KITE HEALTH INC. PRIVACY POLICY
Last Updated: August 26, 2026
Kite Health Inc. ("Kite Health," "Kite," "we," "us," or "our") respects the sensitivity of information about children and families. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you visit kitehealth.com, use our web or mobile applications, register a test kit, use our testing and results platform, communicate with us, or otherwise use a service that links to this Privacy Policy (collectively, the "Services").
The Services are intended to be used by adults, including parents, legal guardians, and other legally authorized representatives who may provide information and specimens relating to a child. Children are not intended to create their own Kite accounts or independently use the logged-in Services.
1. Scope of This Privacy Policy
1.1 General Scope
This Privacy Policy applies to personal information that Kite processes in connection with the Services. It covers information collected directly from an adult account holder, information about a child or other test participant provided by an authorized adult, information Kite receives from Participating Practitioners and laboratories, and information generated through the Kite platform.
1.2 Protected Health Information and Business Associate Agreements
Different rules apply when information is Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). When Kite processes PHI on behalf of a healthcare practitioner, medical practice, laboratory, or other HIPAA-regulated organization for which Kite performs Business Associate functions (a "Healthcare Partner"), Kite uses and discloses that PHI only as permitted or required by HIPAA, the applicable Business Associate Agreement ("BAA"), and other applicable law.
If this Privacy Policy conflicts with an applicable BAA concerning PHI, the BAA and applicable law control. Kite does not use this Privacy Policy to obtain rights to PHI that are broader than the rights available to Kite under the applicable BAA and HIPAA.
1.3 This Policy Is Not a Notice of Privacy Practices
This Privacy Policy is not a substitute for a covered healthcare provider's Notice of Privacy Practices. The applicable covered entity is responsible for its Notice of Privacy Practices and for administering individual HIPAA rights, with Kite providing assistance as required by the BAA and applicable law.
1.4 Information Outside a HIPAA Business Associate Context
Some information Kite processes may not be PHI. Examples may include public-website analytics information, ordinary business contact information, transaction information held outside a clinical record, or health-related information that is collected in a context where Kite is not acting on behalf of a HIPAA covered entity or business associate. Such information is governed by this Privacy Policy and other applicable privacy laws. The same individual may have both PHI and non-PHI information associated with different interactions with Kite.
2. Our Role in the Clinical Testing Workflow
Depending on the Service and applicable law, Kite may receive information from you, a Participating Practitioner, and a participating laboratory; coordinate test eligibility and ordering; coordinate an at-home specimen workflow; receive identifiable laboratory reports; organize laboratory and intake information; generate software-assisted draft interpretations and individualized recommendations; provide a Participating Practitioner access to review, approve, modify, or reject an interpretation; deliver approved information through the platform; and support follow-up and longitudinal tracking.
Because Kite performs these functions as part of services provided in connection with the clinical activities of participating practitioners and other Healthcare Partners, Kite treats the core clinical testing workflow as a HIPAA Business Associate workflow. Kite limits PHI access to workforce members and service providers who need access for an authorized purpose and applies appropriate administrative, physical, and technical safeguards to electronic PHI.
2.1 Clinical and Scientific Advisors
Kite may consult with clinical, scientific, product, or other advisors regarding general product design, scientific literature, workflow design, or quality improvement. An advisor who has no operational role requiring patient-level information is not provided PHI merely because the person advises Kite. If an advisor or contractor is given access to PHI for an authorized operational function, Kite evaluates and documents the person's role and applies the workforce, subcontractor, confidentiality, access-control, and other requirements appropriate to that role.
3. Information We Collect and Receive
3.1 Adult Account Holder and Contact Information
We may collect an adult account holder's name, email address, telephone number, mailing and shipping address, relationship to the child or test participant, account credentials, communication preferences, identity or authority verification information, and other information needed to create, secure, and administer an account.
3.2 Child or Test Participant Identity Information
An authorized adult may provide information about a child or other test participant, including name, date of birth, age, sex or other biological information relevant to testing, mailing or service location, relationship to the account holder, and other identifiers needed to register a kit, coordinate an order, match a specimen, or maintain an accurate clinical record.
