Privacy Policy

1. Who this Policy applies to

This Policy applies to people who visit or use Kozo, create a Kozo account, contact us, or receive a Clinical Summary through a public share link.

You must be at least 18 years old to create a Kozo account. An adult account holder may use Kozo to help manage information for a child or another adult if they have the appropriate permission or authority. Information submitted about that person is handled under this Policy.

If you believe a child has created an account or that their information was provided without appropriate authority, contact us at support@kozohealth.ai.

2. Information we collect

Depending on how you use Kozo, we may collect:

• Account and contact information, such as your phone number, email address when provided, account and session identifiers, onboarding status, and records of your consent to our Terms and Privacy Policy.
• Profile and patient information, such as names, age, sex, location, occupation, marital status, caregiver relationship, pregnancy context, medical conditions, medicines, allergies, and surgeries.
• Health and conversation information, such as symptoms, timing, answers to Kozo’s questions, messages, follow-up updates, and other context you choose to provide.
• Uploads and extracted information, such as symptom photos, test reports, prescriptions, doctor notes, other supported documents, file details, and information extracted from those files.
• Kozo-generated information, such as AI-generated questions, explanations, possible health considerations, next actions, Clinical Summaries, and follow-up responses.
• Usage, analytics, and technical information, such as user and chat identifiers, pages viewed, feature interactions, clicks, device and browser information, approximate network information, error and performance information, heatmaps, and session replay data when analytics is enabled.
• Advertising measurement information, for requests that our hosting provider identifies as coming from India, such as Google ad-click information, the page URL and referrer, IP address and approximate location, device and browser information, and Google advertising cookies or identifiers.
• Sharing information, such as the Clinical Summary selected for sharing, the public share link and token, and related creation or access activity.
• Support and safety information, such as messages you send us and records used to investigate errors, misuse, security issues, or service quality.

We receive this information directly from you, automatically from your browser or device, or by generating or deriving information from what you provide, including through AI-assisted processing and document or image extraction.

3. How we use information

We use personal information to:

• create and secure accounts, send and verify one-time passwords, and maintain sessions;
• personalise Kozo for the relevant person and health context;
• ask focused questions, process uploads, generate explanations, next actions, Clinical Summaries, and follow-up responses;
• create and display public Clinical Summary links when you request them;
• operate, maintain, troubleshoot, secure, and improve the reliability and user experience of Kozo;
• understand feature use and service performance through analytics;
• measure whether a visit associated with a Google advertisement was followed by Kozo displaying a completed action artifact;
• prevent misuse, investigate incidents, and enforce our Terms; and
• comply with legal obligations and respond to lawful requests.

4. AI processing

Kozo uses third-party AI providers to support its symptom-navigation experience. Relevant messages, health context, uploads, and extracted information may be sent to these providers to generate questions, explanations, next actions, summaries, follow-up responses, or file extractions.

We may keep quality and debugging records about AI requests and responses so we can investigate failures, safety issues, and service reliability. These records may include health-related context. Access is limited to authorised operational use.

AI output may be incomplete or inaccurate. Kozo is a tool, not a diagnosis, and its medical limitations are explained in our Terms of Service.

5. When we share information

We may share personal information in the following situations:

• Service providers. We use providers to host and operate Kozo, store data and uploads, deliver and verify one-time passwords, provide AI processing, support product analytics, and measure advertising conversions. These providers include Supabase, Vercel, MSG91, PostHog, Google, and third-party AI providers. They process information to provide these services to us.
• When you choose to share. If you create or send a public Clinical Summary link, anyone with the link can view the summary without signing in and may forward it to others.
• Legal, safety, and security reasons. We may disclose information when reasonably necessary to comply with applicable law or a lawful request, protect rights and safety, investigate fraud or misuse, or secure Kozo.
• Business changes. If Foresee is involved in a merger, financing, acquisition, reorganisation, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.

6. Public Clinical Summary links

When you choose to share a Clinical Summary, Kozo creates a public bearer link. Anyone who has the link can view the Clinical Summary without a Kozo account or sign-in and can copy or forward the link.

Only create or send a link if you are comfortable with the recipient seeing the information in the Clinical Summary. At present, these links do not expire automatically and cannot be revoked through the Kozo app.

If you send a link through WhatsApp or another third-party sharing service, that service will handle the link and related information under its own privacy policy.

The public page shows the shared Clinical Summary, not your full Kozo account or complete chat history. However, the summary itself may contain sensitive health information.

7. Cookies, local storage, and analytics

Kozo uses browser storage and similar technologies where needed for sign-in, session continuity, security, and service operation.

We use analytics tools to understand how Kozo is used, troubleshoot problems, and improve the service. These tools may collect usage information, including pages viewed, interactions with Kozo, and session replay data, and may associate that information with your account.

Kozo uses Google Ads conversion measurement only for requests that our hosting provider identifies as coming from India. IP-based location can be inaccurate, including when a VPN, proxy, or carrier network is used. If a request is not identified as coming from India or location is unavailable, Kozo does not initialise Google Ads measurement.

Google may automatically receive technical information needed for measurement, including the page URL and referrer, IP address and approximate location, device and browser information, Google ad-click information, and Google advertising cookies or identifiers. Kozo uses this information to measure whether a visit associated with a Google advertisement was followed by Kozo displaying a completed action artifact.

Our custom Google Ads conversion event contains only Google’s conversion action identifier. We do not intentionally include symptom text, chat content, diagnoses, generated health content, profile or contact data, email addresses, phone numbers, Kozo user or chat identifiers, uploads, or public Clinical Summary tokens in that event. Kozo does not initialise Google Ads on a fresh public Clinical Summary page.

Enhanced conversions, remarketing, and ad-personalisation signals are not enabled by this integration. Learn more about how Google uses information from sites or apps that use its services.

You can use your browser settings to control cookies or local storage, but blocking essential storage may prevent parts of Kozo from working correctly.

8. Storage, processing locations, and retention

Kozo and its service providers may store or process personal information in India and in other countries where they operate. Processing locations depend on the provider and how the service is configured.

We retain personal information for as long as reasonably necessary to provide, secure, maintain, and support Kozo, comply with legal obligations, resolve disputes, and enforce our agreements. Different records may be kept for different periods, and some information may remain for longer in security, debugging, legal, backup, or technical records.

Kozo does not currently provide an in-app account or data deletion control. You may contact our Grievance Officer to request access or correction, withdraw consent, ask for deletion, or raise a privacy grievance. We will verify and review requests in accordance with applicable law. Withdrawing consent or requesting deletion may affect our ability to provide Kozo.

9. Security

We use reasonable technical and organisational safeguards intended to protect personal information. These include access controls and private storage controls for health-related uploads.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you should protect access to your phone, one-time passwords, account, and public share links.

10. Your choices and rights

Depending on applicable law, you may ask us for information about personal data we process, request correction or updating of inaccurate information, ask for deletion, withdraw consent where processing is based on consent, or raise a privacy grievance.

Contact our Grievance Officer using the details below to make a request. We may need to verify your identity or authority before acting. Rights may be subject to legal exceptions.

If you submitted information about another person, they may also have rights in relation to their information. We may ask for evidence of identity or authority before responding.

Our Grievance Officer will address grievances expeditiously and within one month of receipt.

11. Changes to this Policy

We may update this Privacy Policy as Kozo, our practices, or applicable requirements change. When we do, we will update the “Last updated” date and provide any additional notice required by law.

Please review this Policy periodically. If a change requires new consent, we will ask for it as required before relying on that consent.

12. Contact us

For privacy questions, requests, or grievances, contact our designated Grievance Officer: