Kalibra Privacy Policy

Last updated: 4 November 2026

Kalibra, accessible from kalibra.ai, our web applications, mobile applications, and related services, is committed to protecting personal information. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices available to you.

Kalibra is a health intelligence and performance platform. The information, insights, recommendations, scores, summaries, or outputs provided by Kalibra are for informational and educational purposes only. They are not medical advice, diagnosis, treatment, or a substitute for advice from a qualified medical practitioner. You should consult an appropriately qualified professional before acting on health information.

Summary

Your account is private by default. You choose which supported information to add or connect.
We maintain the health record you request, including authorised information that does not currently contribute to a score.
We do not sell personal information or use shared health information or health-derived attributes for marketing, independent research or model training.
Practitioner sharing requires your approval and the practitioner’s acceptance, confirmed by email. You can turn sharing off at any time in the app.
You can request access, correction or deletion. Confirmed valid deletion requests are carried out immediately, subject only to specific legal retention requirements and separately controlled records.
Connection permissions, practitioner sharing and external exports are separate choices.

Scope of this Policy

This policy applies to Kalibra services that link to it. Feature-specific and deployment-specific notices provide further details where relevant.

When you use Kalibra’s own services, Kalibra is responsible for the processing purposes it determines. When a clinic, practitioner or white-label customer uses Kalibra to deliver its services, that organisation may be responsible for your health records and its purposes, with Kalibra processing those records on its instructions. Its privacy notice identifies its responsibilities and contact details. Kalibra remains responsible for its own obligations and any processing purposes it separately determines, such as administering its business relationships.

For Maia-branded services, Maia’s privacy notice explains its handling of your information. Kalibra’s handling of Maia-controlled records is governed by the applicable service arrangements and processing instructions. We do not treat those records as permission to use your health information for Kalibra’s independent purposes.

Specific notices and agreements apply to the relevant service. They do not remove rights or obligations that cannot lawfully be excluded or override applicable connected-health platform restrictions.

Information We Collect

Depending on the service and your choices, we may receive:

Account and contact details, such as your name, email, organisation, role and account preferences.
Profile and health information you provide, including goals, symptoms, history, medications, body measurements, lifestyle, emotional wellbeing and relationship context.
Health records and reports you upload, or that an authorised practitioner supplies, including laboratory documents, notes and associated source, date and measurement information.
Supported connected-health information you permit us to access. Depending on the connection and enabled categories, this may include activity, cardiovascular measurements, sleep, nutrition, body measurements, metabolic and respiratory measurements, mobility, symptoms, reproductive information and mental-health information.
Conversations, daily check-ins, responses to assigned actions, progress and exceptions you report.
Information produced when providing the service, including extracted and organised records, converted measurements, scores, priorities, summaries, draft plans, approved plans and associated review history. Derived health information receives the same purpose and sharing protections as the underlying health information.
Messages, support requests, feedback, subscription and transaction information.
Technical information needed to operate and protect the services, such as device and browser information, IP addresses, security events, diagnostic logs and service usage.
Details you supply for a specific invitation or connection you request.

The connection flow identifies the supported categories requested and their purposes. Available categories depend on your device, provider, application version and service. We do not obtain access to every category merely because it exists in a device’s health database.

Connected-health permissions

You control the supported categories you share through the relevant provider or device permission controls, including Apple Health permissions managed through HealthKit. Where a Google health connection is offered, the connection notice identifies the applicable product, such as Android Health Connect or the Google Health API.

We request access for the current health-record functionality and other services explained to you. We do not request additional information solely because it may be useful for an unspecified future purpose. You may decline categories or stop a connection; some features may then have less information or be unavailable.

Connections may operate directly or through an integration provider identified in the relevant notice. The connection notice explains any background access, historical imports or write-back. Permission to read information does not itself authorise us to write information to the source.

Device permission to collect information is separate from your choice to share records with a practitioner. Disconnecting a source stops future collection through that connection; it does not automatically erase records already imported. You can request deletion separately.

Where we receive information through the Google Health API, our use complies with the Google Health API Developer and User Data Policy, including its Limited Use requirements. Applicable source-specific restrictions continue to govern derived and aggregated information; removing names does not itself remove those restrictions.

