This Privacy Notice for kenkodoc.com (doing business as Kenko) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at hello@kenkodoc.com.
In short: we collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, or otherwise when you contact us.
Personal information provided by you may include: names, email addresses, passwords, and contact or authentication data.
Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information: health data.
Payment data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and associated security code. All payment data is handled and stored by PayPal, not by us. You may find their privacy notice here: https://www.paypal.com/us/legalhub/paypal/privacy-full.
Social login data. We may provide you with the option to register with us using your existing Google account details. If you choose to register this way, we will collect certain profile information about you from Google, as described in the section below called "How do we handle your social logins?"
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
In short: some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, referring URLs, and information about how and when you use our Services. This information is primarily needed to maintain the security and operation of our Services.
On our marketing site only (kenkodoc.com), we use Google Analytics to understand traffic — this is gated behind a cookie consent banner and does not load unless you accept it. It is never used inside the logged-in application (app.kenkodoc.com), and is not used for advertising or to build ad profiles. Aside from that, our automatic collection is limited to standard web server logging performed by our hosting infrastructure (Google Cloud). You can find out more in our Cookie Policy.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In short: we process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We process your personal information for a variety of reasons, including to:
In short: we only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.
If you are located in the EU or UK, we rely on: Consent (which you can withdraw at any time by contacting hello@kenkodoc.com); Performance of a Contract (processing necessary to provide the Services you've signed up for); Legitimate Interests, specifically to diagnose problems and/or prevent fraudulent activity via our audit log; Legal Obligations; and Vital Interests, where necessary to protect someone's safety.
If you are located in Canada, we may process your information with your express or implied consent, or, in limited circumstances permitted by law, without consent (e.g. for fraud detection and prevention, or where required by a court order).
In short: we may share information with the following categories of third parties.
We share your data with third-party vendors who perform services for us or on our behalf and require access to such information to do that work. The categories of third parties we share personal information with are:
In practice, this means two vendors: Google Cloud/Firebase (covering cloud computing, data storage, authentication, and hosting) and PayPal (payment processing). We may also share or transfer information in connection with a merger, acquisition, or sale of company assets.
In short: within the application, we use only strictly necessary cookies and local storage. On the marketing site, we use Google Analytics, only after you consent.
Inside the application (app.kenkodoc.com), we use minimal cookies and similar technologies (specifically, authentication session storage) to keep you signed in and to maintain the security of your account — nothing for advertising or analytics there. On our marketing site (kenkodoc.com), we use Google Analytics to understand traffic; a consent banner is shown on first visit, and analytics cookies are only set if you click "Accept." We do not display ads, and we do not use cookies to build advertising profiles or tailor advertisements. Specific information about the cookies and local storage we use is set out in our Cookie Policy.
In short: if you choose to register or log in using your Google account, we may have access to certain information about you.
Our Services offer you the ability to register and log in using your Google account details. Where you choose to do this, we will receive certain profile information about you from Google — typically your name, email address, and profile picture. We use this information only for the purposes described in this Privacy Notice. We do not control, and are not responsible for, Google's own use of your information; we recommend reviewing Google's Privacy Policy.
In short: we may transfer, store, and process your information in countries other than your own.
Our database is located in the European Union (Google Cloud's eur3 multi-region). Some processing — specifically the Cloud Functions handling billing — currently takes place in the United States. Regardless of your location, your information may be transferred to, stored by, and processed in the facilities of the third parties with whom we share your personal information (see "When and with whom do we share your personal information?" above), including in the United States, since both Google Cloud and PayPal are US-headquartered companies, and this business is operated from Serbia.
If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland: we rely on the European Commission's Standard Contractual Clauses for transfers of personal information between us and our third-party providers, as incorporated into Google Cloud's Data Processing Addendum and PayPal's data processing terms. Further details can be provided upon request.
In short: we keep your information for as long as necessary to fulfill the purposes outlined in this notice, unless otherwise required by law.
We will only keep your personal information for as long as it is necessary for the purposes set out in this notice. No purpose in this notice requires us to keep your information for longer than the period during which you have an account with us, plus a further 30 days after cancellation to allow reactivation without data loss, after which it is deleted.
In short: we aim to protect your information through organizational and technical security measures.
We use authentication, per-practice data isolation enforced at the database level, and an immutable audit log recording every change made to a patient record. Sessions automatically sign out after 15 minutes of inactivity. However, no method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
In short: we do not knowingly collect data from or market to children under 18.
