Security Disclosure.

KuraPath is a health education and wellbeing platform that processes sensitive health information. We recognise the critical importance of protecting this data and are committed to implementing and maintaining security measures that meet or exceed industry standards and comply with Australian regulatory requirements, including the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme.

Security is not an afterthought. It is embedded into every layer of our architecture, from how we store data to how our AI processes health information.

• At rest: All stored data, including individual records, user profiles, and AI-generated insights, is encrypted using NIST-standardised post-quantum cryptography and authenticated field-level encryption, classified by NIST as quantum-resistant;
• In transit: All network communications use TLS 1.3 with hybrid post-quantum key encapsulation and active post-quantum signatures, ensuring data cannot be intercepted or tampered with during transmission, including by future quantum computers;
• Field-level encryption: Sensitive personal health data fields (raw results, AI analysis, health signals) are individually encrypted using NIST-standardised post-quantum cryptography and authenticated field-level encryption with unique per-field cryptographic parameters, providing defence-in-depth beyond database-level encryption;
• API security: All API endpoints require authenticated requests. Sensitive operations require additional verification;
• Key management: Encryption keys are managed through secure key management services with automatic rotation and strict access controls.

• User authentication: Powered by enterprise identity and authentication providers, supporting email/password, social login, multi-factor authentication (MFA), and FIDO2/WebAuthn biometric passkeys;
• Row Level Security (RLS): Enforced at the database level. Every query is scoped to the authenticated user, making it architecturally impossible to access another user's data;
• Principle of least privilege: Internal access to production systems is restricted to authorised personnel only, with role-based access controls and audit logging;
• Administrative access: Admin functions are protected by additional identity verification and are restricted to designated platform administrators;
• Session management: Sessions are securely managed with short-lived ephemeral session tokens, automatic expiry, token rotation, and secure cookie settings.

Given that KuraPath uses AI to process sensitive health data, we implement specific safeguards:

• Identity separation: Personally identifiable information (PII) is separated from clinical data before AI processing. AI models receive de-identified health values only;
• No third-party training: Your health data is never used to train third-party AI models or shared with AI providers for model improvement;
• Voice Data Privacy: Audio streams from Voice AI sessions are processed ephemerally via secure WebSocket connections. Voice interactions are transcribed for your clinical history, but raw audio is never permanently stored or used for model training;
• Kura Guide Conversation Persistence: Kura Guide conversation history is stored using the same NIST-standardised post-quantum cryptography and authenticated field-level encryption and row-level security (RLS) as all personal health data. Conversations are scoped exclusively to your account and cannot be accessed by other users or KuraPath staff without authorisation;
• KuraBridge Translation Privacy: No voice audio from KuraBridge medical translation sessions is recorded or stored. Only text transcripts are generated, protected at rest with NIST-standardised post-quantum cryptography and authenticated field-level encryption, and accessible only to the authenticated session participants;
• Prompt injection protection: We implement input validation, sanitisation, and adversarial red-team testing to protect against prompt injection attacks on AI systems;
• Multi-layer AI safety framework: KuraPath employs a multi-layer AI safety framework that includes automated pattern scanning, multi-model consensus evaluation, clinical evidence grounding, automated risk classification, and continuous audit logging for quality assurance;
• Output monitoring: AI outputs are continuously monitored for hallucinations and inaccuracies. We maintain structured hallucination logs with severity classification and admin review workflows;
• Automated quality testing: We maintain a comprehensive evaluation test suite that is automatically run on every change to AI-related code, including adversarial attack tests, multilingual input validation, and bias and fairness checks;
• Rate limiting: API endpoints, including AI-powered features, are rate-limited to prevent abuse and ensure fair usage.

