Privacy Policy.

KuraPath is committed to protecting your privacy and handling your personal and health information responsibly, in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Transparency

We are clear about what data we collect, why we collect it, and how it is used. AI-generated health insights are clearly labelled as educational only.

Data Minimisation

We collect only the data necessary to provide our services. We do not build shadow profiles, purchase third-party data, or track you across the web.

Your Control

You own your data. You can access, correct, or delete it at any time. We will never sell your personal or health information to third parties.

Member Trust & Ethical AI Guarantee

How We Protect Your Health Data & Govern AI

KuraPath puts your privacy and trust above all else. We designed our architecture around three core ethical commitments so you can explore your health with complete peace of mind:

1. Bank-Grade Encryption

Your health records and personal information are secured with bank-grade encryption at rest and isolated so only you can access them.

2. Zero Public AI Training

Your personal health data, lab reports, and private conversations are never used to train public or base AI models.

3. Decoupled Telemetry

Analytics are completely separated from your identity into 5-year age buckets, keeping your identity shielded behind a privacy firewall.

1. Who We Are

KuraPath Pty Ltd (ABN 66 701 686 937), registered at Suite 17, 89-97 Jones Street, Ultimo, NSW 2007, Australia ("KuraPath", "we", "us", or "our") operates the KuraPath platform, including our website, mobile applications, APIs, and related services. KuraPath is a health education and information platform. We do not provide medical advice, diagnosis, or treatment.

For all privacy-related inquiries, you may contact our Privacy Officer at Suite 17, 89-97 Jones Street, Ultimo, NSW 2007, Australia or via email at privacy@kurapath.com / support@kurapath.com.

2. Information We Collect

We collect the following categories of personal information:

Category	Examples	Purpose
Identity information	Name, email address, date of birth, gender	Account creation, authentication, personalisation
Health information *	Pathology results, laboratory reports, biometric data, on-device sensor measurements (heart rate, SpO2, focus, balance, etc.), wearable data	AI-powered health education, journey tracking, longevity insights
Location data	City/suburb (user-provided or browser geolocation with consent)	Biosphere environmental intelligence (AQI, UV, pollen, disease surveillance)
Usage data	Pages visited, features used, journey progress, device type	Platform improvement, analytics, error monitoring
Communication data	Support requests, feedback submissions	Customer support, service improvement
Conversation data	Kura Guide chat history, KuraBridge translation session transcripts, voice transcripts, AI interaction logs	Persistent AI companion context, personalised health education continuity
Hotline Call Translation Audio	Transient live call audio streams (1800MEDICARE/healthdirect translation sessions)	Processed strictly transiently in-memory for real-time translation. Zero audio recording is stored, zero voice data is retained on external servers, and zero call streams are used for AI training. Downloadable transcripts are generated locally on device.
On-Device Spatial & Environmental Proximity	Local spatial coordinates, facility buffer distances, and hazard proximity queries	Processed 100% locally inside your browser via WebAssembly (DuckDB-WASM). Exactly 0 bytes of your geographic coordinates, buffer parameters, or calculation results are ever transmitted to KuraPath servers or any third-party cloud. The spatial intelligence engine runs completely offline with verified zero data transfer.

* Health information is classified as "Sensitive Information" under the Privacy Act 1988 (Cth) and is collected only with your explicit, informed consent.

3. How We Use Your Information

We use your personal information for the following purposes:

To provide, maintain, and improve the Platform and its features;
To generate AI-powered health education insights from your uploaded data;
To provide Biosphere environmental intelligence based on your location;
To provide Kura Guide persistent AI companion services, including storing conversation history for continuity;
To track your health journey progress and longevity metrics;
To communicate with you about your account, support requests, and service updates;
To detect, prevent, and address technical issues, fraud, or security incidents;
To comply with legal obligations, including the Privacy Act 1988 and Australian Privacy Principles;
To generate de-identified, aggregated analytics to improve our AI models and service quality (your identity is never included in aggregated datasets);
To query cached satellite data using your location coordinates to generate environmental health metrics for Biosphere features. Satellite lookups are performed against data cached on secure infrastructure, and no user data is sent to Google or any third-party satellite data provider;
On-device audio processing (noise health classification) runs entirely in your browser and does not transmit audio recordings to any server;
No personally identifiable information (PII) is transmitted to satellite data providers. All satellite data queries are resolved against self-hosted cached datasets.

