Keivos Privacy Policy

2.1 Student Information (Keivos Student App)

When you create an account and use the Keivos student app, we collect:

• Full name and email address
• Undergraduate university affiliation
• Academic data: cumulative GPA, science GPA, MCAT score (actual or goal)
• Graduation year and gender
• Extracurricular activities: category, hours, descriptions, supervisor information
• Medical school wish list and application status
• Interview invitations and cycle outcomes
• Messages sent to and received from university advisors
• Subscription and purchase status
• Data sharing consent preferences

2.2 Advisor Information (Keivos Advisor Dashboard)

When advisors register for the Advisor Dashboard, we collect:

• Advisor name, email address, and professional role
• University affiliation and department
• Messages sent to and received from students
• Configuration preferences and alert settings

2.3 Information We Do NOT Collect

• Social Security numbers
• Financial information (bank accounts, credit card numbers — these are handled directly by Apple, Stripe, or other payment processors and are never received by us)
• Health or medical records beyond academic metrics
• Biometric data
• Location data or device identifiers for tracking purposes

4.1 Consent-Based Sharing

Student data is shared with university pre-health advisors ONLY when the student has provided explicit, informed consent through our FERPA consent mechanism. This consent is requested during account setup when a student selects their university. Students may revoke consent at any time through their app Settings, and data sharing will cease immediately upon revocation.

4.2 What is Shared with Advisors

When consent is granted, the following data is shared with the student's university advisor:

• Name and email address
• GPA (cumulative and science), MCAT score
• Activity hours by category
• Medical school wish list and application status
• Interview invitations and cycle outcomes
• King Score (composite academic readiness score)

4.3 Third-Party Disclosure

We do not sell, rent, lease, or otherwise disclose student personally identifiable information (PII) to third parties for commercial purposes. We may disclose information only in the following limited circumstances: (a) to comply with a legal obligation, such as a court order or subpoena; (b) to protect our rights, privacy, safety, or property; (c) to our sub-processors who assist in operating our platform, subject to strict data processing agreements; or (d) with the student's explicit written consent.

4.4 Sub-Processors

We engage a limited set of third-party service providers ("sub-processors") to operate the Services. Our primary backend infrastructure is provided by Supabase, which holds SOC 2 Type 2, ISO/IEC 27001:2022, and HIPAA compliance certifications. Our web applications are hosted by Base44, which holds SOC 2 Type II and ISO 27001 certifications. A complete, current list of all sub-processors — including transactional email, push notification, payment processing, and AI service providers — is maintained at www.keivos.com/subprocessors and is updated whenever we add or change a provider. All sub-processors operate under data processing agreements with Keivos LLC and are bound by confidentiality and data-handling obligations no less protective than those we owe to you.

6.1 Right to Access

You may request a copy of all personal data we store about you at any time. In the Keivos app, use the "Download My Data" feature in Settings to receive a complete export of your information.

6.2 Right to Correct

You may update or correct your personal information at any time through your profile in the app. If you believe information on the advisor dashboard is incorrect, contact us or your advisor to request a correction.

6.3 Right to Delete

You may request deletion of all your personal data at any time. In the Keivos app, use the "Delete My Data" feature in Settings. This will permanently remove all your data from both the student app and the advisor dashboard. This action cannot be undone. We will retain only the audit log entry recording that a deletion was requested, as required for compliance purposes.

6.4 Right to Revoke Consent

You may revoke your data sharing consent at any time through the app Settings. Upon revocation, we will immediately stop sharing your data with your university advisor. Data previously shared will be retained on the advisor dashboard but will be hidden from view until consent is restored.

6.5 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA/CPRA, including the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise these rights, contact us at privacy@keivos.com.

Internal algorithms (no third party). The King Score, school-matching engine, and other ranking, scoring, and recommendation features run entirely within our own infrastructure. These features do not transmit any data to third-party AI services and do not contribute to any external model training.

Third-party AI chat assistant. The optional "Ask Keivos" in-app chat assistant uses Anthropic's Claude API to generate responses. When you send a question to the assistant, the text of that question, along with a limited context window (such as recent messages in the current chat session and, where relevant, a summary of your school list), is transmitted to Anthropic for inference. Anthropic processes the request and returns a response. Pursuant to Anthropic's Commercial Terms of Service, your queries are not used to train Anthropic's AI models and are retained by Anthropic only as needed to operate and secure the service. Anthropic appears on our Sub-Processor List at www.keivos.com/subprocessors. Use of the assistant is optional; you may choose not to use it and all other Service functionality remains available. If we add or change AI service providers in the future, we will update this Privacy Policy and the Sub-Processor List.