Kubyk Privacy Policy
Last Updated: October 15, 2026
Kubyk is a product of KeborMed, Inc.
Introduction
Kubyk is a product of KeborMed, Inc., a Delaware corporation ("KeborMed," "we," "us," or "our"). We are committed to protecting your privacy. Capitalized terms used but not defined in this Policy shall have the meanings assigned thereto in the Kubyk Master Terms of Service and in the tier schedule applicable to your subscription, each of which can be located at kubyk.health/terms. This Privacy Policy describes our practices regarding the personal information we collect from users of the Kubyk website (kubyk.health), the Kubyk Platform portals, and any associated mobile applications. How this Policy applies depends on our role, as explained in "Our Role" below.
This Privacy Policy applies differently depending on your Kubyk Platform Tier of service. The Kubyk Lab Tier and the Kubyk Lab+ Tier are designed for prototyping with simulated data only, prohibit the use of Protected Health Information (PHI) and implement a pseudonymous-by-design architecture. The Kubyk Scale Tier permits the use of PHI in connection with a Permitted Activity, as that term is defined in Schedule C: Kubyk Scale Terms, and subject to the restrictions in that schedule including a separately signed Business Associate Agreement (BAA).
Geographic Scope: The Kubyk Platform is currently available only to users located in the United States. This Privacy Policy is designed to comply with United States federal and state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The Master Terms allow you to engage personnel, contractors or service providers outside the US to support your internal development, engineering and operational activities, and this Policy is designed to comply with the General Data Protection Regulation (GDPR) regarding information of such individuals.
This Policy does not apply to any websites, mobile applications, or other online services that do not link to this Policy, or any face-to-face or telephonic interactions with the Kubyk Platform or us. The Kubyk website may contain links to other websites operated by third parties, which we do not control and for which we are not responsible.
Our Role
Website and Kubyk accounts. For information about visitors to our website and about the people who create and manage Kubyk accounts (for example registration, billing, support and questions to KAI), KeborMed determines how personal information is used, and this Policy applies in full.
Customer deployments. Kubyk customers use the Kubyk Platform to run their own portals and applications (for example at addresses ending in kubyk.dev), invite their own users, and collect device and sensor data. For that information ("Customer Data"), KeborMed acts as a service provider and processor on behalf of the customer, under the Kubyk Master Terms of Service and, for the Kubyk Scale Tier, a Business Associate Agreement. The customer decides how Customer Data is used and is responsible for providing its own privacy notice to its users. If you use a customer's deployment, please contact that customer with questions or requests about your information; if we receive such a request, we will forward it to the customer.
The sections of this Policy on the Kubyk Platform's data architecture and tier-specific data handling describe how we protect Customer Data on the customer's behalf. They do not change the customer's responsibilities to its own users.
Information We Collect
Information You Provide
- Contact Information: Name and email address provided when you contact us or create an account.
- Account Information: Name, email address, login credentials, role assignment, and associated Identifier (for User roles).
- Device Registration Data: Device identifiers, serial numbers, model information, and firmware versions.
- Sensor Readings and Device Data: Data transmitted from registered devices, associated with alphanumeric Identifiers (not real names) in the Lab and Lab+ Tiers.
- Feedback and Correspondence: Information you provide when you contact us through our contact forms or otherwise correspond with us.
- Billing Information: For paid subscriptions (Kubyk Lab+ and Kubyk Scale), your billing name and billing address. Payment card details are collected and processed directly by our payment processor, Stripe; we do not collect or store credit card numbers.
Information Collected Automatically
We or our service providers may automatically collect certain information from your device, including: IP addresses, language preferences, device identifiers, browser information, pages visited, and location (if you grant permission). We also collect information about how you interact with the website and Kubyk Platform, including navigation paths, time spent, and features used. We use cookies, pixel tags, and similar technologies to collect this information on our website. Except for strictly necessary cookies, we use them only as described in "Cookies and Your Choices" below. We work with third-party analytics providers, such as Google Analytics, to understand how people find and interact with our website.
Kubyk Platform Data Architecture
Dual Identity Model
The Kubyk Lab and Lab+ Tiers implement a pseudonymous-by-design architecture to protect data subject privacy:
- Authentication Plane: Your account information (name, email) is used solely for portal access and account management. The Kubyk Platform maintains strict separation between this information and sensor data.
- Data Plane: All sensor readings and device data are associated with neutral alphanumeric Identifiers (e.g., "User_A1", "User_B2") rather than real names or other direct identifiers. No personally identifiable information is stored with sensor data.