• Cloud hosting: The Platform is hosted on enterprise-grade cloud infrastructure with high availability, automatic scaling, and geographic redundancy;
• Network security: Enterprise WAF, DDoS protection, and network segmentation protect against external threats. Geo-blocking available;
• Automated backups: Regular encrypted backups with point-in-time recovery. Deleted account data is purged from production and backups in accordance with our data retention policy;
• Dependency management: Automated dependency vulnerability scanning with continuous monitoring. Critical patches are prioritised and applied promptly;
• Environment isolation: Development, staging, and production environments are strictly separated. Production data is never used in development or testing;
• Storage security: Geospatial and environmental reference data is served from sovereign Australian storage with strict access control policies and encrypted transit. No personal identity or clinical data is transmitted to external environmental data feeds.

We maintain continuous monitoring and a documented incident response procedure:

• Centralised logging: Application, infrastructure, and access events are aggregated via dedicated security monitoring platforms. AI interaction logs are maintained for performance monitoring and safety compliance;
• Log retention: Error and access logs are retained for a minimum of 90 days online. Audit-relevant records (AI safety logs, consent records, EULA acceptance events) are retained for the lifetime of the account;
• Error & telemetry sanitization: Automated telemetry scrubbing strips personal and clinical data before diagnostic events are recorded;
• Anomaly detection: Monitoring of authentication patterns, API usage, and data access for unusual activity;
• Automated alerting: Real-time alerts with escalation to on-call engineering for critical events;
• Incident response plan: Documented procedures for identifying, containing, analysing, and recovering from security incidents, with defined escalation paths and roles;
• Notifiable Data Breaches: In compliance with the NDB scheme (Part IIIC, Privacy Act 1988), we will notify the OAIC and affected individuals of eligible data breaches as soon as practicable;
• Post-incident review: All security incidents are followed by a root cause analysis and implementation of preventive measures.

KuraPath partners exclusively with enterprise-grade infrastructure providers that maintain independent security certifications:

Public environmental and reference data sources receive no personal or health information. Detailed sub-processor documentation is available to institutional customers under our Data Processing Addendum.

Our primary health database and document storage are hosted in Australian sovereign cloud data centres (Sydney), ensuring Australian health data sovereignty.

In accordance with APP 8, before disclosing personal information to any overseas recipient, we take reasonable steps to ensure the recipient complies with the Australian Privacy Principles or is subject to a substantially similar privacy regime.

We value the security research community and welcome responsible disclosure of vulnerabilities. If you discover a security issue, please report it to us:

Our commitment to researchers:

• We will acknowledge your report within 48 hours;
• We will provide regular updates on our progress in addressing the vulnerability;
• We will not take legal action against researchers who report vulnerabilities in good faith and comply with this disclosure policy;
• We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it (typically 90 days);
• We ask that you do not access, modify, or delete user data during your research.

KuraPath aligns its security practices with recognised frameworks and regulatory requirements:

• Privacy Act 1988 (Cth): Full compliance with the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme;
• OWASP Top 10: Our application development follows OWASP guidelines to mitigate common web application security risks;
• NIST Cybersecurity Framework: We align our security governance with the NIST framework's five core functions: Identify, Protect, Detect, Respond, and Recover;
• Australian Cyber Security Centre (ACSC) Essential Eight: We implement the ACSC's Essential Eight mitigation strategies as applicable to our cloud-native architecture;
• GDPR awareness: For users accessing from the European Economic Area, we implement data protection measures consistent with GDPR principles;
• ISO 27001 supply chain: Our primary Australian sovereign cloud data infrastructure provider is certified to ISO/IEC 27001:2022, providing independently audited assurance of information security management across our database layer;
• APRA CPS 230 Readiness: KuraPath's security architecture is designed to support APRA's CPS 230 operational resilience requirements for insurer vendor onboarding, including service continuity planning, incident response, and third-party risk management controls.

Security is an ongoing commitment. We continuously review and improve our security posture through:

• Regular security reviews and code audits;
• Staying current with emerging threats and vulnerabilities;
• Updating dependencies and patching known vulnerabilities promptly;
• Reviewing and updating security policies and procedures;
• Learning from security incidents and near-misses.

This Security Disclosure will be updated as our security practices evolve. Material changes will be noted on this page.