The short version: Your health data is yours. We don't sell it and we don't advertise with it. It is not routinely shared with other people — only at your request, or in the narrow legal and safety circumstances described below. A number of service providers process it to run Kenki, and they are listed below. You can export your health records and delete your account at any time.
Sleep, water intake, food, supplement logs, meal photos you choose to upload, and food recognition corrections
Dental health records
Menstrual cycle data
Medical history and conditions
Health goals and progress notes
Account Data
Email address (for authentication)
Display name (optional)
Authentication tokens (managed by our auth provider)
Technical Data (collected automatically)
Browser type and version
Device type (mobile/desktop)
Pages visited and features used (for improving the Service)
Error logs (for debugging)
What we DON'T collect
We don't track your location continuously or keep a location history
We don't collect contacts or phone data
We don't use tracking pixels, advertising networks, or cross-site trackers
We don't use analytics for advertising or cross-site tracking (see Cookies & Analytics)
We never see or store your card details (see Third Parties)
2. How Your Data Is Stored
Database: Your data is stored in a Supabase-hosted PostgreSQL database with row-level security, meaning your data is isolated and only accessible by your account.
Encryption: Data is encrypted in transit (TLS/HTTPS) and at rest.
Access control: Row-level security means no other member can read your health data. Your own authenticated session, our server acting on your request, and any AI agent you have explicitly authorized are the paths that can access it.
Backups: Regular automated backups are maintained for disaster recovery by our database provider, under that provider's encryption and retention practices.
3. How Your Data Is Used
We use your data only to:
Display your health information back to you
Generate your weekly health reports and insights
Provide medication reminders and appointment alerts
Improve the Service's features and fix bugs
Improve food recognition and nutrition matching only when you opt in to that specific food AI improvement feature
We do not use your data to:
Serve you advertisements
Build marketing profiles
Sell to data brokers, insurers, employers, or anyone else
Train AI models or improve recognition systems unless you explicitly opt in to a specific feature
4. Food Photos & Food Recognition Improvement
Kenki may let you upload meal photos for AI-assisted food recognition. This feature is optional.
Clear opt-in: Meal photos and corrections are used to improve Kenki food recognition only if you turn on the food AI improvement consent.
Features by default: Unless you separately allow raw photo retention, Kenki stores recognition outputs, embeddings/features, hashes, confidence scores, and correction metadata rather than keeping raw meal photos long-term.
Raw photo retention: If you opt in to raw photo retention, photos are stored privately and used only to improve Kenki food recognition and nutrition matching. You can turn this off later.
Delete/export controls: Food logs and food recognition metadata are exportable and deletable. Retained meal photos can be deleted; they are not included in the self-service export, so ask us if you want copies. Deletions remove active records immediately.
No sale or ads: Meal photos, embeddings, corrections, and nutrition data are never sold or used for advertising.
5. AI Features & Your Data
Some Kenki features work by sending your content to an AI provider. This section says exactly which ones, what is sent, and to whom.
Features that use AI providers
When you use one of these features, the content it needs is sent to an AI provider to produce the result. If you have connected your own API key, it is used where the feature supports it: meal recognition, food text lookup and the assistant can run on your key and chosen provider; voice transcription and document extraction use your key only if your chosen provider is OpenAI, and otherwise run on ours; Lifeline note suggestions always use ours.
Meal photo recognition: the photo you took, plus limited context about your diet and history, to identify the food and estimate nutrition.
Food text lookup: the food description you typed. The lookup first checks the nutrition databases listed under Data Sharing & Third Parties, which receive the derived food name. If our deployment has the web-lookup fallback enabled and the primary lookup is unsure and finds no database match, your food description is also sent to Brave Search to find nutrition pages, and the description together with the search snippets goes to OpenAI to estimate nutrition — this fallback always runs on our OpenAI account, even if the primary lookup ran on your own key and provider. It operates only when that fallback is enabled in our deployment, and it is disclosed here so it is covered before it is ever used.
Document and lab extraction, and visit summaries: the document or image you uploaded, and the records being summarised.
Voice logging: the audio you recorded, for transcription, and the resulting transcript for interpretation.
The built-in assistant: your messages, together with health context selected to answer them — which can include recent vitals, active medications, and recent food, sleep and water entries.
Lifeline “Suggest with AI”: if you use it, your Lifeline blood type, allergies and conditions are sent to OpenAI to draft the responder note. This feature always uses our OpenAI account, even if you have connected your own key, and nothing is saved unless you save the note.
Which providers
Depending on the feature and how your account is configured, these are OpenAI, Anthropic, or Google (Gemini). Voice transcription uses OpenAI. When you supply your own API key, your content goes to the provider you chose, under your own account with them.
These providers process your content to return a result to you. What they retain, and for how long, depends on the provider and the terms of the account the request runs under — your own, if you connected a key — and is not governed by Kenki's deletion controls: the “not retained by us” statements below describe Kenki's storage, not the provider's. Review the privacy terms of OpenAI, Anthropic and Google if that matters to you. Kenki itself does not use this content to train models and does not use it for advertising.