3.3 Health, Developmental, Lifestyle, and Intake Information
We may collect or receive developmental and health history, symptoms, diagnoses, allergies, medications, supplements, diet, hydration, sleep, digestion, behavioral information, environmental exposures, family history, prior testing, treatment history, healthcare goals, and responses to questionnaires or intake forms. The specific information collected depends on the applicable Service and the information reasonably needed for the testing and clinical workflow.
3.4 Specimen and Kit Information
We may collect kit identifiers, registration information, order information, specimen type, collection date and time, shipping and tracking information, accession information, specimen status, recollection status, and laboratory communications concerning specimen sufficiency or processing.
3.5 Laboratory and Clinical Information
We may collect or receive laboratory reports, biomarker and metabolite results, reference information, practitioner notes, clinical review status, practitioner approvals or modifications, follow-up information, educational explanations, and the interpretations, summaries, priorities, reports, or action plans generated through or uploaded to the Services.
3.6 Derived and Inferred Information
Kite may derive or generate information from the data available in the authorized workflow, such as prioritization, pattern identification, educational summaries, risk or quality flags, recommended discussion topics, progress indicators, or other software-assisted outputs. When these outputs identify an individual and are created or maintained on behalf of a Healthcare Partner, they may be PHI.
3.7 Payment and Transaction Information
We collect information about purchases, subscriptions, order status, billing contact information, discounts, refunds, and transaction history. Payments may be processed by a third-party payment processor. Kite generally does not receive or store the full payment card number when a third-party processor handles the transaction.
3.8 Communications and Support Information
We collect information you provide when you contact customer support, participate in a support call, complete a survey, send an email or text message, provide feedback, or otherwise communicate with Kite. Depending on the content and context, a support communication may contain PHI and will be handled accordingly.
3.9 Device, Log, Security, and Usage Information
When you use our public website or Services, we may automatically collect information such as IP address, browser type, operating system, device type, device or app identifiers, approximate location derived from IP address, pages or features accessed, timestamps, referring pages, session information, error logs, and security or diagnostic information. Logged-in activity may also generate audit records concerning account access, viewing of health information, changes to records, practitioner review, downloads, and other activity relevant to security and compliance.
3.10 Information From Participating Practitioners and Healthcare Partners
A Participating Practitioner or other Healthcare Partner may provide demographic information, intake information, clinical history, test orders, diagnoses, notes, treatment context, or other information reasonably necessary for Kite to perform the authorized Services. Information received from a Healthcare Partner may be PHI and will be handled in accordance with the applicable BAA and HIPAA.
3.11 Information From Laboratories
A participating laboratory may provide order status, specimen status, laboratory results, corrected reports, reference information, accession information, and communications needed to resolve a specimen or reporting issue. Such information may be PHI.
3.12 Information From Other Service Providers
We may receive information from shipping carriers, payment processors, identity or authentication providers, communications vendors, app stores, security vendors, and other service providers as necessary to provide, secure, and administer the Services.
4. How We Use Information
Kite uses information for the purposes described below. When information is PHI, each use is also subject to the applicable BAA, HIPAA, and other applicable law.
4.1 Provide and Coordinate the Services
- create and administer accounts and verify identity or authority;
- determine eligibility for an offered Service where permitted and coordinate practitioner involvement;
- register kits and coordinate specimen collection, shipping, laboratory processing, and recollection;
- receive, organize, display, and maintain laboratory reports and related health information;
- generate software-assisted draft interpretations, summaries, priorities, educational explanations, and individualized recommendations for the applicable workflow;
- enable Participating Practitioners to review, approve, modify, or reject interpretations and recommendations;
- deliver family-facing reports, action plans, educational content, and progress information; and
- support clinical follow-up and communications among authorized participants in the workflow.
4.2 Account Administration and Customer Support
We use account, contact, transaction, and support information to authenticate users, answer questions, troubleshoot issues, process requests, administer subscriptions or orders, and maintain records of support activity.