Plain English

We use your data only to help you understand your health better and to keep the platform running. We never sell your data, and we never will.

4. AI and Machine Learning

KuraPath uses AI models to process your health data and generate educational insights. We are committed to transparency in how AI is used:

AI-generated outputs are clearly labelled as educational and are not medical advice;
Identity separation: Before any data is processed by AI models, personally identifiable information is separated from clinical values;
No third-party training: Your personal health data is never used to train third-party AI models;
Evidence anchoring: AI insights are grounded in peer-reviewed clinical research using retrieval-augmented generation (RAG) to ensure explainability;
Hallucination monitoring: We actively monitor AI outputs for accuracy and maintain logs of potential inaccuracies for continuous improvement.

Privacy Architecture: On-Device vs Cloud

KuraPath uses a hybrid processing architecture designed to give users and enterprise partners maximum control over where sensitive health data is processed:

Cloud (default): Health education synthesis, real-time voice translation, document parsing, and embedding generation. De-identified health values only are sent to cloud AI services under strict zero-retention agreements.
On-device (optional, for compatible devices): Local health concept classification, on-device health education inference, and local encrypted processing. When enabled, these features run entirely in the browser and no health data leaves the device.

Note: On-device features are optional and depend on device compatibility (hardware acceleration, sufficient memory). Cloud-first is the default experience. On-device capabilities provide an additional privacy layer for users and enterprise partners who require zero-data-transmission options.

Automated Decision-Making Disclosure

In compliance with the Australian Privacy Act 1988 (Cth), as amended by Tranche 1 reforms, we provide the following disclosure about automated decision-making on the Platform:

What is automated: KuraPath uses artificial intelligence (AI) to process uploaded health documents, generate educational explanations of health results, provide environmental health insights, and personalise health education content. These processes run automatically when you upload data or interact with the platform.
Logic involved: Our AI system uses clinical evidence retrieval grounded in peer-reviewed clinical literature, combined with a multi-layer safety framework that checks outputs for accuracy, hallucination risk, and scope compliance.
Nature of outputs: All AI outputs are educational only and are not medical advice, diagnosis, or treatment recommendations. KuraPath is a health education platform, not a Software as a Medical Device (SaMD). AI-generated content is clearly labelled as such.
No consequential decisions: KuraPath does not make decisions that produce legal effects or similarly significant impacts on individuals. The platform provides information to support your health literacy, with all healthcare decisions remaining with you and your healthcare provider.
Human oversight: AI outputs are reviewed for quality by our clinical advisory framework. You can contact us at any time to request a human review of any AI-generated content.
Your right to opt out: You can use the Privacy Mode toggle to process your health documents entirely on-device, with zero data transmitted to cloud AI services. You can also choose not to upload health documents and use the platform's non-AI features.

Enterprise-Grade & Post-Quantum Protection

KuraPath implements a defense-in-depth security architecture designed for long-term protection of health data against current and future computational threats:

Bank-grade field-level encryption: Sensitive health fields are individually encrypted at rest using industry-standard authenticated encryption, providing defense-in-depth beyond basic database-level encryption.
Post-quantum transit protection: All communications between your device and our servers employ hybrid post-quantum key exchange, safeguarding health data against future decryption threats.
Pseudonymization: Health data is pseudonymized and separated from personal identifiers before processing, ensuring that health values cannot be linked back to individual identities without strictly controlled cryptographic keys.
Cryptographic content verification: AI-generated educational content is digitally signed to verify authenticity, prevent tampering, and maintain a verifiable chain of trust.
One-way IP hashing: IP addresses are one-way hashed before storage, ensuring they cannot be reversed to identify individuals.

5. Disclosure of Information

We may disclose your personal information to:

Service providers: Trusted third parties who assist us in operating the Platform (e.g. cloud hosting, authentication, email delivery, error monitoring). These providers are contractually bound to protect your data;
Healthcare providers: Only with your explicit consent, if you choose to share your health profile with a connected provider via KuraBridge;
Legal authorities: Where required by law, court order, or to protect the safety of individuals;
Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred, subject to the same privacy protections.

We do not sell, rent, or trade your personal or health information to third parties for their marketing or commercial purposes.

