Your data,
your control.

Kiri exists to help allergy families stay prepared. To do that, we collect a small amount of information about you, your family, and your pouch. Here’s what we want you to know up front:

• We collect what we need to make Kiri work, and not more.
• We never sell your data. We do not share it with advertisers.
• We do not use your or your child's health information to train AI models.
• You can see your data, export it, correct it, or delete it at any time.
• Health information is treated as the most sensitive category of data we hold, and we apply the strongest available protections to it.

What follows is the full version. We’ve kept it as direct as we can. If you have questions, write to us at privacy@carrykiri.com.

This privacy policy applies to the Kiri smart pouch, the Kiri mobile app, the carrykiri.com website, and any related services we operate (collectively, the Services).

If you are located in the European Economic Area or the United Kingdom, our designated representative under Article 27 GDPR is: [EU representative name and contact — to be confirmed]

We have appointed a Data Protection Officer who can be contacted at: [DPO contact — to be confirmed]

We collect personal information in three ways: when you give it to us directly, when you use the Services, and when our pouch hardware reports back to the app.

Information you give us

• Account information. Name, email address, password, and basic profile details when you create a Kiri account.
• Allergy and health information. Your child's or family member's allergy profile, prescribed medications, dosage instructions, physician name and contact, emergency contacts, and any care notes you choose to include. This is special category health data — see Section 6.
• Care circle members. Names and email addresses of people you invite to your care circle (caregivers, teachers, grandparents, coaches).
• Payment information. When you purchase a pouch or subscribe to Kiri+, our payment processor collects your payment details. Kiri does not store full card numbers on our servers.
• Support correspondence. When you contact us, we keep a record of the conversation so we can help you.

Information generated when you use the Services

• Device and usage data. Device type, operating system, app version, crash logs, and basic interaction events used to diagnose issues and improve the product.
• Pouch telemetry. Bluetooth signal strength (RSSI), pouch online/offline status, battery level, environmental temperature readings, and timestamps of left-behind events.
• Location data, when you enable it. If you enable left-behind alerts or geofencing, the app uses your phone's location to determine whether the pouch has been left behind. Location is processed primarily on-device. We sync only the minimum required for alerts and history, and only when you have enabled the feature.
• QR code scans. When someone scans the QR code on a pouch, we log the time of the scan and approximate location for your safety records. We do not collect personal data about the person scanning.

Information from third parties

• Apple App Store and Google Play. Limited information related to your subscription status and purchase history.
• Integration partners, only if and when you explicitly connect them.

We use your information to:

• Provide the Services, including operating the pouch, sending alerts, and giving caregivers access to the care plan you set up.
• Generate the QR-code emergency profile you have chosen to make publicly visible.
• Send you account-related messages, including critical safety alerts, expiry reminders, and temperature warnings.
• Respond to your support requests.
• Improve the product, fix bugs, and develop new features.
• Send marketing or product updates, only with your consent and only where you can unsubscribe at any time.
• Comply with legal obligations, including responding to lawful requests from public authorities.
• Detect, prevent, and respond to fraud, abuse, and security incidents.

We will not use your information for any new purpose materially different from the purposes above without first asking for your consent.

If you are in the European Economic Area or the United Kingdom, we rely on the following lawful bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)). We process most account, device, and pouch data because we need it to deliver the Services you have signed up for.
• Legitimate interests (Art. 6(1)(f)). We rely on legitimate interests for product analytics, security, fraud prevention, and improving the Services. We balance our interests against your rights, and you can object to this processing at any time.
• Consent (Art. 6(1)(a)). For optional features such as marketing emails, location-based alerts, or sharing with new caregivers, we rely on your consent. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)). Where we are required by law to retain or disclose information.

For health and allergy data specifically, see Section 6.

The QR code on each Kiri pouch is designed to give a bystander instant, app-free access to the emergency information you have chosen to make publicly visible.

• You decide what appears on the public profile. Typical fields include the child's first name, key allergies, prescribed emergency medication, and an emergency contact phone number.
• Information you mark as private (full medical history, full address, additional caregivers) does not appear on the QR profile.
• You can update or revoke the public profile at any time from the app. The change takes effect immediately for any future scan.

By turning on the public emergency profile, you are choosing to make the selected information available to anyone who scans the QR code. Please use this feature deliberately.

This is the most sensitive data we handle, and it gets the most protection.

Health and allergy data

We process allergy profiles, medications, and care plans only with your explicit consent, given when you create the profile (Art. 9(2)(a) GDPR). You can withdraw that consent at any time by deleting the profile or your account. Withdrawal of consent will end the related Services for that profile.