4.3 Payments, Fulfillment, and Operations
We use transaction and contact information to process payments, manage orders and refunds, ship kits, coordinate fulfillment, maintain accounting records, detect payment fraud, and administer other business operations.
4.4 Transactional and Clinical Workflow Communications
We use contact information to send communications concerning kit registration, shipment, specimen status, laboratory status, results availability, practitioner review, account security, billing, support, and other matters necessary to provide the Services. We take reasonable steps to limit sensitive details in communication channels that are not intended to carry detailed clinical information.
4.5 Security, Fraud Prevention, and Compliance
We use information to authenticate users, maintain audit logs, monitor access, detect and investigate security incidents or misuse, protect the integrity and availability of the Services, enforce our agreements, comply with legal obligations, support HIPAA compliance, respond to lawful requests, and protect the rights and safety of Kite, users, Healthcare Partners, and others.
4.6 Quality Assurance and Service Administration
We may use information as permitted by the applicable legal and contractual framework to troubleshoot workflows, validate data transmission, identify defects, measure service performance, perform quality assurance, support internal training concerning authorized operations, and improve the reliability and usability of the Services. PHI is not used for an independent purpose that is inconsistent with the applicable BAA.
4.7 Marketing
We may use contact information that is not PHI to send Kite marketing communications where permitted by law and consistent with your choices. We do not use PHI or identifiable child health information to create an advertising profile or to target advertisements based on a health condition, laboratory result, diagnosis, symptom, medication, or test activity.
4.8 Other Disclosed or Authorized Purposes
We may use information for another purpose that we disclose at the time of collection, that you direct or authorize, or that is otherwise permitted by the applicable BAA and law.
5. How Kite Handles PHI as a HIPAA Business Associate
5.1 Permitted Uses and Disclosures
When Kite acts as a Business Associate, Kite uses and discloses PHI only as permitted or required by the applicable BAA, HIPAA, and other applicable law. A BAA generally limits Kite to performing the functions or services for which the Healthcare Partner engaged Kite, together with limited uses or disclosures permitted for proper management and administration or as otherwise allowed by HIPAA and the BAA.
5.2 Safeguards
Kite maintains administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of electronic PHI and to reduce the risk of unauthorized use or disclosure. Kite's compliance program may include risk analysis and risk management, access controls, authentication, audit logging, security monitoring, encryption where appropriate, secure development practices, incident response, workforce training, vendor management, and access termination procedures appropriate to the systems and risks involved.
5.3 Minimum Necessary and Role-Based Access
Where the HIPAA minimum necessary standard applies, Kite seeks to limit uses, disclosures, and requests for PHI to the minimum reasonably necessary to accomplish the authorized purpose. Access to PHI is limited based on job function and operational need. A person does not receive PHI solely because the person is an employee, executive, clinician, advisor, investor, or contractor of Kite.
5.4 HIPAA Subcontractors
Kite may use service providers to host, transmit, support, analyze, or otherwise process PHI for an authorized Service. A provider that creates, receives, maintains, or transmits PHI on Kite's behalf for a function requiring Business Associate treatment is required to operate under an appropriate HIPAA subcontractor arrangement before receiving PHI. Kite limits such providers to the authorized service purpose and does not authorize them to use PHI for independent advertising, generalized model training, or unrelated product development.
5.5 Security Incidents and Breaches
Kite maintains procedures for evaluating security incidents involving PHI and for providing notices required by HIPAA and the applicable BAA. When Kite is acting as a Business Associate, Kite generally reports a reportable breach or other required incident to the responsible Healthcare Partner, which then determines and provides any individual, regulator, or media notice for which the covered entity is responsible, unless applicable law or the agreement assigns a different responsibility. For health information outside HIPAA, Kite evaluates and provides breach notifications required by applicable federal or state law, including the FTC Health Breach Notification Rule where that rule applies.
5.6 Individual HIPAA Rights
If you wish to exercise a HIPAA right concerning PHI, such as a right to access, amend, restrict, or obtain an accounting of certain disclosures, you should generally contact the Participating Practitioner or other covered entity responsible for the record. Kite will assist the covered entity as required by HIPAA and the applicable BAA. Kite may route a request received directly from you to the appropriate Healthcare Partner and may verify identity and authority before acting on a request.