6. Data Security

We implement robust, layered security measures to protect your data, including post-quantum cryptographic controls that exceed standard industry practice:

Encryption at rest: All personal and health data is secured using bank-grade authenticated encryption at rest. Sensitive health records receive dedicated field-level encryption, providing defense-in-depth protection beyond database-level encryption;
Encryption in transit: All data transmitted between your device and our servers uses TLS 1.3 with hybrid post-quantum key encapsulation. This ensures robust protection against interception and long-term decryption threats;
Post-quantum cryptography: Our cryptographic architecture aligns with the latest standards for quantum resistance, combining classical and post-quantum key exchange mechanisms for long-term health data confidentiality;
Access control: Database-level access controls ensure your data is architecturally isolated from all other users. Cross-tenancy data access is structurally prevented;
Authentication: Robust identity protection supporting multi-factor authentication (MFA), biometric passkeys, and FIDO2/WebAuthn for secure account access;
Monitoring: Continuous security monitoring, automated error tracking, and anomaly detection across all authentication and data access events;
Incident response: Documented incident response procedures aligned with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), with defined escalation paths and notification timelines.

Sovereign On-Device Spatial Intelligence & Zero Location Transmission

When utilizing Biosphere environmental proximity tools (such as finding nearby medical facilities, cooling centers, or calculating hazard buffer zones), calculations are executed 100% locally on your device via in-browser WebAssembly (DuckDB-WASM). Unlike traditional mapping platforms that stream GPS coordinates to remote cloud APIs, KuraPath transmits 0 bytes of location coordinates, query radiuses, or spatial results to our servers or any third-party infrastructure. This provides true sovereign privacy and complete offline functionality.

For full technical details on our security architecture, please see our Security Disclosure.

7. Cross-Border Data Transfers

Some of our service providers may process data outside Australia. In accordance with APP 8, before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient complies with the Australian Privacy Principles or is subject to a substantially similar privacy regime.

Where our cloud infrastructure or AI processing services are hosted outside Australia, we ensure appropriate contractual safeguards are in place and data remains encrypted in transit and at rest.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:

Active accounts: Data is retained for the duration of your account;
Deleted accounts: Upon account deletion or data erasure request, personal data is removed from production systems within 30 days and from backup systems within 90 days;
Legal obligations: Certain records may be retained for up to 7 years where required by Australian tax, corporate, or health record legislation;
De-identified data: Aggregated, de-identified data that cannot be linked back to you may be retained indefinitely for research and service improvement.

9. Your Rights

Under the Australian Privacy Principles and applicable law, you have the right to:

Access: Request access to the personal information we hold about you (APP 12);
Correction: Request correction of inaccurate, incomplete, or out-of-date personal information (APP 13);
Deletion: Request the deletion of your personal data. We will action erasure requests promptly, subject to any legal obligations to retain certain records;
Data portability: Request a copy of your data in a commonly used, machine-readable format;
Withdraw consent: Withdraw your consent for the collection or use of sensitive information at any time. Note that withdrawal of consent may affect your ability to use certain Platform features;
Opt out of marketing: Unsubscribe from marketing communications at any time via the link in our emails or by contacting us.

To exercise any of these rights, contact us at support@kurapath.com. We will respond to requests within 30 days.

10. Notifiable Data Breaches

We maintain a rigorous data breach response plan in accordance with Part IIIC of the Privacy Act 1988 (Notifiable Data Breaches scheme). In the event of a data breach that is likely to result in serious harm:

We will notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable;
We will notify affected individuals with clear information about the breach, the type of data involved, and recommended actions;
We will take immediate steps to contain the breach and mitigate any potential harm.

11. Children's Privacy

KuraPath is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at support@kurapath.com.

12. Cookies and Analytics

KuraPath uses cookies and similar technologies for:

Essential cookies: Required for authentication, session management, and security. These cannot be disabled;
Analytics cookies: Used to understand how the Platform is used and to improve the user experience. We use privacy-respecting analytics tools;
Error monitoring: We use Sentry for error tracking to maintain platform reliability. Error reports may include technical metadata but not health data.

We do not use advertising cookies or engage in cross-site behavioural tracking.

13. Complaints

If you believe we have breached the Australian Privacy Principles or handled your personal information inappropriately, you may lodge a complaint by contacting us at support@kurapath.com.

We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC).

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or a prominent notice on the Platform at least 14 days before taking effect. Your continued use of the Platform after such notification constitutes acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically. This policy is also available at kurapath.com/privacy.