Kibo Privacy Policy
Version 1.4 · Effective 19 July 2026
Carebridge Vital Nexus Limited (“Kibo”, “we”, “us”)
Contact: privacy@kibocare.com

This Privacy Policy explains how Kibo collects, uses, shares, stores, and protects personal information when you use the Kibo Platform. Your information is primarily stored in the United States. This Policy describes our practices. Where the law requires a separate consent, we will ask for it clearly (including the US Hosting and Cross-Border Data Transfer Consent).

1. Who this Policy covers
This Policy applies to people who use the Platform as patients or account holders, and to healthcare providers and authorized staff who use the Platform in connection with your care. The Platform is currently offered in the United States, Japan, and Hong Kong.

2. Our role
For your account, security, support, and Platform operations, Kibo decides how personal information is used. When we handle clinical information only on instructions from a healthcare provider you have chosen, we may act as that provider’s service provider.

3. Information we may collect
Depending on how you use the Platform, we may process:
- Account details such as name, email address, phone number, and login identifiers
- Profile information and information about a dependent that you choose to add
- Health and medical information you enter or upload, including pre-screening answers and documents
- Referral, enquiry, and document-sharing records with providers you select
- Messages related to your use of the Platform, and support requests
- Technical and security information needed to run and protect the service (for example device and log data)

We do not intentionally collect precise GPS location, social-media login data, or payment card details unless we clearly enable those features and tell you first.

4. How we use information
We use information to:
- Create and secure your account
- Provide the features you request
- Store medical documents and share them only when you authorize sharing
- Send referrals or treatment information to providers you choose
- Prevent fraud, keep the Platform secure, and meet legal obligations
- Provide customer support

Where the law requires consent for sensitive health information or international transfers, we will ask for that consent separately.

5. Where your information is stored
Your account and related patient information—including profile, pre-screening, medical documents, referrals, consent records, and security logs—are hosted in the United States. Your information may be accessed from or transferred to another country when you ask us to share it with a healthcare provider, or when a carefully selected company helps us operate the Platform (for example cloud hosting or authentication). We use contracts, access controls, and security measures appropriate to the sensitivity of the data. More detail is in the US Hosting and Cross-Border Data Transfer Consent.

6. Who we share information with
We may share information with:
- Healthcare providers, clinics, or care coordinators you select or authorize
- Companies that host or support the Platform (such as cloud, security, authentication, and communications providers) under confidentiality and data-protection commitments
- Professional advisers, and regulators or authorities when the law requires or allows disclosure

We do not sell your personal information for advertising.

7. Sharing with healthcare providers
Agreeing to United States hosting is not the same as sharing medical documents with a specific provider. You choose what to share with each provider through the Platform’s sharing controls.

8. How long we keep information
We keep information only as long as needed for the purposes above, our retention schedule, legal requirements, security, and disputes. If you withdraw consent or ask for deletion, we may still keep information where the law requires or where we need it for security, fraud prevention, or legal claims.

9. How we protect information
We use encryption where supported, access controls, authentication, monitoring, backups, and vendor checks. No online service can guarantee perfect security.

10. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, or to restrict or withdraw certain processing. To make a request, contact privacy@kibocare.com. We may need to verify your identity. You may also contact your local privacy authority if you have a complaint.

Additional notices may apply if you are in California, Japan, or Hong Kong under local privacy laws.

11. Children
The Platform is for adults. We do not knowingly allow a child to create an account. An authorized adult may manage information for a dependent.

12. Security incidents
If a security incident affects your personal information, we will assess it and notify you and authorities as required by applicable law.

13. Changes to this Policy
If we make important changes—especially to why we use data, what we collect, who we share with, or where data is stored—we will update this Policy and, where required, ask for new consent.

14. Contact
privacy@kibocare.com