- Customer Responsibility: You are solely responsible for maintaining any mapping between Identifiers and real-world individuals. This mapping must be stored separately and securely outside the Kubyk Platform, it being understood that the Kubyk Platform includes a feature which enables you to export data by email.
Tier-Specific Data Handling
Kubyk Lab & Lab+ (Prototyping Tiers): You may not upload, transmit, or store Protected Health Information (PHI) or real patient data. All data must be simulated or test data only.
Kubyk Scale: Processing of real patient data is permitted only after execution of a Business Associate Agreement (BAA) with KeborMed. PHI processing will be governed by the terms of the BAA and applicable HIPAA regulations, including breach notification procedures.
Account Registration and Invitations
The person who creates a Customer Account (the account owner) registers through our account management site, kubyk.health, and provides their name, email address and organization; for paid subscriptions, payment is handled by our payment processor. All other Kubyk Platform portal accounts are created by administrators who invite users by email, and we collect an invited user's personal information only after the invitation is accepted. Account administrators are responsible for ensuring they have appropriate authorization to invite users and collect their information.
Artificial Intelligence and Automated Processing
KAI Natural Language Assistant
KAI is an AI-powered assistant that helps you understand the features of the Kubyk Platform, and learn how to work with it effectively. KAI responds to your questions about Kubyk Platform functionality, setup, and best practices. KAI does not access, process, or analyze your sensor readings or Customer Data in the Data Plane.
Data Usage for AI
We do not use your Customer Data to train our AI models. KAI's underlying models are trained on general datasets and do not learn from your specific data. KAI only processes the questions you ask about Kubyk Platform functionality.
Automated Decisions
KAI does not make automated decisions that have legal or similarly significant effects on you. Notifications generated when expected data is not received are based on data expectations you configure, and do not involve automated decision-making about individuals.
Questions About AI Processing
If you have questions about AI processing, contact us at privacy@kebormed.com.
Legal Basis for Processing
We process your personal information based on the following legal grounds:
- Contract Performance: Processing account data and usage data necessary to provide you with the Kubyk Platform services.
- Legitimate Interest: Processing for analytics, service improvement, security monitoring, and fraud prevention.
- Consent: Processing for marketing communications and non-essential cookies (you may withdraw consent at any time).
- Legal Obligation: Processing required to comply with applicable laws, regulations, or legal process.
How We Use Your Information
We use your personal information to:
- Provide and operate the Kubyk website and Kubyk Platform, and improve them using website and account information
- Enable device registration, configuration, and management
- Display sensor readings in the portal
- Provide AI-assisted Kubyk Platform guidance through KAI
- Generate notifications when data expected under a configuration you set is not received
- Facilitate communication between users within the Kubyk Platform
- Communicate with you about the Kubyk Platform, including announcements, updates, security alerts, and support messages
- Personalize your experience and send marketing communications (with your consent)
- Comply with legal obligations, respond to legal process, and protect our rights
Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Specific retention periods:
| Data Category | Retention Period |
|---|---|
| Website Analytics | 14 months |
| Marketing Contact Data | Until opt-out, plus 30 days |
| Lab/Lab+ Account Data | Duration of account, plus 30 days |
| Sensor Data | Duration of the subscription; deleted on request, or after the retrieval period following termination set out in the applicable tier schedule |
| Scale PHI | Duration of the subscription, plus the retrieval period set out in Schedule C, then returned or destroyed in accordance with the BAA |
| Cookie consent record | 6 months |
Data Security
We implement industry-standard technical and organizational measures to protect your information. Despite our efforts, we cannot guarantee absolute security in all circumstances.
- Security Certifications: KeborMed maintains ISO 13485 (medical device quality management) and ISO 27001 (information security management) certifications.
- Encryption: All data is encrypted in transit and at rest using industry-standard encryption.
- Pseudonymous Architecture: The Lab and Lab+ Tiers implement a pseudonymous-by-design architecture that separates personal identity information from sensor data, providing an additional layer of privacy protection.
Data Breach Notification
In the event of a security breach affecting your personal information, we will notify you as required by applicable law. We will provide notification without undue delay after confirming a breach that affects your personal information. For customers with a Business Associate Agreement, breach notification will follow the timelines specified in that agreement.
Your Rights and Choices
Opt Out of Marketing
You may opt out of marketing communications by following the unsubscribe instructions in any marketing email, or by contacting us at privacy@kebormed.com.