Children’s data

• Kiri is intended for use by parents, legal guardians, and adult caregivers. We do not knowingly allow children under 13 to create their own Kiri accounts.
• Parents and guardians may create a profile for a child of any age and manage that profile on the child's behalf. The legal basis is the parent's explicit consent, given on the child's behalf.
• In the United States, this approach is designed to comply with the Children's Online Privacy Protection Act (COPPA). We collect children's information only from a verified parent or guardian.
• In the European Economic Area, we follow the higher of 16 years or the age of digital consent set by the relevant member state, in line with Article 8 GDPR.

We do not sell your personal information. We do not share it with advertisers. We share it only in the limited circumstances below.

With your care circle

Information you choose to share with caregivers is visible to the people you invite. You can revoke their access at any time from the app.

With service providers (sub-processors)

We work with carefully selected vendors who help us run the Services. These providers act on our instructions, are bound by written data protection agreements, and may only use your data for the purposes we specify. Categories include:

• Cloud hosting and database
• Mobile push notifications (Apple Push Notification Service, Firebase Cloud Messaging)
• Web hosting
• Email delivery
• Payment processing
• Crash and error reporting
• Customer support tooling

A current list of our key sub-processors is available on request from privacy@carrykiri.com.

With emergency responders

If you turn on emergency contact sharing, your designated information may be shared with first responders or medical personnel.

For legal reasons

We may share information when required by valid legal process, to protect the safety of users, or to investigate fraud or abuse.

In a corporate transaction

If Kiri is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you and your data will continue to be protected under terms equivalent to this policy.

Kiri Products, Inc. is based in the United States. If you are located outside the United States, your information will be transferred to and processed in the U.S. and in any country where our service providers operate.

When we transfer personal data of EEA, UK, or Swiss residents to a country that has not been recognised as providing adequate protection, we rely on:

• The EU Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional safeguards where required.
• The UK International Data Transfer Addendum for transfers from the UK.

Where applicable, we also assess the destination country’s laws and apply supplementary technical measures (encryption in transit and at rest) to maintain a level of protection essentially equivalent to that offered within the EEA. A copy of the relevant transfer mechanism is available on request from privacy@carrykiri.com.

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law.

After the applicable period, we either delete the data or anonymise it so that it can no longer be linked to you.

We apply industry-standard security practices, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest.
• Role-based access controls within our team. Access to personal data is restricted to staff who need it for their role.
• Regular security reviews of our infrastructure and key sub-processors.
• Secure software development practices, including code review and dependency monitoring.
• Incident response procedures, including breach notification to affected users and the relevant supervisory authority within 72 hours where required by law.

No system is perfectly secure, and we encourage you to use a strong, unique password for your Kiri account and enable any available account protections such as two-factor authentication.

You have the following rights regarding the personal information we hold about you. To exercise any of these, write to privacy@carrykiri.com. We will respond within 30 days, or sooner where required by law.

Rights available to all users

• Access a copy of your data.
• Correct inaccurate data.
• Delete your data.
• Export your data in a portable, machine-readable format.
• Unsubscribe from marketing communications at any time.

Additional rights for EEA, UK, and Swiss residents (GDPR)

• Object to processing based on legitimate interests.
• Restrict processing in certain circumstances.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first.

Additional rights for California residents (CCPA / CPRA)

• Right to know the categories of personal information we collect, sources, and purposes.
• Right to correct or delete personal information.
• Right to opt out of the sale or sharing of personal information. Kiri does not sell or share personal information for cross-context behavioural advertising.
• Right to limit the use of sensitive personal information.
• Right not to be discriminated against for exercising your privacy rights.

Other U.S. states (including Colorado, Connecticut, Virginia, Texas, Oregon, and others) provide similar rights. We honour those rights for residents of those states.

The Kiri website uses only essential cookies required for core functionality (for example, remembering your waitlist status). We do not use third-party advertising cookies, cross-site tracking pixels, or behavioural advertising networks.

You can configure your browser to block or delete cookies at any time. Disabling essential cookies may affect site functionality.

We send marketing emails (waitlist updates, product news, launch announcements) only to people who have opted in. Every marketing email contains an unsubscribe link, and you can also email privacy@carrykiri.com to be removed from all marketing lists.

We do not use SMS for marketing without separate, explicit consent.

Critical safety alerts (left-behind, temperature warnings, expiry reminders) are part of the Service itself and are not classified as marketing communications.

We may update this policy as our product, our team, or applicable law evolves. When we make material changes, we will notify you by email or through the app at least 14 days before the change takes effect. The “Last updated” date at the top of this page always reflects the most recent revision.

For privacy questions, requests, or complaints: privacy@carrykiri.com

For all other support: contact us here