5.7 Termination of Access
Kite maintains processes designed to revoke or adjust workforce, contractor, and vendor access when an individual's role changes, the person no longer requires access, or the relationship ends. Contractual obligations concerning return, destruction, or continued protection of PHI apply as required by the applicable BAA and law. Certain information may remain in backups, audit logs, legal holds, or other systems for a permitted period subject to continued safeguards.
6. Artificial Intelligence and Automated Processing
6.1 Clinical Workflow Use
Kite may use artificial intelligence, machine learning, statistical methods, and other automated tools to help organize information and prepare draft summaries, interpretations, priorities, educational explanations, or recommendations. These tools support the workflow and are not autonomous healthcare providers. Where practitioner review is part of the Service, the Participating Practitioner remains responsible for exercising independent clinical judgment.
6.2 PHI Processing by AI Providers
An artificial intelligence or model provider may process PHI only to perform an authorized service for Kite where such processing is permitted by the applicable healthcare arrangement. Kite requires appropriate contractual restrictions and, where the provider is a HIPAA subcontractor, an appropriate Business Associate arrangement. Kite does not authorize such a provider to retain or use PHI for the provider's own advertising, generalized model training, or unrelated product improvement.
6.3 No Generalized Training on Identifiable PHI
Kite does not use identifiable PHI to train generalized artificial intelligence models. This restriction does not prevent an authorized model from processing PHI to generate an output for the individual's Service where the processing is permitted under the BAA and HIPAA, nor does it prevent the use of properly de-identified information as described below.
6.4 Human Review and Quality Controls
Kite may use human review, automated checks, and quality controls to evaluate output accuracy, formatting, completeness, and workflow performance. Any reviewer who accesses PHI must have an authorized role and is subject to the safeguards applicable to that access.
7. How We Disclose Information
7.1 Participating Practitioners and Healthcare Partners
We disclose information to Participating Practitioners and other Healthcare Partners as necessary to coordinate testing, enable clinical review, support follow-up, maintain the authorized record, and perform the services for which Kite acts on their behalf. PHI disclosures are subject to HIPAA, the applicable BAA, and other applicable law.
7.2 Laboratories
We exchange information with laboratories as necessary to register specimens, coordinate orders, transmit information required for testing, resolve specimen issues, receive results and corrected reports, and support the testing workflow. Laboratory disclosures and responsibilities depend on the roles of the parties, applicable healthcare law, and the relevant contracts.
7.3 HIPAA Subcontractors and Other Service Providers
We use service providers for functions such as cloud hosting, data storage, security, authentication, communications, artificial intelligence processing, software development, customer support, payment processing, fulfillment, shipping, analytics, and other operational services. We provide or make available information only as reasonably necessary for the provider's authorized role and impose contractual restrictions appropriate to the information. Providers that handle PHI on Kite's behalf are required to satisfy applicable HIPAA subcontractor requirements.
7.4 Payment, Fulfillment, and Shipping Providers
We disclose transaction, contact, and shipping information to payment processors, fulfillment providers, and carriers as necessary to complete purchases and deliver or return kits. Kite seeks to avoid disclosing clinical details to these providers unless the information is necessary for the service and the disclosure is legally and contractually permitted.
7.5 Professional Advisors
Kite may disclose information to lawyers, auditors, accountants, insurers, and other professional advisors where reasonably necessary for legal, compliance, risk-management, audit, or business purposes. PHI is disclosed to a professional advisor only when the disclosure is permitted under HIPAA and the applicable BAA and the advisor is subject to appropriate confidentiality or Business Associate obligations where required.
7.6 Legal, Safety, and Regulatory Disclosures
We may disclose information when required by law, legal process, or a valid governmental request, or as permitted by law to protect rights, safety, and security. PHI disclosures are subject to the additional conditions, limitations, and procedures required by HIPAA and other healthcare privacy laws. Kite does not treat a request from law enforcement or another third party as authority to disclose PHI beyond what applicable law permits.