Account Deletion
You may request deletion of your account and associated data by contacting your account administrator or by emailing privacy@kebormed.com. We will respond to account deletion requests within the period required by applicable law, subject to any legal retention requirements.
Cookie Preferences
You can manage your cookie preferences at any time with the "Your Privacy Choices" link at the bottom of our pages. You can also block or delete cookies in your browser settings; strictly necessary cookies are needed for the website to work.
California Privacy Rights (CCPA/CPRA)
This section applies to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
Your Rights
California residents have the following rights:
- Right to Know: Request information about how we have collected, used, and shared your personal information.
- Right to Access: Request a copy of the personal information we maintain about you.
- Right to Delete: Request deletion of the personal information we have collected or maintain about you.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt-Out of Sale/Sharing: To the extent personal information is shared for cross-context behavioral advertising through advertising cookies on our website, you may opt out at any time. We do not otherwise sell or share your personal information.
Your Privacy Choices
Kubyk does not sell your personal information. Advertising cookies on our website may constitute a sale or sharing under California law. To opt out, click the "Your Privacy Choices" link at the bottom of our pages and turn off Marketing cookies, or turn on Global Privacy Control in your browser, which we honor automatically. You may also contact us at privacy@kebormed.com.
Exercising Your Rights
To exercise your California privacy rights, contact us at privacy@kebormed.com or by mail at the address below. You are entitled to exercise these rights free from discrimination. We will verify your identity before processing your request.
If your personal information was provided to us by a Kubyk customer as part of its deployment, we process it on that customer's behalf and will refer your request to the customer.
Other U.S. State Privacy Rights
Residents of other U.S. states with consumer privacy laws may have similar rights, including the right to access, correct and delete personal information and to opt out of targeted advertising. You can exercise them in the same way: through "Your Privacy Choices", Global Privacy Control, or by contacting privacy@kebormed.com. Occasionally we may be unable to fulfill a request, for example if we cannot verify your identity, if the information belongs to a Kubyk customer's deployment, or if we are required by law to retain it. If that happens, we will explain why, and you may appeal by emailing privacy@kebormed.com.
Children's Privacy
The Kubyk website and Kubyk Platform are intended for use by individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we discover we have collected personal information from someone under 18, we will delete it promptly. If you believe we have collected information from someone under 18, please contact us immediately at privacy@kebormed.com. Where a Kubyk customer collects data from a minor through its own deployment, that customer is responsible for obtaining any parental or guardian consent required by law, and we process that data on the customer's behalf.
Rights of EU Data Subjects (GDPR)
Kubyk is currently available only for use in the United States. However, the Master Terms allow US Customers to engage personnel, contractors or service providers outside the US to support their internal development, engineering and operational activities. This Policy is designed to comply with the General Data Protection Regulation (GDPR) regarding information of such individuals.
In compliance with the General Data Protection Regulation (GDPR), individuals in the European Union have specific rights regarding their personal data:
- Right of Access: You have the right to ask us for confirmation on whether we are processing your personal data, and access to the personal data and related information on that processing.
- Right of Rectification: You have the right to have your personal data corrected, as permitted by law.
- Right to Erasure: You have the right to ask us to delete your personal data, as permitted by law.
- Right to Restriction of Processing: You have the right to request the limiting of our processing under certain circumstances.
- Right to Data Portability: You have the right to receive the personal data that you have provided to us, in a structured, commonly used, and machine-readable format.
- Right to Object: You have the right to object to our processing of your personal data as permitted by law.
- Right to Lodge a Complaint: You have the right to lodge a complaint with a competent supervisory authority subject to applicable law.
- Right to Withdraw Consent: If we are processing your personal data based on your consent, you have the right to withdraw your consent at any time.
To exercise any of these rights, please contact us at privacy@kebormed.com.
If your personal data was provided to us by a Kubyk customer as part of its deployment, we process it on that customer's behalf and will refer your request to the customer.
Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy at any time. When we make changes, we will post the updated notice on our website and update the "Last Updated" date. For material changes, we will provide notice via email or through the Kubyk Platform. Please review this Policy periodically for any changes.
Contact Us
If you have any questions about this Privacy Policy, please contact us:
- Email: privacy@kebormed.com
- Support: support@kebormed.com
- Mail:
Kubyk (a product of KeborMed Inc.)
Attn: Privacy Officer
815 Superior Ave. East, Suite 1618
Cleveland, Ohio 44114