We do not knowingly collect, solicit data from, or market to children under 18 years of age. By using the Services, you represent that you are at least 18. If we learn that personal information from a user under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data. Contact us at hello@kenkodoc.com if you become aware of any such data.
Depending on your state of residence in the US or region (such as the EEA, UK, Switzerland, or Canada), you may have rights including: access to and a copy of your personal information; rectification or erasure; restriction of processing; data portability; and the right not to be subject to solely automated decision-making. You can exercise these rights by contacting hello@kenkodoc.com. We will consider and act upon any request in accordance with applicable data protection law.
If you are located in the UK and unhappy with how we've handled your information, you can complain to us directly, or to the Information Commissioner's Office (ico.org.uk/make-a-complaint, helpline 0303 123 1113). If you are in the EEA, you may complain to your Member State's data protection authority. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing consent: where we rely on your consent to process your information, you may withdraw it at any time by contacting hello@kenkodoc.com — this won't affect the lawfulness of processing before the withdrawal.
Account information: to review, change, or terminate your account, contact us using the information provided in this notice.
Most browsers include a Do-Not-Track ("DNT") feature. Because there is currently no uniform standard for recognizing DNT signals, we do not currently respond to them. If a standard is adopted that we must follow, we will update this notice accordingly.
In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to withdraw consent.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Email address, account name, unique identifier, IP address | Yes |
| B. California Customer Records personal information | Name, contact information | Yes |
| C. Protected classification characteristics | Gender, age, race and ethnicity, national origin | No |
| D. Commercial information | Subscription/billing status and history | Yes |
| E. Biometric information | Fingerprints, voiceprints | No |
| F. Internet or other similar network activity | Browsing history, search history | No |
| G. Geolocation data | Device location | No |
| H. Audio, electronic, sensory, or similar information | Images, audio/video/call recordings | No |
| I. Professional or employment-related information | Job title, work history | No |
| J. Education information | Student records | No |
| K. Inferences drawn from other personal information | Profiles or summaries of preferences | No |
| L. Sensitive personal information | Account login information and health data | Yes |
We have not sold any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties (our service providers, Google Cloud and PayPal) for a business purpose in the preceding twelve (12) months: Category A (Identifiers), Category B (California Customer Records personal information), Category D (Commercial information), and Category L (Sensitive personal information).
Your rights under applicable US state law may include: right to know, right to access, right to correct, right to delete, right to obtain a copy, right to non-discrimination, and right to opt out of targeted advertising, sale, or certain profiling — noting we do not engage in targeted advertising, sale, or profiling of your information in the first place. To exercise these rights, contact hello@kenkodoc.com. If we decline to act on your request, you may appeal by emailing the same address; if your appeal is denied, you may contact your state attorney general.
Australia and New Zealand: we collect and process your information under Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You have the right to request access to or correction of your personal information by contacting hello@kenkodoc.com. Complaints can be lodged with the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.
Republic of South Africa: you have the right to request access to or correction of your personal information by contacting hello@kenkodoc.com. Complaints can be directed to The Information Regulator (South Africa).
Kenko is used by medical and dental practices ("Customers") to manage patient scheduling information. With respect to any patient data entered into the Service by a Customer, the Customer is the data controller and Kenko acts solely as a data processor/service provider, processing that data only on the Customer's instructions and for the purpose of providing the scheduling service. Patients do not create accounts or interact with Kenko directly — any request from a patient regarding their data should be directed to the practice that manages their care, not to Kenko directly, though Kenko will support the practice in fulfilling such requests as needed. Customers are responsible for having an appropriate legal basis and, where required, patient consent, to enter their patients' information into the Service, and for minimizing the amount of clinical detail entered into free-text fields to what is reasonably necessary for scheduling purposes.
If you are a US healthcare provider and the information you enter qualifies as Protected Health Information (PHI) under HIPAA, we offer a Business Associate Agreement (BAA) on request — contact hello@kenkodoc.com before entering PHI so we can get one signed first. Our infrastructure provider, Google Cloud, offers its own Business Associate Agreement covering the specific services (Cloud Firestore, Firebase Authentication, Cloud Functions, Cloud Storage, and Firebase Hosting) that store and process this data.
In short: yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date. If we make material changes, we will notify you by posting a notice or sending a direct notification.
If you have questions or comments about this notice, email us at hello@kenkodoc.com.
Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we've processed it, correct inaccuracies, or delete your personal information, and to withdraw your consent to our processing of it. To make such a request, contact hello@kenkodoc.com.