7.7 Business Transactions
Information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable law and contractual restrictions. PHI remains subject to applicable HIPAA and BAA obligations to the extent those obligations continue to apply, and a successor receiving PHI must assume applicable restrictions before using the PHI for a new purpose.
7.8 At Your Direction or With Consent or Authorization
We may disclose information when you direct us to do so or provide an applicable consent or authorization. A separate HIPAA authorization may be required for certain uses or disclosures of PHI. A direction or consent concerning non-PHI does not automatically authorize a use or disclosure of PHI that would otherwise require a HIPAA authorization.
8. No Sale of PHI; No Health-Based Targeted Advertising
Kite does not sell PHI. Kite does not disclose PHI or identifiable child health information to data brokers, advertising networks, or social media platforms for targeted advertising. Kite does not use a child's health condition, laboratory result, diagnosis, symptom, medication, supplement, or test activity to build an advertising profile or to target advertising.
Kite may use ordinary contact information that is not PHI to communicate about Kite products or services where permitted by law and consistent with your choices. You may opt out of marketing communications without affecting transactional or clinical communications needed to provide the Services.
9. De-Identified and Aggregate Information
9.1 HIPAA De-Identification
Where permitted by an applicable BAA and law, Kite may create de-identified information using a method permitted under HIPAA. Properly de-identified information is not PHI under HIPAA. Kite may use properly de-identified or aggregate information for security, service administration, quality assurance, performance analysis, benchmarking, scientific validation, and other lawful purposes consistent with Kite's commitments.
9.2 No Re-Identification
Kite does not attempt to re-identify information that has been de-identified for these purposes except as permitted by law for validation, security, or another specifically authorized purpose. Where Kite discloses de-identified information to another party, Kite may impose contractual restrictions against re-identification where appropriate or required.
9.3 De-Identified Information Is Different From Pseudonymized Information
Removing a name or replacing a name with an internal identifier does not necessarily make health information de-identified under HIPAA. Kite treats coded, tokenized, or pseudonymized information as PHI when it remains reasonably linkable to an individual in a manner that causes HIPAA to apply.
10. Optional Research, Scientific Validation, and Generalized Model Improvement
Kite may offer an optional program under which properly de-identified information may be used for research, scientific analysis, external validation, publication, benchmarking, or generalized model improvement beyond routine operation of the Services. Where Kite offers such a program as an optional parent or guardian choice, participation is voluntary and is not a condition of purchasing or receiving the core testing Services.
The applicable consent or choice will describe the program, the categories of information involved, the intended use, any external recipients, and any withdrawal right. Withdrawal will apply prospectively as described in the consent. Information already properly de-identified and incorporated into completed analyses, trained generalized models, aggregate statistics, or completed research may not be capable of being linked back to an individual or removed from completed work.
Kite will not represent that ordinary service consent, acceptance of the Terms of Use, or a BAA authorizes identifiable child PHI to be used for independent research or generalized AI training where separate authorization or consent is required.
11. Cookies, Analytics, SDKs, and Tracking Technologies
11.1 Public, Unauthenticated Website
On public, unauthenticated pages, Kite may use cookies and limited analytics, security, or performance technologies to understand website performance, remember preferences, prevent fraud, diagnose errors, and improve the user experience. These technologies may receive information such as IP address, device and browser information, referring page, timestamps, and activity on public pages. Kite configures public-site analytics to avoid intentionally collecting health information submitted through clinical or logged-in workflows.
11.2 Logged-In, Testing, and Health-Related Areas
Kite does not use third-party advertising pixels or cross-site behavioral advertising trackers in logged-in areas where users provide, receive, or view health information. Any analytics, error monitoring, session support, communications, or similar technology used in an authenticated health workflow must be evaluated for HIPAA compliance. If the provider creates, receives, maintains, or transmits PHI on Kite's behalf in a manner requiring Business Associate treatment, Kite requires an appropriate HIPAA arrangement before the provider receives PHI.
