Privacy Policy

Kintara provides software to businesses (“Customers”), such as clinics and home service companies. For information about a Customer’s own patients, clients or leads (“Customer Data”), the Customer decides why and how it is processed andKintara processes it on the Customer’s behalf, as a service provider or “processor”. Where a Customer is a healthcare provider covered by HIPAA, we act as its business associate under a Business Associate Agreement. For account details of the people who sign in to Kintara, and for visitors to our website, Kintara is responsible for the information.

• Account information: name, email address, phone number, role, organization, password (stored hashed by our authentication provider) and sign-in method, including Google sign-in.
• Calls and messages: audio recordings, transcripts and summaries of calls handled or placed by Kintara’s AI agents, caller phone numbers, call times and outcomes, and the content of SMS and email messages sent through the platform.
• Customer Data: details of a Customer’s patients, clients or leads that the Customer or its callers provide, such as names, contact details, appointment details, intake form answers and, for healthcare Customers, health information.
• Connected services: when a Customer connects a calendar, practice management system, CRM or other tool, the data needed for that integration, such as calendar availability and appointments (see section 4 for Google data).
• Billing information: plan, usage (such as call minutes and messages) and payment details, which are handled by our payment processor; we do not store full card numbers.
• Technical information: IP address, browser and device type, pages used, and logs needed to run, secure and troubleshoot the service. We use only the cookies needed to keep you signed in, remember preferences and limit abuse; we do not use advertising cookies.

• To provide the service: answer and place calls, book, change and cancel appointments, send reminders and follow-ups, and show calls, recordings and reports in the dashboard.
• To create and secure accounts, including multi-factor authentication.
• To bill Customers for their plan and usage.
• To provide support, fix problems and keep the service secure and reliable.
• To send service messages, such as security alerts and changes to the service. We send marketing messages only where permitted, and you can opt out at any time.
• To meet legal obligations and enforce our terms.

We do not sell personal information, and we do not use Customer Data for advertising. We do not use Customer Data, call recordings or transcripts to train generalized AI models.

Kintara offers Google sign-in and lets Customers connect Google Calendar so its AI agents can book appointments. When you connect a Google account, we request only the access needed:

• Sign-in (openid, email, profile): your name, email address and profile picture, used to create your account and sign you in.
• Google Calendar: used to read the availability of the calendars you choose and to create, update and cancel the appointments Kintara books, changes or cancels for your business. We store the access and refresh tokens encrypted, and the appointment details the service needs.

Kintara’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer Google user data to others except as needed to provide those features, to comply with law, for security, or as part of a merger or acquisition with notice to you.
• We do not use or transfer Google user data for advertising, and we do not sell it.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.
• No person at Kintara reads Google user data unless you ask us to (for example for support), it is needed for security or to comply with law, or it has been aggregated and anonymized.

You can disconnect Google Calendar at any time in Kintara’s integration settings, or revoke access in your Google Account permissions. When you disconnect, we delete the stored tokens.

We share information only with service providers that help us run Kintara, under contracts that limit their use of it to providing their service to us, and where required with a Business Associate Agreement. They include (see the full list at Sub-processors):

• Supabase (database, authentication and file storage)
• Vercel (application hosting and delivery)
• Vapi (voice AI orchestration for live calls)
• Twilio (phone numbers, calls and SMS)
• Telnyx (backup telephony and SMS (failover))
• Deepgram (speech-to-text)
• ElevenLabs (text-to-speech voices)
• OpenAI (language models and transcription)
• Anthropic (language models)
• Resend (email delivery)
• Stripe (payments and billing)
• Google (calendar integration and OAuth sign-in)
• Tools a Customer chooses to connect, such as Google Calendar, a practice management system or a CRM, which receive the data the Customer directs us to send

We may also share information to comply with law or a valid legal request, to protect the rights, safety and security of our users and the public, or in connection with a merger, acquisition or sale of assets, in which case we will give notice.

We keep Customer Data, including recordings and transcripts, for as long as the Customer’s account is active or as the Customer configures, and delete it within 90 days after the account is closed, unless the law requires us to keep it longer. Backups are overwritten on a rolling basis. Account and billing records are kept as long as needed for legal, tax and accounting purposes.

We protect information with encryption in transit and at rest, access controls with per-organization separation, multi-factor authentication, audit logs and least-privilege access for our staff. No system is perfectly secure, but we work to protect your information and will notify affected Customers of a breach as required by law and our agreements.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to or restrict some uses of it. Account users can update most details in their profile settings. If you are a patient, client or lead of a business that uses Kintara, please contact that business first, since it controls your information; we will help it respond. You can reply STOP to any text message to stop receiving them. To make a request, email privacy@kintaragroup.com. We will not discriminate against you for using these rights.

Kintara is a business service and is not directed to children under 13. We do not knowingly collect personal information from children for our own purposes.

Kintara is based in the United States, and information is processed and stored in the United States and other countries where our service providers operate, with appropriate safeguards.

We may update this policy from time to time. We will post the new version here with a new “Last updated” date and, for material changes, notify Customers by email or in the app.

Questions about this policy or your information: email privacy@kintaragroup.com or visit kintaragroup.com. See also our Terms of Service.