KuraPath is a health education and wellbeing platform that processes sensitive health information. We recognise the critical importance of protecting this data and are committed to implementing and maintaining security measures that meet or exceed industry standards and comply with Australian regulatory requirements, including the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme.

Security is not an afterthought. It is embedded into every layer of our architecture, from how we store data to how our AI processes health information.

• At rest: All stored data, including health records, user profiles, and AI-generated insights, is encrypted using AES-256-GCM encryption, classified by NIST as quantum-resistant;
• In transit: All network communications use TLS 1.3 with hybrid post-quantum key encapsulation (ML-KEM-768) and active ML-DSA-65 signatures, ensuring data cannot be intercepted or tampered with during transmission, including by future quantum computers;
• Field-level encryption: Sensitive health fields (raw results, AI analysis, health signals) are individually encrypted using AES-256-GCM with unique initialisation vectors (IVs) per field, providing defence-in-depth beyond database-level encryption;
• API security: All API endpoints require authenticated requests. Sensitive operations require additional verification;
• Key management: Encryption keys are managed through secure key management services with automatic rotation and strict access controls.

• User authentication: Powered by Clerk, supporting email/password, social login, multi-factor authentication (MFA), and FIDO2/WebAuthn biometric passkeys;
• Row Level Security (RLS):Enforced at the Supabase database level. Every query is scoped to the authenticated user, making it architecturally impossible to access another user's data;
• Principle of least privilege: Internal access to production systems is restricted to authorised personnel only, with role-based access controls and audit logging;
• Administrative access: Admin functions are protected by additional identity verification and are restricted to designated platform administrators;
• Session management: Sessions are securely managed with automatic expiry, token rotation, and secure cookie settings.

Given that KuraPath uses AI to process sensitive health data, we implement specific safeguards:

• Identity separation: Personally identifiable information (PII) is separated from clinical data before AI processing. AI models receive de-identified health values only;
• No third-party training: Your health data is never used to train third-party AI models or shared with AI providers for model improvement;
• Voice Data Privacy: Audio streams from Voice AI sessions are processed ephemerally via secure WebSocket connections. Voice interactions are transcribed for your clinical history, but raw audio is never permanently stored or used for model training;
• Kura Guide Conversation Persistence: Kura Guide conversation history is stored using the same field-level encryption (AES-256-GCM) and row-level security (RLS) as all health data. Conversations are scoped exclusively to your account and cannot be accessed by other users or KuraPath staff without authorisation;
• KuraBridge Translation Privacy: No voice audio from KuraBridge medical translation sessions is recorded or stored. Only text transcripts are generated, encrypted at rest with AES-256-GCM, and accessible only to the authenticated session participants;
• Prompt injection protection: We implement input validation, sanitisation, and adversarial red-team testing to protect against prompt injection attacks on AI systems;
• Industry-leading 5-layer safety pipeline: Every AI output passes through a five-layer safety pipeline: (1) deterministic pattern scanning with 40+ regex rules and a 70+ drug/supplement blocklist, (2) dual-model LLM consensus evaluation using two independent Gemini instances scoring against a 10-criterion weighted rubric, (3) grounding verification that cross-references AI claims against retrieved evidence documents, (4) FMECA-inspired severity classification that routes actions from pass to block based on clinical risk, and (5) full observability with every evaluation persisted for admin audit and drift detection;
• Output monitoring: AI outputs are continuously monitored for hallucinations and inaccuracies. We maintain structured hallucination logs with severity classification and admin review workflows;
• Automated quality testing: We maintain a comprehensive evaluation test suite that is automatically run on every change to AI-related code, including adversarial attack tests, multilingual input validation, and bias and fairness checks;
• Rate limiting: API endpoints, including AI-powered features, are rate-limited to prevent abuse and ensure fair usage.