How We Use Information

We use information for the purposes explained for the relevant service, including maintaining your health record; extracting and organising uploaded records; displaying information and changes over time; producing requested health insights, scores or summaries; preparing draft plans for the relevant review process; supporting approved actions, reminders and check-ins; enabling authorised practitioner review; administering accounts and subscriptions; providing support; and protecting service reliability and security.

We may process necessary account, transaction and operational information to meet legal obligations, resolve disputes, prevent abuse and administer our business. We limit such processing to an appropriate and lawful purpose.

Where EU or UK data protection law applies, account and requested-service processing may be necessary to perform our agreement with you. Appropriate operational processing may rely on legitimate interests, subject to your rights, and legally required processing relies on the relevant legal obligation. Processing health information also requires an applicable special-category condition, such as explicit consent. Where a customer determines the processing, its notice explains its legal bases and Kalibra acts under the applicable instructions.

We use shared health information only to provide the requested services and meet applicable legal obligations. We do not use it for independent research, advertising, sale or model training. These restrictions also apply to health-derived information and customer-controlled records; removing names does not authorise reuse.

Automated Processing and AI-Assisted Features

Features may use rules, algorithms or AI to organise information, identify patterns or generate summaries. Where third-party AI receives your personal information, the feature notice explains the recipient, purpose and information involved, and requests explicit permission where required before sharing begins.

Service providers may process information only for the authorised service purposes under the applicable arrangements. We do not permit providers to use your shared health information to train their general-purpose models.

Scores and summaries support understanding and professional review. They should not be used as the sole basis for a clinical decision or treated as a substitute for an appropriately qualified professional. AI outputs may contain errors and need appropriate review for their intended use.

The feature description distinguishes automated educational guidance from drafts intended for practitioner review. Producing an output for your requested service is different from using your information to train a model for another purpose.

Sharing and Disclosure

We use providers where necessary to host, connect, operate, secure and support the services. Depending on the deployment, these may include infrastructure, integration, communications, support and specifically disclosed AI providers. We require appropriate contractual confidentiality, purpose and security protections. Provider processing is distinct from practitioner sharing.

The applicable service or customer information identifies relevant providers and processing arrangements. You may contact us for information about providers handling your information. For customer-controlled records, subprocessor appointments and changes are managed under the applicable data processing agreement. Where that agreement provides for 30 days’ advance notice of a new or replacement subprocessor, we give that notice before the change takes effect. Existing signed agreements remain governed by their own notice provisions.

We may disclose information to advisers or authorities where necessary and permitted or required by law, subject to applicable source restrictions. We assess the basis and scope of such disclosures and limit information to what is appropriate.

A business restructuring or transfer does not create an unrestricted right to transfer your health information. Applicable legal and platform requirements continue to apply, including prior explicit consent for a corporate-transaction transfer of Google Health API data where required.

Your Sharing Choices

Sharing with a practitioner begins only after you approve the connection and the practitioner accepts it. This double opt-in is confirmed by email. The sharing flow identifies the recipient and information made available, including whether the connection covers future records.

Where you approve sharing with a clinic or care organisation, its authorised care team may have access within the scope explained to you. This can include relevant practitioners and support staff with defined roles. It does not authorise access by every employee, unrelated organisation or sponsor.

You can turn off practitioner sharing at any time using the controls always available in the app. You may also contact us for help. Withdrawal does not reverse previous access or automatically erase information a practitioner has lawfully incorporated into its own records. The practitioner’s privacy notice and professional obligations govern those records.

Subsequent access by another practitioner or organisation requires the relevant authorisation. A sponsorship, employer, insurer or referral relationship alone does not authorise access to your individual health records.

Where a service lets you export or send a summary to a clinician outside Kalibra, that action has a separate sharing choice. The flow explains what is sent and how the recipient can access it. Revoking an available sharing link does not retrieve a copy the recipient has already downloaded or retained lawfully.

Cookies and Similar Technologies

We use necessary technical tools to operate and protect our websites and services. Optional website analytics or marketing technologies are subject to appropriate notices, choices and consent where required. Shared health information and health-derived attributes are not used for website advertising, audience profiling or marketing.

