1. Introduction

Kisho ("we," "our," or "us"), operated at kishomed.io, is a rare disease intelligence platform. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services, including our disease intelligence tools, AI-generated reports, organizational workspaces, and monitoring features.

2. Information We Collect

Account Information

• Name, email address, and password (stored as a cryptographic hash, never in plain text)
• Role selection (e.g., patient, caregiver, researcher, clinician)
• Email preferences and notification settings

Platform Activity

• Disease follows and saved searches (disease-anchored cross-domain monitors)
• Company follows, clinical trial follows, and organization follows
• Content contributions, feedback submissions, and flagged issues
• Push notification subscriptions (web push endpoint and keys)

Organization and Workspace Data

• Patient Advocacy Group (PAG) registration details (organization name, type, disease claims)
• Workspace content (AI-generated reports, inline comments, team membership)

Information Collected Automatically

• Log data (IP address, browser type, pages visited)
• Device information (device type, operating system)
• Usage analytics and page views

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain our services, including disease intelligence tools and monitoring
• Process PAG registrations, verifications, and subscription management
• Deliver personalized alerts, digests, and push notifications based on your follows and saved searches
• Generate AI-powered research reports within workspaces
• Moderate community contributions using automated content review
• Send transactional emails (account verification, password resets, alert digests, lifecycle communications)
• Improve our platform and user experience
• Enforce rate limits and prevent abuse
• Ensure the security and integrity of our services

4. AI Processing

Kisho uses artificial intelligence to power several platform features:

• Report Generation: AI models (OpenAI o3-mini and GPT-4o-mini) generate disease research reports using publicly available medical and scientific data. Your personal data is not sent to these models.
• Content Moderation: Community contributions are reviewed using the Anthropic Claude API to ensure content quality and safety.
• Editor Tools: Workspace editor features (validate, simplify, elaborate) use Claude Sonnet and GPT-4o-mini. These tools process the disease and medical content you are editing, not your personal account data.
• Intelligence Briefings: AI-generated summaries are based on aggregated public data sources (news, clinical trials, publications, policy), not your personal information.

Your personal data is not used to train any third-party AI models. AI processing is applied to publicly available medical and scientific data, not to your personal account information.

5. Information Sharing

We do not sell your personal information. We may share information in the following circumstances:

• Public Contributions: Disease information contributions are publicly visible with attribution
• PAG Profiles: Verified PAG information is publicly displayed in our directory
• Service Providers: We share data with trusted third-party services necessary to operate our platform (see Section 6)
• Legal Requirements: We may disclose information if required by law

6. Third-Party Services

We use the following third-party services to operate our platform. Each processes only the minimum data necessary for its function:

• Stripe: Payment processing for subscriptions. Stripe handles your payment card details directly; we do not store card numbers.
• Resend: Transactional email delivery (account verification, alert digests, lifecycle emails).
• OpenAI: AI report generation and content classification using disease and medical data.
• Anthropic: Content moderation and editor tools using disease and medical content.
• Cloudflare R2: Image and file storage (e.g., blog images, organization assets).
• Meilisearch: Search indexing for diseases, organizations, and platform content.
• Railway: Application hosting and infrastructure.
• Upstash Redis: Rate limiting and abuse prevention.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Passwords are stored using cryptographic hashing and are never stored in plain text. API keys are SHA-256 hashed in our database. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the following rights:

• Access your personal information
• Correct inaccurate information
• Request deletion of your account and associated data
• Object to or restrict certain processing
• Data portability
• Opt out of non-essential email communications via your notification settings

To exercise these rights, please contact us at [email protected].

9. Cookies

We use a minimal set of cookies necessary to operate the platform:

• Session Cookie: Maintains your authenticated session (required for login functionality).
• Preview Mode Cookie: Used to enable content preview features for authorized users.

We do not use third-party tracking cookies or advertising cookies. You can control cookies through your browser settings, but disabling session cookies will prevent you from logging in.

10. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

11. Data Retention

We retain your account data for as long as your account is active. Transient operational data, such as change feed events, is automatically purged after 120 days. Enrichment queue items are deleted after processing. If you request account deletion, we will remove your personal data within 30 days, though some anonymized or aggregated data may be retained for platform analytics.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

13. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: [email protected]