11.3 Mobile Application Technologies
A mobile application may use technologies necessary for authentication, security, crash reporting, notifications, device compatibility, and core functionality. Kite limits the information made available to such technologies based on their purpose and the sensitivity of the data. Kite does not authorize a mobile advertising SDK to receive PHI or identifiable child health information for targeted advertising.
11.4 Cookie and Opt-Out Choices
You can control many cookies through browser or device settings and any cookie controls Kite makes available. Where a privacy law applicable to non-PHI requires recognition of a valid universal opt-out preference signal, Kite will honor the signal as required. Browser settings do not necessarily affect technologies that are strictly necessary to authenticate an account, provide security, or deliver a requested Service.
11.5 Do Not Track
Some browsers transmit a "Do Not Track" signal. Because there is not a single uniform legal or technical standard for that signal, Kite does not respond to it except where required by applicable law. This does not change Kite's commitment not to use PHI or identifiable child health information for targeted advertising.
12. Children and Parent or Guardian Information
12.1 Adult-Directed Accounts
Kite's Services concern children, but Kite's online account and contracting relationship are intended for adults. A parent, legal guardian, or other legally authorized adult may provide information and a specimen relating to a child. The adult is responsible for having the legal authority required to provide the information and make applicable choices on the child's behalf.
12.2 Information About Children Provided by Adults
Kite may collect detailed information about a child from an adult account holder and from authorized Healthcare Partners. Federal COPPA requirements are generally directed to personal information collected online from children themselves. Kite nevertheless treats information about children as highly sensitive and applies the healthcare, privacy, security, and contractual protections described in this Policy.
12.3 No Independent Child Accounts
Kite does not intend for a child under 13 to independently create an account, submit information through the logged-in Services, or independently communicate health information to Kite online. If Kite learns that a child has directly created an account or provided personal information without appropriate adult involvement, Kite may suspend the account, contact the parent or guardian where appropriate, and take other steps required by applicable law.
12.4 Parent and Guardian Access
A parent or guardian's ability to access, direct, amend, or control a child's health information may be limited by applicable law, a custody order, or circumstances in which a minor is legally entitled to consent to particular healthcare services or control related records. Kite may request verification before granting or changing access to child information.
13. Security
Kite maintains administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of information, including safeguards appropriate for electronic PHI. Security measures are selected based on the sensitivity of the information, the system involved, reasonably anticipated threats, applicable contractual commitments, and legal requirements.
Measures may include role-based access controls, multi-factor authentication where appropriate, encryption in transit and at rest where appropriate, audit logging, environment separation, vulnerability management, secure development practices, backup and recovery procedures, incident response, vendor risk management, workforce training, device and endpoint protections, and procedures for changing or terminating access.
No method of transmission or storage is completely secure. You are responsible for protecting your account credentials and devices. Contact Kite promptly if you believe your account, device, or information has been compromised.
14. Retention and Deletion
14.1 Retention Depends on Record Type
Kite retains information according to the type of record, the purpose for which it is maintained, applicable BAAs and Healthcare Partner instructions, legal and regulatory requirements, healthcare record obligations, security and audit needs, payment and tax requirements, legal holds, and Kite's written retention schedule. Kite does not apply a single blanket retention period to every category of information.
14.2 Clinical and Laboratory Information
Retention of laboratory reports, practitioner-reviewed interpretations, clinical workflow records, and other PHI may depend on the applicable BAA, the Healthcare Partner's record obligations, laboratory requirements, state law, and the role Kite performs. Kite may retain such information for the period required or permitted by the applicable legal and contractual framework even after a consumer account is closed.
14.3 Account, Transaction, Support, and Security Records
Account information may be retained while an account is active and for a reasonable period afterward for support, security, dispute resolution, and legal purposes. Transaction and payment-related records may be retained for tax, accounting, fraud prevention, and financial-record requirements. Security and audit logs may be retained according to the system's security and compliance schedule. Support records may be retained to resolve issues and document actions taken.
