This Privacy Policy describes how Kayros Technologies, LLC (“Kayros,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information in connection with the Kayros corporate website, Kayros Assist, client and patient portals, appointment scheduling tools, chatbots, artificial intelligence voice services, SMS and WhatsApp communications, secure messaging tools, and related services (collectively, the “Services”).
This Privacy Policy applies to Clients, their authorized users, website visitors, prospective Clients, healthcare professionals, patients, authorized patient representatives, and other individuals who interact with the Services.
1. Our Role
For Client Data and Patient Information, Kayros generally acts as a service provider or processor on behalf of the applicable Client. In the healthcare context, Kayros may also act as a Business Associate when the Services involve Protected Health Information (“PHI”) and the parties have entered into an applicable Business Associate Agreement (“BAA”). Kayros processes this information in accordance with Client instructions, the applicable agreement, and applicable law.
The Client determines the purposes of processing Client Data and remains responsible for required privacy notices, consents or authorizations, communication preferences, and legal compliance. For information Kayros uses for its own business purposes, including website operation, sales inquiries, billing, account administration, security, fraud prevention, and legal compliance, Kayros may act as an independent business or controller, as applicable.
This Privacy Policy does not replace any Notice of Privacy Practices provided by a healthcare Client.
2. Information We Collect
The information we collect depends on the Services selected and configured by the applicable Client.
Contact Information
When you use the Services, receive notifications or reminders, access our website or applications, request information, schedule a demonstration, or interact with a chatbot, we may collect your name, telephone number, and email address. We process this information as necessary to provide and administer the Services, communicate with you, respond to your requests, manage our relationship with Clients and prospective Clients, and for the other purposes described in this Privacy Policy.
Client and Authorized User Information
We may process name, business email address, telephone number, organization, job title or role, username, account permissions, authentication information, access history, audit records, and activities performed within the Services.
Patient, Appointment, and Interaction Data
Depending on the Client configuration, Kayros may process patient and appointment information such as name, date of birth, telephone number, email address, healthcare organization, provider, appointment date, time, location and type, reason for the visit, communications, responses, documents or attachments when enabled, chatbot interactions, call transcripts and summaries, support communications, and related metadata. Kayros does not currently retain audio recordings of calls; audio may be processed in real time through speech-recognition technology to generate a transcript and provide the Services.
Technical and Usage Information
We may collect IP addresses, browser and device type, operating system, session information, application events, access and diagnostic logs, cookie identifiers, and general location information such as city or locality. We use this information to operate, secure, troubleshoot, and improve the Services.
Meta and WhatsApp Integration Data
When an authorized Client connects a WhatsApp Business Account through Meta Embedded Signup, Kayros may receive and process business and technical identifiers such as the Meta Business Portfolio identifier, WhatsApp Business Account (“WABA”) identifier, WhatsApp business phone number identifier, sender configuration, authorization and onboarding status, and related technical or error information. We use this information to configure, connect, maintain, secure, and support the Client’s WhatsApp integration through Twilio.
Sources of Information
We may collect information directly from individuals and Clients; from Client-authorized practice management, electronic health record, scheduling, or other systems; from service providers such as Microsoft, Twilio, and Meta; and automatically from browsers, devices, applications, cookies, logs, webhooks, and use of the Services.
3. How We Use Information
- Provide, administer, support, and improve the Services and manage Client and user accounts.
- Schedule, confirm, remind, cancel, or reschedule appointments and enable authorized communications.
- Configure and support Meta, WhatsApp Business Platform, Twilio, and other authorized integrations.
- Authenticate users, assign permissions, maintain audit records, and protect the security and integrity of the Services.
- Troubleshoot, evaluate performance, respond to inquiries, and prevent fraud, abuse, or security incidents.
- Comply with legal, regulatory, contractual, telecommunications, and platform requirements.
- Send business-to-business marketing communications to contacts or prospective Clients where permitted by law and subject to any required consent.
4. How We Disclose Information
We may disclose personal information only as reasonably necessary for the purposes described in this Privacy Policy:
- To the applicable Client, in accordance with the Client’s instructions and governing agreement.
- Technology and service providers, including Microsoft Azure for hosting and AI services, Twilio for telephony, SMS, and messaging, and Meta for WhatsApp Business Platform integrations. Providers may process information to transmit, host, secure, support, maintain, and protect the applicable services and comply with legal or platform requirements.
- To employees, contractors, agents, and affiliates who require access and are subject to confidentiality and security obligations.
- To courts, regulators, law enforcement, government authorities, or other parties when required or permitted by law or reasonably necessary to protect rights, safety, security, or the Services.
- In connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or similar transactions, subject to appropriate safeguards.
- In aggregated or de-identified form that does not identify an individual.
- Notwithstanding the foregoing, mobile information and SMS consent will not be shared with third parties or affiliates for marketing or promotional purposes. Kayros may disclose mobile information and SMS consent to service providers solely as necessary to operate, secure, support, and deliver the Services and SMS communications, subject to applicable law and contractual confidentiality and data-protection obligations.
5. SMS and WhatsApp Communications
Kayros Assist enables Clients to send appointment confirmations, reminders, cancellations, rescheduling notices, administrative communications, and other authorized messages. Clients are responsible for providing required notices, obtaining and documenting applicable consent or opt-in, and honoring communication preferences and opt-out requests. Messages are designed to include only the information reasonably necessary for the communication, such as the patient’s first name, healthcare organization, appointment date and time, location, and an applicable map or scheduling link. Responses may be stored in Kayros Assist and made available to the applicable Client.
