful requests and protecting Kivira, users, researchers, publishers and the public.
We do not use Kurate personal information for targeted advertising. We do not sell Kurate personal information or share it with data brokers.
5. AI-assisted features and service improvement
Kurate uses automated and AI-assisted methods to help search, summarize, compare and discuss research evidence. Your queries, submitted material, generated outputs, interaction records, feedback and related usage records may be used to operate, evaluate, validate and improve those features.
We may use external AI, infrastructure, analytics, security and support providers to process research queries, submitted material, generated outputs, interaction records and relevant evidence. We use contractual, technical and organizational controls intended to limit provider processing to the services they perform for us.
We do not permit service providers to use identifiable Kurate user data to train their general-purpose models except where expressly permitted by applicable law, contracts and required notices or authorizations. We may use de-identified, aggregated or otherwise privacy-protected information to evaluate and improve Kurate.
Kurate outputs are not decisions about you and are not intended to produce legal or similarly significant effects about you without human involvement.
6. Legal bases for processing
Where laws such as the EU GDPR or UK GDPR apply, our legal bases may include:
- Contract: to provide Kurate, manage accounts, save results, process requests and enforce the Kurate Terms.
- Legitimate interests: to secure, maintain, analyze, improve and protect Kurate; prevent abuse; support users; and develop evidence-curation and AI-assisted features, where those interests are not overridden by your rights and interests.
- Consent: where we ask for consent, such as certain optional communications, cookies or processing that requires consent under applicable law.
- Legal obligations: to comply with applicable laws, lawful requests, accounting, tax, sanctions, security or recordkeeping obligations.
We do not intentionally request special-category personal data through standard Kurate accounts. If special-category data is processed under a separate written agreement or because you choose to submit it, the applicable legal basis or condition will depend on the context, the agreement and applicable law.
7. How we share information
We may share information in the following circumstances:
7.1 Service providers
We use service providers for hosting, storage, databases, authentication, email, logging, analytics, monitoring, security, support, payments if introduced, retrieval, AI processing and other infrastructure or operational services. These providers may process information only to perform services for us and under contractual obligations.
7.2 Your organization
If you use Kurate through an organization, domain, complimentary access program, enterprise plan or separately agreed account, we may share information with that organization as needed to administer access, support the account, comply with the agreement, investigate misuse or report aggregate usage. We do not share the contents of individual research queries with an organization unless enabled by the product, required by the agreement, necessary for support or security, or otherwise disclosed to you.
7.3 Identity and payment providers
If you choose Google sign-in or another identity provider, that provider processes information according to its own terms and privacy notices. If paid services are introduced, payment processors may process billing and payment information according to their own terms and privacy notices.
7.4 Legal, safety and compliance reasons
We may disclose information if we believe it is necessary to:
- comply with applicable law, regulation, legal process or governmental request
- enforce our agreements and policies
- protect the rights, safety and security of Kivira, users, researchers, publishers, service providers or the public
- investigate or prevent fraud, abuse, security incidents or technical issues
7.5 Business transfers
If we are involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, information may be transferred as part of that transaction, subject to appropriate safeguards.
8. Cookies and analytics
Kurate may use cookies, local storage and similar technologies for authentication, security, session continuity, preferences, analytics, performance monitoring and abuse prevention. If we introduce optional advertising, marketing or non-essential analytics cookies, we will handle them in accordance with applicable law and any consent controls we make available.
9. Data retention
We retain information for as long as needed to provide Kurate and for legitimate business, security, legal, compliance and dispute-resolution purposes. Retention periods can vary based on the type of information, account status, saved results, legal obligations, security needs, backup cycles and any separate written agreement.
When you request account closure or deletion, we will delete, de-identify or restrict personal information in accordance with applicable law, our retention practices and any applicable agreement. We may retain records needed for security, fraud prevention, legal compliance, dispute resolution, backups and enforcement. Deletion may not remove information that has already been aggregated, de-identified or incorporated into model evaluations, system improvements or derived statistics in a form that is not reasonably linked to you.
10. Security
We use reasonable administrative, technical and physical safeguards designed to protect information from unauthorized access, use, disclosure, alteration or loss. These safeguards may include access controls, encryption in transit and at rest where appropriate, logging, monitoring and vendor controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
11. International transfers
Kivira is based in the United States. We and our service providers may process information in the United States and other countries that may not provide the same level of protection as your home country. Where required, we use appropriate safeguards for cross-border transfers, such as contractual commitments, data-transfer agreements or other mechanisms recognized by applicable law.
12. Your choices and rights
Depending on where you live and how you use Kurate, you may have rights to:
- access, correct or delete certain personal information
- object to, or restrict, certain processing
- request a copy of your information in a portable format
- withdraw consent where processing is based on consent
- opt out of certain communications or optional processing
- appeal or complain to a regulator where applicable law gives you that right
To submit a privacy or individual-rights request, contact us at privacy@kivira.health. We may need to verify your identity before responding. If you use Kurate through an organization, some requests may need to be routed through that organization.
13. Communications
We may send service-related communications such as email codes, password resets, account-security messages, service notices, allowance notices, support responses and Terms or Privacy Notice updates. Marketing communications, if introduced, will be handled separately in accordance with applicable law and any available opt-out or consent controls.
14. Children's privacy
Kurate is intended for users who are at least 18 years old. We do not knowingly collect personal information from children through Kurate. If you believe a child has provided us information, contact us and we will take appropriate steps.
15. Changes to this notice
We may update this Privacy Notice from time to time. We will post the updated version and update the "Last updated" date. If changes are material, we may provide additional notice through Kurate, by email or by other appropriate means.
16. Contact us
Kivira Axis Inc.
33 W 17th Street, Floor 6
New York, NY 10011
Privacy and individual-rights requests: privacy@kivira.health
Support: hello@kivira.health