Consumer Health Data Privacy Policy
BlackSolstice Technologies · Effective [EFFECTIVE DATE] · Last updated [DATE]
Why this is a separate document
Washington's My Health My Data Act requires a distinct Consumer Health Data Privacy Policy — its own document, linked directly from the homepage, rather than a section inside a general privacy policy. Nevada's SB 370 is similar. That is what this is. The general policy is here.
1. Who we are
Kindava is made by BlackSolstice Technologies. Kindava is a companion device. It is not a therapist, not a medical device, not a diagnostic tool, and not a suicide prevention service. It does not provide medical advice or treatment.
If you are in crisis:
Call or text 988
Suicide & Crisis Lifeline. Veterans: call 988, then press 1.
Contact: privacy@kindava.ai · BlackSolstice Technologies, 1545 N Texas Street, Ste 201, Fairfield, CA 94533
2. What Kindava collects
Kindava listens for a wake word. It does not record or transmit anything until it hears that wake word. Once woken, it records what you say until you stop speaking.
| What | Why | Where it goes |
|---|---|---|
| A recording of your voice | To turn speech into text | Held in the device's memory, sent to our server, then to Deepgram for transcription. Not stored on the device after sending, and never written to the device's permanent storage. |
| A transcript of what you said | So Kindava can respond | Our server; sent to Anthropic to generate a reply |
| Conversation memory | So Kindava remembers what you told it | Our server. The last 20 exchanges, kept as written. |
| A written summary of you | So Kindava remembers you across conversations | Our server. Written by the language model from your conversations. |
| An inferred emotional state | To shape the tone of the reply | Computed on our server; not stored long term |
| A device identifier | To keep your conversations separate from another device's | Our server |
| The reply Kindava speaks | To play it back to you | Our server, then your device |
What Kindava does not collect: your name (unless you tell it), your address, your date of birth, any government identifier, any payment details, your contacts, or your location.
Is this "consumer health data"?
We treat it as if it is. Conversations with Kindava are often about how you are feeling, how you are sleeping, whether you are lonely, and how you are coping. Washington's My Health My Data Act defines consumer health data broadly, and inferences about mental health fall within it. We do not argue about whether the definition is met — we apply these protections to everything Kindava collects.
3. Who we share it with
Kindava cannot work without sending what you say to other companies. We use as few as possible, and these are all of them:
| Company | What they receive | What they do with it |
|---|---|---|
| Deepgram | Your voice recording; the text of Kindava's reply | Turn speech into text, and text into speech. We send an instruction on every request that excludes your data from their model training, and their retention is then limited to the time needed to process the request. |
| Anthropic | The transcript of what you said, your conversation memory and summary | Generate Kindava's reply. Anthropic does not retain conversation content by default and does not use it for model training. |
| Render | Hosts our server; your data is stored on a disk there | Hosting only |
| Supabase | Your email address and sign-in credentials | Signing you in to the app. It never receives your conversations. |
We do not sell your data. We do not share it for advertising. We do not share it with data brokers.
We may disclose data if legally compelled, and will tell you if we are permitted to.
4. How long we keep it
| What | How long |
|---|---|
| Voice recordings | Not retained. Production servers do not save recordings. |
| Spoken replies | Deleted automatically within about one hour |
| Transcripts and conversation memory | Until you ask us to delete them, or 24 months after you last use Kindava, whichever comes first |
| Written summary | Until you ask us to delete it, or 24 months after you last use Kindava, whichever comes first |
The clock runs from when you last used Kindava, not from when the conversation happened. If you use it, nothing is ever deleted out from under you, however many years of conversation there are — that is the point of the product. If you stop entirely, what was said does not sit on a disk indefinitely.
5. Your rights
You can, at any time:
- Ask what we hold about you, and get a copy
- Ask us to delete it — all of it, including the summary
- Withdraw your consent, which stops collection going forward
- Ask us to correct anything wrong in your profile or summary
You can delete everything yourself, immediately, from inside the app or from this website. For anything else, write to privacy@kindava.ai and we will respond within 45 days.
Washington's My Health My Data Act gives Washington residents a private right of action — the ability to sue directly for violations. We state that here because you are entitled to know it.
6. Consent
Before Kindava collects anything, we ask for your consent — and we ask separately for two different things, because they are different:
- Consent to collect your voice, transcripts and conversation memory so that Kindava can work at all.
- Consent to share that data with the companies listed above.
You can say yes to the first and no to the second, but Kindava will not function without the second, and we tell you that plainly rather than burying it.
Consent is never bundled into a terms-of-service acceptance, never a pre-ticked box, and never assumed from continued use.
7. Who else might be recorded
Kindava records whoever is speaking when it is woken, not only its owner. If other people live with you or visit you, they may be recorded without having agreed to any of this. Mitigations are still being decided; this is an open question we would rather name than leave out.
8. Security
- Everything between your device and our server is encrypted in transit (TLS 1.2, certificate verified).
- Every device authenticates with a token; requests without it are refused.
- Our processors are independently audited: Deepgram holds SOC 2 Type I and II; Anthropic holds SOC 2 Type II, ISO/IEC 27001 and ISO/IEC 42001.
What we will not claim: Kindava has not been independently security audited. We hold no HIPAA Business Associate Agreement with our processors. Stored data is not currently encrypted at rest beyond what our host provides. We would rather tell you that than imply otherwise.
9. Children
Kindava is not intended for anyone under 18 and we do not knowingly collect data from children.
10. Changes
If we change this policy we will email you and post a notice on this website. Material changes affecting how we share consumer health data require new consent, not just a new effective date.
11. Complaints
Contact us first: privacy@kindava.ai.
You may also complain to your state Attorney General. Washington residents may additionally bring a private action under the My Health My Data Act.