• Cloud hosting: The Platform is hosted on enterprise-grade cloud infrastructure with high availability, automatic scaling, and geographic redundancy;
• Network security: VentraIP WAF, DDoS protection, and network segmentation protect against external threats. Geo-blocking available;
• Automated backups: Daily encrypted backups via Supabase with point-in-time recovery (PITR). Deleted account data purged from production within 30 days and from backups within 90 days;
• Dependency management: Automated dependency vulnerability scanning via Dependabot. Critical patches applied within 72 hours;
• Environment isolation: Development, staging, and production environments are strictly separated. Production data is never used in development or testing;
• Network security: VentraIP Anycast DNS, DDoS protection, and network segmentation
• Storage security: Geospatial raster data (environmental embeddings, Optimised GeoTIFF files from AlphaEarth and Dynamic World) is served from VentraIP sovereign object storage with bucket-level access control policies and encrypted transit.. All geospatial processing occurs on KuraPath infrastructure — no user location data or PII leaves KuraPath servers for satellite lookups;
• On-device audio inference:The Perch 2.0 noise classification model runs entirely in the user's browser via WebGPU/ONNX Runtime. No audio data is transmitted to any external server.

We maintain continuous monitoring and a documented incident response procedure:

• Centralised logging: Application, infrastructure, and access events aggregated via Sentry and Vercel logging. All AI interaction logs maintained for performance monitoring and safety compliance;
• Log retention: Error and access logs retained for a minimum of 90 days online. Audit-relevant records (AI interaction logs, consent records, EULA acceptance events) retained for the lifetime of the account. Sentry retains event data for 90 days with full stack traces;
• Error monitoring: Real-time error tracking and alerting via Sentry, with sampling controls to balance coverage and performance;
• Anomaly detection: Monitoring of authentication patterns, API usage, and data access for unusual activity;
• Automated alerting: Real-time alerts with escalation to on-call engineering for critical events;
• Incident response plan: Documented procedures for identifying, containing, analysing, and recovering from security incidents, with defined escalation paths and roles;
• Notifiable Data Breaches: In compliance with the NDB scheme (Part IIIC, Privacy Act 1988), we will notify the OAIC and affected individuals of eligible data breaches as soon as practicable;
• Post-incident review: All security incidents are followed by a root cause analysis and implementation of preventive measures.

We use carefully selected third-party services to operate the Platform. Each is evaluated for security and privacy compliance:

All third-party providers are evaluated for their security practices and compliance with applicable privacy laws. Public data API providers (Open-Meteo, AIHW) receive no personal or health information. We ensure appropriate contractual protections are in place with all other providers.

KuraPath uses carefully selected infrastructure providers, each evaluated for security compliance. The following table summarises where data is processed and stored. Our primary health database is hosted in ap-southeast-2 (Sydney, Australia), ensuring health data sovereignty.

In accordance with APP 8, before disclosing personal information to any overseas recipient, we take reasonable steps to ensure the recipient complies with the Australian Privacy Principles or is subject to a substantially similar privacy regime.

We value the security research community and welcome responsible disclosure of vulnerabilities. If you discover a security issue, please report it to us:

Our commitment to researchers:

• We will acknowledge your report within 48 hours;
• We will provide regular updates on our progress in addressing the vulnerability;
• We will not take legal action against researchers who report vulnerabilities in good faith and comply with this disclosure policy;
• We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it (typically 90 days);
• We ask that you do not access, modify, or delete user data during your research.

KuraPath aligns its security practices with recognised frameworks and regulatory requirements:

• Privacy Act 1988 (Cth): Full compliance with the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme;
• OWASP Top 10: Our application development follows OWASP guidelines to mitigate common web application security risks;
• NIST Cybersecurity Framework:We align our security governance with the NIST framework's five core functions: Identify, Protect, Detect, Respond, and Recover;
• Australian Cyber Security Centre (ACSC) Essential Eight:We implement the ACSC's Essential Eight mitigation strategies as applicable to our cloud-native architecture;
• GDPR awareness: For users accessing from the European Economic Area, we implement data protection measures consistent with GDPR principles;
• ISO 27001 supply chain: Our primary data infrastructure provider (Supabase) is certified to ISO/IEC 27001:2022, providing independently audited assurance of information security management across our database layer;
• APRA CPS 230 Readiness:KuraPath's security architecture is designed to support APRA's CPS 230 operational resilience requirements for insurer vendor onboarding, including service continuity planning, incident response, and third-party risk management controls.

Security is an ongoing commitment. We continuously review and improve our security posture through:

• Regular security reviews and code audits;
• Staying current with emerging threats and vulnerabilities;
• Updating dependencies and patching known vulnerabilities promptly;
• Reviewing and updating security policies and procedures;
• Learning from security incidents and near-misses.

This Security Disclosure will be updated as our security practices evolve. Material changes will be noted on this page.