What Kenki keeps
Voice: we do not store your audio or your transcript. We keep only usage metadata — recording length, byte size, the provider and model used, and the character count of the transcript.
Meal photos: kept only if you turn on photo retention. Otherwise the photo is used to produce the result and not retained by us.
Assistant chat history: the visible transcript is kept in your browser's local storage on your device, not on our servers; clearing the chat clears that device copy.
Selected chat inputs: separately from your visible history, we may keep individual messages you typed to the assistant — with your account ID, IP address and technical metadata — to fix failures and improve how the assistant understands requests. Clearing your chat does not remove these; deleting your account does. Ask us if you want them deleted sooner.
Extracted records: results you save (recognised foods, extracted documents, visit summaries) are stored in your account and deleted when you delete them.
What is separate from this
Improving food recognition is a separate opt-in. It is off unless you turn it on, and it governs whether your food observations and retained photos may be used to improve recognition — not whether the features above send content to a provider. Those features send content because that is how they produce a result.
Connecting your own AI assistant (an external agent you authorize to read your Kenki data) is described in AI Agent Data Access. That is you granting a third party access; this section is about Kenki using providers to run features for you.
Using Kenki without this
These features are the ones that use AI. Logging, tracking, records, reminders, reports and export all work without them, and nothing in this section happens unless you use one of the features listed above.
6. AI Agent Data Access
Kenki supports optional integration with AI assistants. Here's how that works:
Explicit opt-in: AI access is off by default. You must enable it and choose what data to share.
Granular permissions: You control which categories of health data an AI agent can access. For example, you might share medications but not medical history.
Read-only or read-write: You choose the access level for each integration.
Instant revocation: Revoke any AI agent's access at any time. Access stops immediately.
No secondary use: Kenki does not use data shared with AI agents for any purpose beyond facilitating the connection you requested.
Third-party AI policies: When you connect an AI agent, that agent's own privacy policy governs how it handles data received from Kenki. Review their policies before connecting.
7. Data Sharing & Third Parties
We do not sell your data. Period.
We share data only in these limited circumstances:
Infrastructure: Supabase provides database hosting and authentication. Cloudflare fronts both the website and our API as a reverse proxy, CDN and gateway, so ordinary requests pass through it — this is separate from the analytics beacon described under Cookies & Analytics. Each processes your data to provide that service, on the terms of their own agreements with us.
Analytics and diagnostics: Cloudflare Web Analytics receives one cookieless request per page view and provides us only aggregated reports. When configured, PostHog receives pseudonymous product-usage events and Sentry receives scrubbed error and performance diagnostics. See Cookies & Analytics for the data and storage each service uses.
Payments: Stripe and Coinbase Commerce process payments. They receive your payment details directly — we never see or store your card number. We keep your subscription status and the provider's customer and subscription identifiers so we know what you have access to.
Email: Resend delivers account email, reminders, weekly reports and any Lifeline messages or packet links you send. It receives the recipient address and the message contents.
Push notifications: If you enable them, your browser's push service (operated by your browser vendor) receives the notification payload and your subscription endpoint.
Site assets: Google Fonts, OpenStreetMap and Carto map tiles, and DiceBear avatars. Application code libraries load from the jsDelivr, cdnjs and unpkg CDNs on both public and signed-in pages; those CDNs see your IP address and which page requested the file. See Cookies & Analytics.
Food and nutrition databases: When you search for a food, scan a barcode, or look up a restaurant item, your search text or the barcode is sent to the configured nutrition providers to find a match — depending on our deployment's configuration these are FatSecret, USDA FoodData Central, Open Food Facts, and for restaurant items Nutritionix. They receive the query or barcode, not your identity or your logs, and they process it under their own terms.
Location, only when you ask: Two features can use your device location, and they handle it differently. Nearby restaurants requests a low-accuracy fix and rounds it to roughly 100 metres before it leaves your device. The hospital finder requests a precise fix and sends those coordinates through our server to a public Overpass map-query service to find care near you; if you decline, it searches by the city you type instead. Both features use the same providers, which we try in order: overpass-api.de, maps.mail.ru, then overpass.kumi.systems. Neither feature keeps a location history, and location is used only to answer the request you made.
AI agents: Only when you explicitly enable and configure access (see above).
Legal requirements: We may disclose data if required by law, court order, or government request, and we'll notify you unless legally prohibited from doing so.
Safety: To prevent imminent harm to a person, if we reasonably believe disclosure is necessary.
8. Data Retention & Deletion
Your health data is retained as long as your account is active.
You can export your health records at any time in standard formats. Operational records such as audit logs and service usage are not in that export; ask us and we will provide them.
You can delete individual records or categories of health data in Settings, and you can request full account deletion by contacting [email protected].
When you delete data, it is removed from our production database immediately. Copies inside our database provider's automated backups age out on that provider's retention schedule rather than being deleted individually.
If your account is inactive for 24 months, we may send you a reminder before scheduling deletion.
9. Cookies & Analytics
Kenki uses minimal browser storage:
Authentication tokens: Stored in local storage to keep you logged in.