14.4 De-Identified Information
Properly de-identified or aggregate information may be retained for a longer period because it is not maintained as identifiable personal information, subject to applicable contractual restrictions and Kite's commitment not to re-identify it except as permitted by law.
14.5 Backups and Legal Holds
Deletion from active systems may not immediately remove information from backups, immutable security logs, disaster-recovery systems, or records subject to a legal hold. Information retained in those systems remains protected and is deleted, overwritten, or de-identified according to the applicable retention cycle and legal requirements.
15. Your Privacy Rights and Choices
15.1 HIPAA Rights
If information is PHI that Kite maintains as a Business Associate, the applicable covered entity is generally responsible for receiving and acting on your HIPAA rights request. Depending on the circumstances, HIPAA may provide rights concerning access, amendment, restrictions, confidential communications, an accounting of certain disclosures, and a copy of the covered entity's Notice of Privacy Practices. Contact the Participating Practitioner or other covered entity identified in the relevant healthcare relationship. Kite will assist as required by the applicable BAA and HIPAA.
15.2 Rights for Personal Information Outside HIPAA
Depending on where you live, the type of information involved, and whether the applicable law applies to Kite, you may have rights concerning personal information that is not PHI, including rights to request access, correction, deletion, or portability; to learn about certain disclosures; to withdraw consent; to opt out of certain sales, targeted advertising, or profiling; and to appeal a decision concerning a request. Rights are subject to legal exceptions and verification requirements.
15.3 Requests and Verification
You may submit a privacy request using the contact information below. Kite may require information reasonably necessary to verify your identity, authority, and the information to which the request relates. Kite will not require you to create a new account solely to exercise a privacy right where applicable law prohibits that requirement. An authorized agent may submit a request where permitted by law, subject to verification of the agent's authority and the consumer's identity.
15.4 Appeals
If applicable law gives you a right to appeal Kite's decision on a privacy request, you may appeal by replying to the decision or using another appeal method Kite identifies. Kite will provide the response and any regulator-contact information required by applicable law.
15.5 Marketing Choices
You may unsubscribe from marketing email using the unsubscribe link in the message and may opt out of marketing text messages using the method provided in the message. We may continue to send transactional, security, billing, testing, and clinical workflow communications needed to provide the Services.
15.6 No Discrimination
Kite will not unlawfully discriminate against you for exercising a privacy right. This does not prevent Kite from offering a Service that reasonably requires particular information where the information is necessary to provide the Service and the collection is otherwise lawful.
16. Supplemental Consumer Health Data Notice for Information Outside HIPAA
Certain state laws regulate "consumer health data" that is not PHI or is otherwise outside a statutory HIPAA exemption. This Section is intended to provide supplemental disclosures for such information when a consumer health privacy law applies to Kite. It does not expand the scope of a state law to PHI or other information that the law expressly exempts.
16.1 Categories of Consumer Health Data
Depending on the Service, consumer health data outside HIPAA may include health conditions or symptoms; developmental, behavioral, diet, sleep, digestion, medication, supplement, or lifestyle information; laboratory or test information; health-related purchases; information about seeking a health-related service; and inferences, recommendations, or other information derived from those categories.
16.2 Sources
Sources may include you, a parent or guardian, a Participating Practitioner or other healthcare provider, a laboratory, a service provider involved in a requested Service, and information generated through your use of the Services.
16.3 Purposes of Collection and Use
Kite collects and uses consumer health data outside HIPAA to provide and support requested Services, coordinate testing, prepare and deliver reports or recommendations, administer accounts, communicate with users, maintain security, prevent fraud, troubleshoot and improve service reliability, comply with law, and carry out another purpose disclosed to and authorized by the consumer where required.
16.4 Categories of Consumer Health Data Shared
Kite may share the categories of consumer health data reasonably necessary to provide a requested Service, including identity and contact information, intake information, specimen and order information, laboratory or test information, and generated reports or recommendations, depending on the recipient and the purpose.
