Privacy Policy

Kinora Health Ltd (company number 17272055), registered office at 167-169 Great Portland Street, 5th Floor, London, United Kingdom, W1W 5PF, is the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration reference ZC185423.

You can contact us about privacy at: privacy@kinora.health

This policy covers the Kinora website and the current website features: account creation, login, profile settings, mailing-list sign-up, co-creator applications, contact forms, password reset, and security controls.

The community and health survey features are not yet live on the website. Where this policy describes how we collect, use, or retain data through those features (see Sections 3, 5, and 9), this reflects our intended approach, published in advance of launch as part of our compliance preparation. We will obtain any necessary consent at the point these features launch.

Depending on how you use the website, we may collect:

• name and email address
• account and authentication details, such as your user ID and login session
• profile details you choose to add, such as display name, pronouns, date of birth, avatar, community username, and mailing-list preference
• email engagement data, such as whether you have opened our mailing-list emails and which links you have clicked, if you are subscribed to our mailing list
• co-creator application details, including your answers and any hormonal or reproductive health experience you choose to share
• contact form messages and the contact details you provide
• any personal information you choose to disclose as part of the online community page or our health survey, if you choose to engage with those parts of the website
• technical and security information, such as IP address, browser information, request timestamps, rate-limit records, and bot-protection results

Some of this information is necessary for us to provide the service you have requested. For example, we cannot create or secure your account without your email address, and we cannot review a co-creator application without your application answers. Where information is optional, we will indicate this, and choosing not to provide it will not affect your ability to use the core website.

Information about hormonal or reproductive health can be special-category health data under UK GDPR. We only ask for this kind of information where it is necessary for a specific purpose, such as co-creator applications or in any health surveys, and we ask for explicit consent at the point you submit it.

The contact form is not intended for detailed health information. Please avoid sharing health information in the contact form unless it is necessary for your enquiry. If your enquiry requires you to share health information, please email us directly at hello@kinora.health instead. If you do include it, we will use it only to respond to that enquiry and will not use it for product development or research without asking for separate consent.

We use personal data for the following purposes:

• Accounts and login: to create your account, let you sign in, keep you signed in, and provide account features you request. Article 6 lawful basis: contract.
• Optional profile details: to let you add and manage optional profile information, such as display name, pronouns, date of birth, avatar, community username, and mailing-list preference. Article 6 lawful basis: consent, because you choose whether to provide these optional details and can update or remove them.
• Mailing list: to record your interest and contact you about Kinora updates if relevant. If you opt in, your details are shared with our email delivery provider, MailerLite, to send these communications. You can withdraw your consent at any time by clicking the unsubscribe link included in any mailing-list email, or by updating your preferences in your profile settings. Lawful basis: consent.
• Co-creator applications: to review your voluntary application, assess whether there may be a suitable participation opportunity, and contact you about that application. Article 6 lawful basis: legitimate interests, in reviewing applications and managing participation opportunities. If your application includes health information, Article 9 condition: explicit consent.
• Community page: to let you participate in community features you choose to use. Article 6 lawful basis: contract, where needed to provide the community feature you request. If you choose to disclose health information in a community post or reply, Article 9 condition: explicit consent.
• Community safety and moderation: to review reports, remove harmful content, prevent misuse, and protect users. Article 6 lawful basis: legitimate interests, in keeping the community safe and trustworthy.
• Health survey: to gather insights for market research where you choose to complete a survey. Article 6 lawful basis: consent. If a survey asks for health information, Article 9 condition: explicit consent.
• Contact form: to respond to your message. Article 6 lawful basis: legitimate interests, to respond to enquiries efficiently.
• Security and abuse prevention: to protect the website, prevent spam, investigate abuse, and maintain service integrity. Article 6 lawful basis: legitimate interests, in keeping the platform secure and trustworthy for everyone.
• Legal compliance and rights requests: to meet legal, regulatory, accounting, corporate, or data-protection rights obligations. Article 6 lawful basis: legal obligation.

You may withdraw consent at any time where consent is the lawful basis, or where explicit consent is the Article 9 condition for health information. If you withdraw consent for health information in a co-creator application, community contribution, or survey response, we will stop using that health information and delete or anonymise it where required, unless we need to keep limited information for legal, security, fraud-prevention, dispute-handling, or backup-cycle reasons. Withdrawal may mean we can no longer continue reviewing an application, provide a feature, or include your response in a survey.

• We do not sell your personal data.
• We do not share identifiable health information with advertisers.
• We do not use advertising cookies or cross-site tracking cookies.
• We do not currently use analytics cookies.
• We do not add you to mailing lists without your consent.