Service Worker: Enables installing Kenki as an app. It currently serves everything from the network and does not cache your health data on the device.
Analytics storage: Cloudflare Web Analytics is cookieless. When PostHog is enabled, it uses a cookie and local storage to maintain a pseudonymous analytics identifier and attribution data. We don't use advertising or cross-site tracking cookies.
Website analytics
We use Cloudflare Web Analytics to understand how the site performs — which pages load, how quickly, and roughly where visitors come from. It is a privacy-preserving alternative to conventional analytics:
No cookies and no fingerprinting. It stores nothing on your device and does not build a device signature.
No cross-site tracking. It cannot follow you to other websites, and we cannot use it to identify you.
What is sent: your browser sends Cloudflare one request per page view containing the page address, referring site, browser and device type, approximate country, and page-load timings. Cloudflare processes those individual requests and gives us only aggregated reports — we do not receive per-visitor data.
Never your health data. It receives none of your logs, records, documents, or account information.
It loads a script from static.cloudflareinsights.com and reports to cloudflareinsights.com. Blocking those hosts disables it with no loss of app functionality.
Web fonts load from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), so Google receives your IP address when a page loads. Map tiles on the hospital finder come from OpenStreetMap and Carto, and generated profile images from DiceBear. Each receives only the request needed to serve that asset.
Optional product analytics and diagnostics
When analytics is enabled in our deployment, we may also use:
PostHog: product-usage events such as page views and feature or checkout interactions, together with page path and title, browser/device context, referral and campaign attribution, and a pseudonymous account identifier. PostHog uses a cookie and local storage for persistence. We configure it not to autocapture page content and scrub sensitive property names; we do not intentionally send health-log contents, food names, chat text, images, email addresses, or payment credentials.
Sentry: error and performance diagnostics needed to detect and fix failures. Reports may include an account identifier and operational metadata. We strip authorization headers, cookies, request bodies, and sensitive fields before reports are sent, and do not intentionally include raw health-record values.
These services are for operating and improving Kenki, not advertising or cross-site tracking. Disabling or blocking their browser-side requests does not remove core app functionality.
10. Security
We take security seriously. Measures include:
HTTPS/TLS encryption for all data in transit
Encryption at rest for stored data
Row-level security (your data is isolated from other users)
Regular security audits and dependency updates
Rate limiting and brute-force protection on authentication
Secure authentication via established providers (not custom password hashing)
No system is 100% secure. If we discover a breach affecting your data, we will notify you as required by applicable law, and tell you what happened and what we are doing about it.
11. Children's Privacy
Kenki is not intended for use by anyone under 16 years old. We do not knowingly collect data from children under 16. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child under 16 is using Kenki, please contact us at [email protected].
12. Your Rights
Regardless of where you live, you have the right to:
Access: View your health data in the dashboard and export it. The export covers the health records you create; some operational records (audit logs, service usage) are not included, and you can request those from us.
Export: Download your data in standard formats via Data Export.
Correction: Edit or correct any data at any time.
Deletion: Delete any or all of your data.
Portability: Take your data and move to another service.
Restrict processing: Ask us to limit how we use your data.
Object: Object to any processing you don't agree with.
To exercise these rights, email [email protected] or use the in-app tools.
13. California & GDPR
California Residents (CCPA)
We do not sell your personal information.
We do not use your personal information for cross-context behavioral advertising.
You may request disclosure of what data we've collected, and request its deletion.
We will not discriminate against you for exercising your privacy rights.
European Residents (GDPR)
Health information is "special category data" under GDPR. Kenki processes only the health information you choose to enter.
It is used to provide the Service to you, and to improve the Service's features and fix bugs, as set out in How Your Data Is Used. Two uses are narrower and called out separately: improving Kenki's food recognition happens only if you opt in (see Food Photos & Food Recognition Improvement), and selected messages you typed to the assistant may be kept to fix failures and improve how requests are understood (see AI Features & Your Data) — you can ask us to delete those, and deleting your account removes them.
Data reaches third parties in two ways, both described in this policy: the built-in AI features send content to the providers named in AI Features & Your Data, and the processors, integrations and circumstances listed in Data Sharing & Third Parties — which include disclosure required by law, court order or government request, and disclosure we reasonably believe necessary to prevent imminent harm to a person.
We do not sell your health data, we do not use it for advertising, and we do not use it to train general-purpose AI models.
We are reviewing the formal legal basis we document for this processing and will update this section in a future revision of this policy.
You can stop Kenki's active processing at any time by deleting your data or your account, and you can export your health records first. Deletion removes records from our production database immediately; copies inside our database provider's automated backups age out on that provider's retention schedule (see Data Retention & Deletion), and content already sent to an AI provider is subject to that provider's own retention (see AI Features & Your Data). We do not control either schedule.
You may lodge a complaint with your local data protection authority.
14. Changes to This Policy
If we change this Privacy Policy, we'll update the "Last updated" date and notify you of material changes via email or in-app notification. We won't retroactively reduce your privacy protections without your consent.