16.5 Categories of Recipients
Recipients may include Participating Practitioners and medical practices; laboratories; processors that provide cloud hosting, security, authentication, communications, artificial intelligence processing, customer support, or software operations; shipping and fulfillment providers where needed for the requested Service; and legal or professional advisors where disclosure is permitted and reasonably necessary. Kite does not sell consumer health data and does not share it with advertising networks or data brokers for targeted advertising. Kite does not currently share non-HIPAA consumer health data with a corporate affiliate for that affiliate's independent use. If Kite begins such sharing and applicable law requires the affiliate to be specifically identified, Kite will update this notice before the sharing occurs.
16.6 Consent and New Uses
Where applicable consumer health privacy law requires consent for collection or sharing, Kite obtains the required consent or relies on an applicable provision allowing processing necessary to provide a product or service the consumer requested. Kite will not materially expand the categories of consumer health data collected, the disclosed purposes of collection, or the categories of sharing in a manner that requires new affirmative consent without first providing the required disclosure and obtaining that consent.
16.7 Consumer Health Data Rights
Where applicable law provides these rights, you may request confirmation of whether Kite collects, shares, or sells consumer health data; access the data; obtain information about recipients; withdraw consent for future collection or sharing; request deletion; and appeal a denial. Kite will authenticate and respond to requests within the time required by applicable law, subject to permitted extensions and exceptions.
16.8 No Sale; No Health-Care Geofencing
Kite does not sell consumer health data. Kite does not use geofencing around an in-person healthcare facility to identify or track people seeking healthcare, collect consumer health data from them, or send health-related advertisements based on their presence at the facility.
17. California and Other State Privacy Laws
Some state privacy laws exempt PHI, medical information, or other information maintained by covered entities and Business Associates in compliance with healthcare privacy laws, while applying to other personal information held by the same company. To the extent a generally applicable state privacy law applies to Kite and to information not exempt under that law, Kite will provide the rights and disclosures required by that law. This Privacy Policy is intended to describe Kite's current practices without implying that every state privacy statute applies to every category of Kite information.
Kite does not sell personal information for monetary consideration and does not use health information for cross-context behavioral advertising. If Kite introduces a practice that is legally treated as a sale, targeted advertising, or another opt-out activity under an applicable state law, Kite will update its disclosures and provide any required choice before applying the practice to affected information.
18. International and Offshore Processing
Kite is based in the United States and the consumer Services are intended primarily for use in the United States. Kite may engage service providers, contractors, or personnel in other locations for software development, support, security, or other operational functions. Access to PHI from another country is permitted only where the access is consistent with HIPAA, the applicable BAA, Kite's security requirements, and any contractual or legal geographic restriction that applies to the information.
Kite applies role-based access, confidentiality obligations, technical safeguards, and contractual restrictions to authorized personnel regardless of location. A vendor or developer does not receive PHI merely because the vendor supports Kite; PHI access is limited to the individuals and systems with an authorized need for that access.
19. Third-Party Links, App Stores, and External Services
Our public website or Services may link to third-party websites, app stores, educational resources, or other services that Kite does not control. Their privacy practices are governed by their own notices. A link does not mean Kite endorses the third party's privacy practices. Information exchanged with a third party as part of an authorized healthcare workflow remains subject to the legal and contractual framework applicable to that exchange.
20. Changes to This Privacy Policy
Kite may update this Privacy Policy to reflect changes in the Services, law, or Kite's practices. Kite will post the revised policy and update the "Last Updated" date. If a change materially expands the collection, use, or disclosure of sensitive information, Kite will provide additional notice or obtain consent where required by law or Kite's contractual obligations. Updating this Privacy Policy does not by itself expand Kite's rights to use PHI beyond what HIPAA and the applicable BAA permit.
21. Contact Us
To ask a privacy question or submit a privacy request concerning information that is not handled through your healthcare provider, contact:
Kite Health Inc. 425 Page Mill Road, Suite 200, 2nd Floor
Palo Alto, California 94306
United States
Email: contact@kitehealth.com
HIPAA rights requests relating to a Participating Practitioner's or other covered entity's records may be routed to that practitioner or covered entity. If you are unsure where to direct a request, you may contact Kite and we will help identify the appropriate path.
.png)