Consumer health data
Kiri Consumer Health Data
Privacy Policy
About this policy
Effective date: November 15, 2026
Kiri helps families keep allergy medication close. To do that, we hold information about allergies and medication, which some US state laws call “consumer health data”. This policy explains what consumer health data we collect, why, who we share it with, and the rights you have over it.
It applies to the Kiri app, the Kiri pouch and sensor, carrykiri.com, and the public allergy profile you can share by link or QR code. “Kiri”, “we” and “us” mean Kiri Products Inc., 4340 E Indian School Rd Ste 21, Phoenix, AZ 85018, United States. Our general Privacy Policy covers all other personal data. Where the two differ for consumer health data, this policy applies.
Kiri is a reminder and information tool. It is not a medical device and does not replace your doctor’s advice or your emergency action plan.
The consumer health data we collect, and why
We only collect it to provide the Kiri service you asked for. We don’t use it for advertising, and we don’t sell it.
| What we collect | Examples | Why we collect it |
|---|---|---|
| Allergies | Food allergies, insect stings and other allergens, with specific triggers | To build the allergy profile and the emergency information you choose to share |
| Medication | Medication types and brands (such as epinephrine, antihistamine, inhaler), dose, and your notes | To show what medication is carried and how much makes one dose |
| Medication expiry dates | The expiry date of each item in a pouch | To remind you before medication expires |
| Emergency action plan settings | Whether asthma is present, and when epinephrine should be given | To show helpers what to do in an emergency |
| Profile details linked to the above | The name and date of birth of the person the profile is for, and an emergency contact | So the right profile reaches the right person and helpers know who to call |
| Pouch and sensor activity | Whether the pouch is near your phone, when it was last seen, battery level, and alerts | To warn you when medication is left behind or a sensor stops reporting. This can show that someone carries emergency medication |
| Location you set | Safe locations you choose, where left-behind alerts are paused | To avoid alerts when the pouch is somewhere you have marked as safe |
The person the profile is about is often a child. The account owner creates and manages profiles and decides who else gets access, including a teen who carries their own pouch. Kiri accounts are for people 13 and older.
Where it comes from
- From you:what you enter in the app, and what a caregiver in your care circle enters on your profile’s behalf.
- From your Kiri sensor and phone: pouch activity and alerts, recorded by the Kiri app on your phone.
We don’t buy consumer health data, and we don’t receive it from doctors, insurers or other companies.
Who we share it with
We share consumer health data only in these ways:
- People you choose. Members of your care circle see the profiles and pouches you share with them. You invite them, and you can remove them at any time.
- Anyone with your public profile link or QR code. If you create a public profile, anyone who opens the link or scans the code sees the details you chose to show, such as first name, allergies, emergency medication and an emergency contact. This is meant for helpers in an emergency. You can turn the link off at any time, and the old link then stops working.
- Service providers who process it for us. These companies host, store or deliver parts of the service under contract, and may only use the data to provide it to us:
- Google Cloud and Firebase: hosting, storage and sign-in, in the United States
- Vercel: hosts carrykiri.com, including the public profile page
- Expo, Apple and Google: deliver alerts to your phone. Alert text contains names and pouch names, not allergy or medication details
- When the law requires it, for example a valid court order, and only to the extent required.
- If Kiri is sold or merged, to the buyer, who must keep this policy’s promises or ask for your consent again.
We have no affiliates that receive consumer health data. You can ask us for the list of every third party we have shared your consumer health data with (see Your rights).
What we never do
- We never sell consumer health data.
- We never use it for advertising, or share it with advertisers or data brokers.
- We never use it to train AI models.
- We never place a geofence around a hospital, clinic or other place where health care is provided to track or contact people there.
- We never use your consumer health data for a purpose you haven’t consented to.
How long we keep it, and how we protect it
We keep consumer health data while your account is open. When you delete a profile, a pouch or your whole account, we delete the related data from our live systems within 30 days. Encrypted backups, kept for disaster recovery, are deleted on their own schedule within 14 weeks. If we ever restore from a backup, we delete your data again before the system goes back online.
The data is encrypted in transit and at rest. Access to production data is limited to a very small number of named Kiri staff, using two-step sign-in. Error reports we send to our monitoring provider have health details removed before they leave your phone or our servers.
Your consent
We ask for your consent to collect consumer health data before you enter any, with its own checkbox in the app, separate from accepting our Privacy Policy. We record when you gave it and which version of this policy it applied to. If this policy changes in a way that affects your consent, we ask again.
Sharing with care-circle members and through a public profile only happens when you choose to do it, which is how you consent to that sharing.
You can withdraw consent at any time by deleting the profile, or by deleting your account in the app (Menu > My Profile > Delete my account). We then stop collecting consumer health data from you and delete it as described above. Kiri can’t work without this data, so withdrawing consent ends the service for that profile or account.
Your rights
Wherever you live in the United States, you can:
- Know and access: confirm whether we collect or share your consumer health data, get a copy of it, and get the list of every third party we shared it with, with their contact details.
- Delete: have your consumer health data deleted, including by the service providers we shared it with. You can do this yourself in the app, or ask us.
- Withdraw consent as described above.
- Correct inaccurate data, which you can usually do yourself in the app.
Using these rights is free, up to twice a year, and won’t change the price or quality of Kiri.
How to ask: email privacy@carrykiri.comfrom the email address on your Kiri account, or use the in-app options. If you write from another address, we’ll confirm your identity through your account email before acting. Someone you authorise can ask on your behalf with proof of that authority.
When we answer:within 45 days. If we need more time, we’ll tell you why within those 45 days and answer within another 45.
Appeals:if we refuse your request, we’ll explain why. You can appeal by replying to our answer with “Appeal” in the subject line. We’ll answer the appeal in writing within 45 days, with our reasons. If you’re still not satisfied, you can contact the Attorney General of Washington (atg.wa.gov) or of your own state.
Changes to this policy
We’ll post any change here with a new effective date. If a change affects what we collect, why, or who we share it with, we’ll tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it.
Contact
Kiri Products Inc., 4340 E Indian School Rd Ste 21, Phoenix, AZ 85018, United States
Email: privacy@carrykiri.com