Security

We apply administrative, technical and organisational safeguards appropriate to the information, service and applicable requirements. These include suitable access restrictions and security arrangements for storage, transmission and provider processing. Authorised operational access is limited to relevant service, support, security or legal purposes.

No system is completely free from security risk. This does not limit our responsibility to apply required safeguards or respond to incidents. Contact us promptly if you suspect unauthorised account access. We assess incidents and notify customers, authorities or affected individuals as required by applicable law and agreements.

Data Retention

We retain information only while it is needed for the disclosed service or an applicable legal obligation. You may request deletion of imported records or your account. Once a valid deletion request is confirmed, we delete the information immediately. We do not apply a routine 30-day or 90-day retention period after deletion.

Deletion applies to the information within Kalibra’s control, including retained copies, and we instruct relevant service providers to delete their copies. Service providers acting on our instructions may take up to 30 days to complete deletion of their copies. We do not treat archive storage, removal from view or replacement of names with identifiers as deletion.

Where a specific legal obligation or valid legal hold requires retention, we retain only the records required, restrict their use to that purpose and explain the exception. A practitioner or customer organisation may hold separately controlled records under its own legal and professional obligations; we help route requests concerning those records.

Disconnecting a source stops future collection but does not delete previously imported records. Withdrawing practitioner sharing stops future access but does not retrieve copies already lawfully retained by the practitioner. Deleting an account and cancelling a paid subscription are separate actions; the relevant flow explains any additional steps.

International Transfers

Our usual hosting location is Singapore. White-label services may have different agreed hosting locations, including the United States. The applicable deployment notice or customer arrangements identify the hosting location for that service.

Backup, integration, support or other authorised provider processing may occur in additional countries. We disclose relevant processing arrangements and apply the transfer safeguards required for the information and jurisdictions concerned, such as appropriate contractual protections. A hosting location is not a promise that every processing activity occurs in that country.

External Links and Third-Party Services

Independent practitioners and other third-party services may have their own privacy responsibilities and policies. Their separate role does not remove Kalibra’s obligations for its own processing or providers acting on its behalf.

Children

Kalibra services are intended for adults. Users under 18 are not permitted to use the services. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us and we will take appropriate steps to delete it.

Your Rights and Choices

Depending on applicable law, you may request access, correction, deletion, restriction, portability or an objection to certain processing, and may withdraw consent where processing relies on consent. Withdrawal does not affect the lawfulness of processing before withdrawal. We explain any effects on the requested services and any lawful retention exceptions.

Use the available account, provider or sharing controls, our personal data request forms, or contact our Data Protection Officer. We may verify identity and authority to protect your information. We respond within applicable legal time limits and explain any permitted exception or extension.

Where a clinic or white-label organisation controls the requested records, we help route the request and provide the assistance required under our obligations. Depending on jurisdiction, you may also complain to the relevant data protection authority, including Singapore’s Personal Data Protection Commission or an applicable EU/UK supervisory authority.

Singapore PDPA

Kalibra is committed to complying with Singapore’s Personal Data Protection Act 2012 (PDPA), including obligations relating to consent, purpose limitation, notification, access and correction, protection, retention limitation, transfer limitation, accountability, and data breach notification where applicable. More information about the PDPA is available at www.pdpc.gov.sg.

European Union and UK GDPR

If you are located in the European Union, United Kingdom, or another jurisdiction with similar rights, you may have additional rights under applicable data protection law. These may include rights of access, rectification, erasure, restriction, objection, portability, and the right to lodge a complaint with a supervisory authority. More information about the GDPR is available at https://gdpr-info.eu/.

Marketing Communications

Where permitted, we may send ordinary promotional communications using separately supplied contact details and communication preferences. You can unsubscribe or contact us to stop these. We may continue necessary account, service, legal and security messages.

Changes to this Policy

We update this policy when relevant services, processing arrangements or requirements change. Material changes are communicated as required by applicable law, platform rules and customer agreements. We obtain fresh consent before changed processing where required; continued use alone is not treated as consent where affirmative permission is needed.

Contact Us

For privacy questions, requests or concerns, contact:

Kalibra Pte Ltd
Data Protection Officer: Ivan Vatchkov
Email: support@kalibra.ai

Further information is available in our Data Protection Policy and personal data request forms.