Kokoro Collective Pty Ltd ("we", "us", "our") operates the Knox mobile application. This Privacy Policy explains how we collect, use, and safeguard your information when you use Knox and its related services.
When you create a Knox account, we collect your email address for authentication and service communications. Knox does not use traditional passwords. Your identity is secured through device-bound cryptographic keys protected by biometrics (Face ID, Touch ID, or fingerprint).
Knox processes health records, lab results, and medical documents that you voluntarily upload. This data is encrypted on your device using AES-256 encryption (via SQLCipher) before being transmitted. We cannot access, read, or view your health data. This is an architectural guarantee, not a policy choice.
Knox allows you to manage health records for up to five people, including yourself, your children, partner, and parents. Records for each person are strictly partitioned at the database level. AI analysis is isolated per person so that one family member's data never influences another's.
We collect anonymised, aggregate usage metrics (e.g., feature usage counts, crash reports) to improve the application. This data cannot be linked to your identity or your health records.
We do not use your information for advertising. We do not sell, rent, or share your personal information with third parties for marketing purposes. Knox is funded by subscriptions, not data monetisation.
Knox uses a three-key architecture to protect your data:
Compromise of one key never exposes the others. Our servers store only encrypted data that we cannot decrypt. We implement TLS 1.3 for data in transit and conduct regular security audits.
When you submit a document for AI analysis, Knox performs on-device de-identification before any data leaves your device. Personal identifiers, including your name, date of birth, and Medicare number, are stripped locally. Only de-identified document content is sent to our AI pipeline for extraction and analysis.
We use enterprise-tier AI services with contractual guarantees that your data will not be used to train AI models. Certain sensitive categories, including genetic data and mental health records, are never sent to cloud AI services.
If you connect Knox to My Health Record, that data is subject to additional protections under the My Health Records Act 2012 (Cth) and is strictly excluded from the AI pipeline.
Your health data lives on your device. No server-side copy of your unencrypted data exists. If you enable encrypted backups, only encrypted blobs are stored in the cloud.
You may delete individual records or your entire account at any time. Deleting the Knox app destroys all local data. When you delete your account, all associated cloud data is permanently removed from our systems within 30 days.
Knox uses the following third-party services:
De-identified health data may be processed by AI service providers located outside Australia. We ensure all such transfers comply with Australian Privacy Principle 8 (cross-border disclosure) and are covered by contractual data protection commitments.
Knox offers an Emergency Access feature that generates a shareable code or QR granting time-limited, read-only access to critical information such as medications, allergies, and emergency contacts. You explicitly choose when to grant access and can revoke it at any time. Emergency Access data is end-to-end encrypted using your Identity Keypair.
You have the right to:
Knox allows parents and guardians to manage health records for their children as part of the family vault (up to five members total). Children under 16 should not create their own Knox account. Parents and guardians are responsible for managing their children's health data and for ensuring that data is uploaded with appropriate consent.
We may update this Privacy Policy from time to time. We will notify you of any material changes via the application or email. Your continued use of Knox after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or your data, contact us at:
Kokoro Collective Pty Ltd
Made with ♥ in Newcastle, NSW, Australia