Kidney Navigator Privacy Policy

1. The short version

• Kidney Navigator is local-only by default. Nothing is sent to the sync service until you choose Set up encrypted sync, verify your email and enter a separate recovery phrase.
• With sync on, your browser encrypts supported tracker records before sending them. We store ciphertext, an account email, security/session records and service metadata. We cannot read the encrypted health-data copy or recover your recovery phrase.
• Photos, PDFs, attachments and raw scans are not included in sync. Structured entries you save after reviewing extracted text can be included in encrypted sync. The app does not use analytics, advertising or tracking code.
• If you set an app PIN, your entries are encrypted on that device.
• We do not sell or share personal information for targeted advertising, and Kidney Navigator does not show ads.

2. Information you enter in the app

You can record appointments, blood pressure, fluid intake, weight, lab results, medications and doses taken, dialysis sessions, symptoms and mood, journal notes, care-team contacts, emergency-card details (such as blood type, allergies, insurance and medical record number) and questions for your doctor.

Dialysis printout (coming soon). We are preparing a tool in More that will let you type or paste numbers from a dialysis fluid and blood pressure report, or pick a photo for your browser to read on your device. It is not available to everyone yet. The photo is not uploaded and is discarded after reading. The tool subtracts the numbers you entered and prints a list for your care team. It does not interpret the numbers or give medical advice. A note you choose to keep, and lab results you choose to add, are saved on this device. If you turn on encrypted sync, they sync with your other records. Delete them in Care notes and Health > Labs, or use Erase this device. Lab results from your clinic's nutrition and blood test report can be typed or read the same way, and are added to your Labs list only after you check each number. Photo reading uses open-source software bundled with the app and runs entirely on your device. Cloud reading of photos is not offered.

Care scanner. You can select a photo or paste or type text to organize food or menu details, lab work, appointments, medical history and care-team contacts. The app reads text from the photo on your device. The first time you use it, it downloads the reading files (about 10 MB) from kidneynav.com; they are the same for everyone and contain none of your information. You can also type or paste the text. The app does not upload the photo for this processing. Extraction can be incomplete or wrong: check every field against the original before saving. These entries are not a diagnosis or medical advice. PDF files you choose are read on your device; the file is not uploaded. Nutrition lookup. If you tap Look up nutrition after a barcode is read, the app sends only that barcode number to Open Food Facts (openfoodfacts.org), a public food database, to get the product's nutrition label. No photo, name, account or health entry is sent with it, and nothing is sent unless you tap the button.

• Local storage. Your entries are first stored in your browser on the device you are using. Without sync, they do not move to another device automatically and may be lost if browser data is cleared.
• Optional encrypted sync. After explicit setup, supported structured records are encrypted in your browser with AES-GCM 256 using a key derived from your separate recovery phrase with PBKDF2-SHA256 (310,000 rounds). The encrypted envelope is stored with our database provider. Your recovery phrase stays in browser memory and is not sent or stored.
• What the service can see. We and our providers can see your account email, sign-in and request metadata, encrypted-envelope size and update times, and normal hosting logs. We cannot decrypt the health-data envelope without your recovery phrase.
• What is excluded. Photos, PDFs, attachments, raw scans, the local app PIN and downloaded backup files are not synchronized. This exclusion does not apply to supported structured entries saved from extracted, pasted or typed text; those entries can be included when you enable encrypted sync.
• Keeping local data. Sync is an additional encrypted copy, not a replacement for local storage or your own backup.
• Offline use. The app continues storing changes locally while offline and can synchronize after you reconnect and unlock sync.

3. Your controls in the app

• PIN lock. If you set a PIN, local entries are encrypted on that device with AES-GCM 256 and PBKDF2-SHA256 (310,000 rounds). The device PIN and sync recovery phrase are separate.
• Recovery phrase. You must enter the same phrase on each device. We cannot recover it. Losing it means the encrypted cloud copy cannot be opened.
• Download and restore. A downloaded copy is not encrypted. You control where it is stored and who receives it.
• Erase this device. Removes app data in that browser only. It does not delete an encrypted cloud copy or another device.
• Delete cloud copy or account. These are separate sync controls and require recent email-code verification. Deleting the sync account deletes its server-side encrypted data and sessions. Local device data and downloaded files remain unless you erase them separately.
• Turn off sync. Signs this device out and removes its in-memory recovery key while preserving local records and the encrypted cloud copy.
• Caregiver share link. The safety summary is carried in the link after the "#" and is not part of account sync. Anyone with the link may read it; send it only to someone you trust.