A processor is a service provider that handles personal data for us so the website can work. We use the following categories of processors:

• Database, authentication, and storage: Supabase.
• Website hosting and infrastructure: Microsoft Azure (UK South).
• Bot and abuse protection: Cloudflare Turnstile.
• Mailing list and email delivery: MailerLite — used to contact users who have explicitly opted in via mailing-list sign-up or profile settings. MailerLite also tracks engagement data, such as whether an email was opened and which links were clicked, to help us understand how our communications are received. No health or special-category data is shared with or processed by MailerLite; it is used only to send mailing-list communications and measure engagement with them.
• Contact-form email delivery: Resend.

We use these providers under appropriate data-processing terms where required by UK GDPR, and we keep our processor arrangements under review. We may update this list if the website's processors change.

We choose UK or European processing locations where available. Our website hosting and infrastructure is provided by Microsoft Azure in the UK South region. Supabase database data is hosted in the European Union. Cloudflare Turnstile is provided by Cloudflare, Inc., a US company operating a global network. Resend is a US company and processes data in the United States. MailerLite, Inc. is a US company; its sub-processors include data centres in Germany, the Netherlands, and Poland.

Where personal data is transferred internationally, we rely on appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to Standard Contractual Clauses, the UK Extension to the EU-US Data Privacy Framework where applicable (for example, with Resend), or equivalent contractual safeguards where required.

• Account and profile data: kept while your account exists, then deleted or anonymised after account deletion unless we need to keep limited records for legal or security reasons.
• Mailing list records and engagement data: kept for up to 24 months from your last interaction with our communications, or until you ask us to remove them, whichever is sooner.
• Contact messages: normally kept for up to 24 months, unless a longer period is needed to handle a request, dispute, or legal obligation.
• Co-creator applications: kept for up to 12 months from submission, whether or not you are selected. If you are selected to join the Co-Create Programme, your application data becomes part of your volunteer record from that point, governed by our Co-Create Programme agreement with you rather than this 12-month period.
• Security and abuse logs: normally kept for 30 to 90 days unless needed for investigation, fraud prevention, or legal reasons.
• Backups: overwritten on a rolling basis according to our providers' standard backup schedules.
• Community page contributions: kept while you continue to engage with the community, and deleted or anonymised after 24 months of inactivity, or sooner if you request removal.
• Community moderation reports: kept for up to 12 months from when a report is closed, then deleted or anonymised.
• Health survey responses: kept for up to 24 months for market research purposes, or until you withdraw consent, whichever is sooner, after which responses are deleted or anonymised, unless we need to retain limited information for legal reasons.

If you have a Kinora account, you can delete it from the danger zone in your profile settings. This deletes your account, profile, profile photo, and current website form submissions linked to your account email where we no longer need them.

You can also request deletion of your account or personal data by emailing privacy@kinora.health. We will respond within one month. Where applicable, we will also instruct relevant processors, such as MailerLite for mailing-list data, to delete or remove your personal data on our behalf.

Some limited information may be retained where necessary for legal compliance, security, fraud prevention, dispute handling, or backup deletion cycles.

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, database row-level security, bot protection, rate limiting, and security monitoring.

No online service can guarantee perfect security, but we review our controls and limit access to people who need it for service, support, security, or compliance reasons.

You may ask us to:

• provide access to your personal data
• correct inaccurate data
• delete your data
• restrict processing
• transfer your data where applicable
• object to processing carried out on the basis of our legitimate interests
• not be subject to a decision based solely on automated processing, including profiling, that has a legal or similarly significant effect on you (we do not currently carry out this kind of processing on the website)
• withdraw consent where consent is our lawful basis

Please note that community usernames, once set, cannot be changed. This is not a restriction on your right to rectification generally — it is a deliberate design choice to preserve the consistency and integrity of the community space.

Requests may be sent to: privacy@kinora.health

We aim to respond within one month.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

We use strictly necessary cookies and similar technologies for website functionality, authentication, and security. We do not currently use analytics, advertising, or cross-site tracking cookies.

More detail is available in our Cookie Policy.

Kinora is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we become aware that we have collected data from someone under 18, we will delete it.

Kinora does not provide medical advice, diagnosis, treatment, or prescriptions.

Any information or tools we provide are for informational and educational purposes only. Medical decisions should always involve a suitably qualified healthcare professional.

We may update this policy from time to time. If changes materially affect your rights or how we use your data, we will notify registered users by email before those changes take effect, and update the "last updated" date at the top of this page.