SMS
Recipients may opt out through the mechanism provided in the message, including by replying “STOP” when supported, or by contacting the applicable Client. When an SMS workflow may contain PHI, Kayros and the Client must use only services and configurations covered by the applicable BAA and approved for that purpose.
Before initiating WhatsApp communications, the applicable Client must obtain documented, explicit opt-in that is specific to WhatsApp and the type of communication. WhatsApp is a third-party channel operated by Meta and delivered through Twilio.
Recipients should avoid sending such information through WhatsApp. If sensitive information is received, it may be stored for the applicable Client, and the interaction should be moved to Kayros secure messaging or another approved secure channel when appropriate. Recipients may request to stop WhatsApp messages through the available opt-out mechanism or by contacting the applicable Client.
Mobile information, including mobile phone numbers, and SMS consent will not be shared with third parties or affiliates for marketing or promotional purposes. Kayros uses SMS communications only to provide requested or authorized Services, such as one-time verification codes, appointment-related communications, reminders, administrative communications, and other authorized messages.
6. Healthcare Information and Artificial Intelligence
Healthcare Information and HIPAA
When Kayros processes PHI on behalf of a Covered Entity or Business Associate, Kayros does so under the applicable BAA, Client instructions, and applicable law. Only approved services, subprocesses, channels, configurations, and workflows may be used to create, receive, maintain, or transmit PHI. A BAA alone does not make an otherwise ineligible service or configuration compliant. Patients seeking access to, correction of, restriction of, amendment of, or deletion of medical information should contact the applicable healthcare organization; Kayros will assist the Client when required by agreement or law.
Artificial Intelligence and Voice Services
Kayros Assist uses Microsoft Azure OpenAI Service and Microsoft Azure AI Speech to support conversational AI, appointment scheduling, speech recognition, natural language processing, automated responses, and call summaries. Depending on the Services used, Kayros may process transcripts, voice interactions in real time, text messages, appointment information, and user requests to provide the Services, conduct quality assurance, troubleshoot, maintain security, and evaluate accuracy and performance.
Client Data and Patient Information are not used to train or fine-tune publicly available or general-purpose AI models. Kayros does not use such data to train Kayros-owned models unless expressly authorized in writing by the Client and permitted by applicable law and agreement. Kayros may use aggregated or de-identified information to evaluate and improve the Services only as permitted by the applicable agreement, any applicable BAA, and applicable law, and subject to safeguards designed to prevent re-identification.
7. Security, Retention, and Deletion
Security
Kayros implements reasonable and appropriate administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, unauthorized access, alteration, and disclosure. Depending on the Services and configuration, safeguards may include encryption in transit and at rest where applicable, role-based and least-privilege access, multi-factor authentication for administrative access, audit logging, security monitoring, incident response, vulnerability management, and workforce confidentiality requirements. No transmission or storage method is completely secure, and Kayros cannot guarantee absolute security.
Retention and Deletion
Kayros retains personal information only for as long as reasonably necessary to provide the Services, fulfill contractual obligations, maintain security and audit records, prevent fraud, comply with legal or regulatory requirements, resolve disputes, and enforce agreements. Client Data and healthcare information are retained and returned or deleted in accordance with Client instructions, the applicable agreement, any applicable BAA, and legal requirements. Meta and WhatsApp integration data is retained while reasonably necessary to maintain and support the connected integration and meet applicable audit, legal, contractual, or platform obligations. Information in backups may remain until overwritten or deleted in the ordinary course, subject to access restrictions.
See our Data Deletion Instructions for how to request removal of a Meta or WhatsApp Business Platform integration.
8. Your Rights and Choices
Subject to applicable law and exceptions, individuals may have rights to request access, correction, deletion, restriction, objection, or portability; withdraw consent where processing is based on consent; appeal certain privacy decisions; and file a complaint with a competent authority. Kayros may verify identity and authority before responding and may deny or limit requests where permitted by law. Kayros will not discriminate against an individual for exercising applicable privacy rights.
Kayros generally processes Patient Information on behalf of healthcare organizations. Requests involving medical information should be directed to the applicable healthcare organization. Individuals may opt out of text or other electronic communications by replying “STOP” when supported, using the available opt-out mechanism, sending a clear request to discontinue messages, or contacting the applicable Client. Opting out may affect the ability to receive reminders through that channel.
9. Cookies and Similar Technologies
Kayros may use strictly necessary cookies for authentication, security, session management, load balancing, and account access. Subject to consent where required, functional or analytics cookies may be used to understand aggregated use and improve performance and user experience. Kayros does not currently use advertising or marketing cookies or tracking technologies for targeted advertising. Kayros does not share health-related information for advertising or marketing purposes.
10. International Processing and Children
International Processing
Kayros and its authorized service providers may process information in the United States or other jurisdictions in which they operate. When information is transferred across jurisdictions, Kayros uses contractual, technical, and organizational safeguards designed to protect it in accordance with applicable law.
Children’s Privacy
Any interaction involving a child under the age of 13 must be handled through the child’s parent, legal guardian, or other authorized representative.
11. Changes and Contact Information
Kayros may update this Privacy Policy to reflect changes in the Services, legal requirements, or data practices. The current version will be available through the Kayros website and will identify the date of the latest update. Additional notice or consent will be provided for material changes when required by law.
Questions, concerns, complaints, or privacy requests may be directed to:
Kayros Technologies, LLC
Email: compliance@kayrostech.com
Mail: PMB 238, 1353 RD 19, Guaynabo, PR 00966
Website: https://kayrostech.com
