Privacy Policy
Last Updated: 2026-08-03
Kyra Health (“Kyra,” “we,” “us,” or “our”) provides technology that helps employers and individuals manage and fund health benefits. We operate solely within the United States. Protecting your and your family’s privacy is central to our mission.
1. Scope and Legal Status
This Privacy Policy applies to all information we collect through our websites, mobile apps, and related services (the “Services”).
We are not a healthcare provider or insurer under HIPAA, but we handle health-related information using HIPAA-aligned privacy and security practices.
Because we facilitate payments and reimbursements, we also follow banking, tax, and anti-money-laundering requirements.
We do not operate outside the United States or offer Services to non-U.S. residents.
2. Information We Collect
We collect only what’s necessary to deliver the Services and meet compliance obligations:
- Identity information: names, addresses, mobile and other telephone numbers, contact details, dates of birth, SSNs/EINs (for identity verification and KYC/KYB).
- Financial information: bank and routing numbers, payment card tokens, transaction details, and related metadata.
- Health-related information: limited data used to
- verify insurance eligibility,
- help compare or select health plans,
- calculate contributions or reimbursements, and
- help you navigate your healthcare experience and find the best path for care.
- Dependent information: when a guardian uses our Services to manage coverage or care guidance for minors under 18.
- Technical and security data: device info, IP addresses, browser type, session logs, authentication tokens.
- Derived data: reimbursement history, plan preferences, benefit usage summaries.
We do not collect or store full medical records or detailed treatment histories.
3. How We Use Information
We use information to:
- Operate and deliver the Services, including account setup, eligibility checks, payments, and reimbursements;
- Support plan selection, affordability tools, and healthcare navigation;
- Detect, prevent, and respond to fraud or unauthorized activity;
- Comply with legal and regulatory obligations (KYC, AML, IRS, HIPAA-related);
- Operate, maintain, and improve our technology, including internal analytics and product development using aggregated or de-identified data;
- Communicate required updates and service notices.
We do not sell or rent your information or use health or financial data for advertising.
4. How We Share Information
We share data only as needed to deliver the Services or meet legal obligations:
- Payment partners: with Stripe, Fifth Third Bank, and Celtic Bank to move and reconcile funds;
- Employers and benefit administrators: to process reimbursements or contributions you authorize;
- Health insurance carriers: to establish, fund, and reconcile coverage on your behalf;
- Healthcare and EHR integrations: when you explicitly connect your account to another system (e.g., to view plan or claims data);
- Service providers: for hosting, security, and operations under strict confidentiality and security agreements;
- Regulators and authorities: when required by law (e.g., tax, banking, or AML inquiries).
All partners must maintain HIPAA-aligned and SOC 2–level security standards.
All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Data obtained through the SMS program will not be shared with any third parties for their marketing reasons/purposes.
5. How We Protect Information
We use industry-standard safeguards:
- Encryption at rest and in transit (TLS 1.2+, AES-256);
- Segregated environments and key management;
- Role-based, least-privilege access;
- Continuous monitoring and third-party penetration testing;
- Employee training and background checks.
6. Data Retention
We keep data as long as necessary for:
- delivering and supporting the Services,
- meeting contractual, legal, or regulatory obligations (e.g., IRS, banking, or HIPAA-related), or
- maintaining audit and fraud-prevention records.
When data is no longer needed, it is securely deleted or anonymized according to our retention policy.
7. Your Rights and Choices
You (or your authorized guardian) may:
- Request access to or correction of your information;
- Request deletion where reasonably possible, and not prohibited by applicable law or compliance obligations;
- Limit non-essential communications;
- Revoke previously granted connections to third-party systems.
Requests can be sent to privacy@kyra.health.
We may need to verify identity before acting on a request.
8. Children’s and Dependent Information
We do not offer direct accounts to minors under 18.
Parents or legal guardians may provide limited information about dependents for purposes of benefit eligibility, plan guidance, or care-related reimbursements.
Dependent data is protected under the same controls as adult data and is never used for marketing or analytics.
9. Changes to This Policy
We may update this Policy periodically. The “Last Updated” date reflects the current version.
If material changes occur, we will notify users through our Services or by email.
10. Contact Us
Kyra Health Privacy Office
222 Main St, Suite 244
Farmington, CT 06032
Email: privacy@kyra.health