Legal
HealthCare Analytics II, LLC, a Rhode Island limited liability company ("Healthcare Analytics," "we," "us," or "our") built Kayris™ around a simple rule: your health information is yours, and we don't want it. The app's risk calculations — every equation, every result, every trend line — run locally on your phone or tablet. There is no Kayris™ server that receives, stores, or processes the health data you enter.
This policy explains, plainly, what limited information we do handle (mostly account and billing mechanics), what we never see, and the one deliberate exception where you can choose to share data with a clinician.
If you use Kayris™ Professional as a clinician or member of a care team, see Section 06, which describes how that app handles patient information.
Because most of Kayris™ operates without a server, the categories of information we collect are narrow and largely non-health in nature. All features are currently available at no cost for a limited time — during this period, we are not collecting an account identifier, referral activity, or subscription data, because those systems are not yet active. The table below reflects what we collect today, and what we will begin collecting once Premium and the referral program are introduced (Sections 07–08):
| Category | What it includes | Status |
|---|---|---|
| Account identifier | A randomly generated, anonymous account ID — not your name, email, or a health-linked identifier. | Not yet active. Will be created only once Premium or the referral program launches. |
| Referral activity | Which anonymous account ID referred which other anonymous account ID, and the resulting reward tier. | Not yet active. See Section 08. |
| Subscription & purchase status | Whether you're on Basic or Premium, your billing cycle, and receipt validation data, to be handled by our billing processor, RevenueCat. | Not yet active. See Section 07. |
| Diagnostics | The app has no network access and includes no crash-reporting service. If you have chosen in your device settings to share analytics with app developers, Apple or Google may provide us with anonymous, aggregated crash reports. | Not collected by Kayris™. |
We do not require your name, email address, or any government-issued identifier to use Kayris™.
We never receive, store, or have access to:
These stay on your device, encrypted in local storage, unless you choose to share them using Sync with Clinic or an Export / Share button (see Section 05).
Every Kayris™ risk model — the 2024 AHA PREVENT™ equations, the ACC/AHA Pooled Cohort Equations, the ADA Diabetes Risk Estimator, and the Kairos Factor™ calculation — is embedded in the app itself and runs entirely on your phone or tablet. When you enter data or generate a result, no network request is made to transmit that information anywhere.
This design was a deliberate architectural choice, not an incidental one. It means:
Sync with Clinic is an optional feature that lets you share your Kayris™ data with a clinician using the companion Kayris™ Professional app. It is never automatic and never runs in the background. It only activates when you deliberately open Connect to Clinic and choose an action:
Kayris™Kayris_Patient_Data.json) that you send yourself — by email, file sharing, or another method you control — to your clinician.Data included in a Sync with Clinic export may include your risk inputs, calculated results, and trajectory history. It does not include your name or date of birth. Results you imported from your clinician are not included when you share your own data back.
Sync with Clinic and the Export / Share buttons on the Results, History, Progress and Healthspan screens (which create a PDF, HTML or data file that you send through your device's share sheet) are the only ways Kayris™ health data leaves your device, and each happens only when you choose it.
These files and QR codes are not encrypted. Anyone who has the file or can see the code can read the health information in it. Share them only with your clinician or people you trust, and use a sending method you trust — ordinary email, for example, is not private.
We do not operate the transmission channel and do not receive a copy of anything you export. It moves directly from your device to the destination you choose (a share sheet, a QR scan, or a file you send yourself). Once shared, that data is subject to the recipient's own privacy and recordkeeping practices, not this policy.
Kayris™ Professional is used by healthcare organizations and their staff to assess and track patients' cardiometabolic risk. It follows the same on-device design as the consumer app.
The organization's responsibilities. Each organization is responsible for using Kayris™ Professional in line with its own privacy and security obligations, including any that apply under HIPAA or other laws.
Deleting data. Deleting the app permanently removes all patient records stored on that device. Because no copy exists anywhere else, deleted data cannot be recovered.
All Kayris™ features — including what will eventually be offered as Premium — are currently available at no cost for a limited time. This may change in the future; any changes will be communicated in the app. No purchase, subscription, or payment is required or processed at this time, and we do not collect any billing or payment information from you right now.
When paid subscriptions are introduced, they will be processed through RevenueCat, a third-party subscription infrastructure provider, in combination with the Apple App Store and Google Play billing systems. At that point, RevenueCat will receive the information necessary to validate purchases and manage subscription status — your anonymous account identifier and purchase/receipt data — but never your health inputs or results, which never leave your device. Your payment card details will always be handled directly by Apple or Google, never by Kayris™ or RevenueCat. We will update the effective date of this policy before payment is introduced.
The Kayris™ referral program is not active in this version of the app. No referral tracking, account linking, or reward processing is currently taking place, and no referral-related data is collected.
When introduced, the program will track who referred whom using anonymous account identifiers only — never your name, email, or health data. Referral relationships and reward status will be tracked server-side, via infrastructure we operate, so that rewards apply correctly across devices and reinstalls. We will update this policy to describe that infrastructure before the feature is enabled.
We do not sell your information. Because Premium billing and the referral program are not currently active (Sections 07–08), the only current sharing is what you choose to send yourself — through Sync with Clinic or an Export / Share button (Section 05) — plus disclosures required by valid legal process.
Once Premium and the referral program are introduced, we will also share limited account and purchase data with RevenueCat, the Apple App Store / Google Play, and our infrastructure provider — never your health inputs or results — as described in Sections 07 and 08.
Health data stored locally on your device is encrypted at rest using your platform's standard secure storage. Kayris™ does not transmit your health data over a network. When you use Sync with Clinic or an Export / Share button, the file or QR code moves directly from your device to the recipient you choose and is not encrypted (see Section 05). Future account, purchase, and referral services will use encrypted (TLS) connections. No method of storage or transmission is 100% secure, and we encourage you to keep your device's operating system and lock-screen protections up to date.
Kayris™'s risk models are clinically validated for adults ages 30–79, and the app is intended for use within that range. A user's name and age may be entered directly into the app's on-device profile — for example, to personalize results or to distinguish family members sharing one device — but that information is stored locally and is never transmitted to us. We do not operate a server that receives, stores, or has visibility into anything entered in a Kayris™ profile, so we have no way to know a user's name or age, whether they are an adult or a child.
Because of this, there is no mechanism by which a child's name, age, or other profile information could reach us, and nothing for us to identify or delete on our end. If you're a parent or guardian with concerns about a child's use of the app, the most direct step is to delete the app or the relevant profile from the device — which permanently removes that locally stored information. You're also welcome to contact us at the address in Section 14 with any concerns.
Depending on your location, you may have additional rights under laws such as the CCPA or similar state privacy statutes, including the right to know, delete, or opt out of the sale of personal information. We do not sell personal information.
We may update this policy as Kayris™ evolves. If we make material changes, we'll update the effective date above and, where appropriate, notify you in the app. Continued use of Kayris™ after changes take effect constitutes acceptance of the revised policy.
Questions about this policy or your data can be sent to privacy@kayris.app.