4. Information we do receive

• Sync account and security data. If you opt in, we receive your email, one-time-code and session security records, encrypted data envelopes, revision numbers, timestamps and request metadata. Verification codes expire; session tokens are hashed in the database.
• Daily reminder (optional). Only if you turn on Daily reminder in More, your browser creates a push subscription (a reminder address, a public key and an authentication secret) and we store just that and the hour you chose, in our Upstash Redis store, so our server can send you one fixed message, “Time to log today”. The message is delivered by your device’s push service (for example Apple, Google, Microsoft or Mozilla), which learns that your browser received a Kidney Navigator reminder. We store no name, email, account, health entry or other identifier with it, the reminder never contains health information, and your browser asks for permission first. Turning the reminder off deletes the address from our server; an address that stops working is deleted automatically, and an unused one expires after 90 days.
• Service providers. Vercel hosts the app and server functions, Upstash stores the optional reminder subscription, Neon stores encrypted envelopes and account/security records, and Google/Gmail delivers verification codes.
• Emails you send us. We receive your address, message and anything you include and use it to reply.
• Website analytics (optional). Google Analytics and MAVTG Visitor Intelligence are disabled on the Kidney Navigator pages, regardless of any saved analytics choice. Only on three public pages (the home page, the Trust page and the white paper), and only if you choose Allow analytics in the banner, we collect aggregate page-speed measurements (how quickly the page loaded) in our own counters. We use the counts to improve the site and for our own research. If you choose No thanks, or your browser sends Global Privacy Control or Do Not Track, no page-speed numbers are collected. The app, the tool pages and the Spanish pages never use analytics, advertising or tracking code, and no health information is ever sent. You can change your choice on the Trust page. Otherwise, visitor counts come from the hosting logs described below.
• Hosting logs. Vercel processes technical data such as IP address, browser and requested route to deliver and protect the service.

5. What we do not do

We do not sell or share personal information for targeted advertising, show ads in the app, use health entries to train AI, or use them to make decisions about insurance, employment or credit.

Developed with assistance from AI tools. This describes how the app was built. The Care scanner uses the on-device processing described in section 2; this development attribution does not mean your entries are sent to a generative AI service.

6. Health information and the law

Kidney Navigator is an educational and tracking tool. It is not medical advice, diagnosis or treatment, and MAVTG is not a healthcare provider.

The legal protections that apply to health information depend on the applicable law, the service relationship and how the information is used. Do not assume that information in this app has the same protections as records held by your healthcare provider. We treat health-related information as sensitive.

Consumer health data. Without sync, we do not receive app entries. With sync, we receive an encrypted envelope that we cannot decrypt, plus the account and service metadata described above. We do not sell it or use it for advertising. Contact us using section 12 to exercise applicable rights. Depending on where you live, you may have rights to know what we hold, to delete it and to withdraw consent, and we will act on a request without charging you. We use no health data for advertising, and we do not share it with anyone other than the service providers needed to run sign-in email and payments.

Our standalone Consumer health data privacy notice summarizes this in one place.

If something goes wrong. If we learn that information we hold was accessed or disclosed without authorization, we will tell the people affected and the authorities as the law requires, without unreasonable delay.

7. Earlier versions of the app

An earlier account and cloud-sync system was discontinued on September 23, 2026. The current encrypted-sync system uses separate v2 tables and never automatically reads or restores health data from the retired plaintext system.

8. Children

Kidney Navigator is for adults 18 and older. People aged 13 to 17 may use sync only with a parent or guardian's approval, and we do not allow sync for anyone under 13. Kidney Navigator is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the app. If you believe a child under 13 has sent us information, contact us and we will delete it. For our student program, see the Youth Privacy page (www.mavtg.com/legal/youth-privacy).

9. Security

Local entries rely on device/browser security and optional PIN encryption. Sync uses HTTPS in transit and browser-side AES-GCM encryption before upload. Sessions use secure HTTP-only cookies and email verification. Account email, traffic metadata and encrypted data remain exposed to provider or breach risks, and a weak or reused recovery phrase reduces protection. Downloaded copies are not encrypted.

10. Your choices and rights

You can view, download or erase local data in the app. If sync is enabled, you can separately delete the encrypted cloud copy or complete sync account after recent email verification. For other requests, write to michael@mavtg.com.

Depending on where you live and whether a particular privacy law applies to MAVTG or the information involved, you may have additional rights, including to access, correct or delete certain information, and to opt out of sale or targeted advertising (we do neither). Where a law gives you these rights, we will respond within the time that law requires, and may use any extension it allows. We will not treat you differently for asking, and you can have an authorized agent ask for you. If we deny a request, you can appeal by replying to our answer.

11. Changes

We will update this policy and effective date before materially changing how the app handles information and seek consent where required.

12. Contact

Medical Adventure Voyage Travel Group LLC, doing business as Moore Audax Voyage Travel Group (MAVTG), a Florida limited liability company · Tampa, Florida · michael@mavtg.com