Your data. Your patterns. Your call.

Effective 9 October 2026. This is how Kin handles personal data under the GDPR and Swedish law. Read it alongside our Terms of Service. Plain language. No dark patterns.

Who is responsible

Kin Wellness AB (organisationsnummer 559550-7483), registered in Sweden, is the controller of the personal data processed in the Kin app.

You use Kin as an individual, even when a club, agency or federation has invited you or pays for your place. Your relationship with Kin is your own. An organisation cannot instruct us to give it your check-ins, your journal or any other individual data, and its agreement with Kin cannot override that.

An organisation that offers Kin to its athletes is responsible for its own decisions and its own use of what it receives from Kin.

Contact: privacy@thekin.ai

What we collect

Account information. Email address, login identifiers, and the profile details you choose to give us, such as date of birth, gender, sport and position.

Your inputs. Daily check-ins, notes, journal entries, voice entries, and any context you add inside Kin. Voice entries are transcribed to text so Kin can use them. Kin keeps the text, not the recording.

Connected health and wearable data. When you give permission, we read signals such as sleep, heart rate, heart rate variability, activity and workouts from Apple Health and other wearables you connect. We do not collect medical diagnoses or treatment records.

What Kin works out. The patterns, reads and insights Kin generates from your data, and the history it builds so that each read is based on you over time.

Device and usage data. Device type, operating system, app version, crash diagnostics and basic interaction events, used to keep Kin working and to improve it.

Push tokens. If you turn on notifications, the token needed to deliver them.

Your consent record. When you accepted this policy and our Terms, and which versions.

Health data and your consent

Your check-ins, journal entries, voice entries and connected wearable data say something about your health. Under the GDPR that is health data, a special category of personal data.

We process it only with your explicit consent, which you give when you create your account, separately from accepting our Terms. We record when you gave it and which version of this policy it refers to.

Your consent covers using your health data to generate your patterns and insights, and de-identified analysis of it to make Kin's reads more accurate.

If you join Kin through a club, agency or federation, your consent is given to Kin, not to that organisation. Using Kin is voluntary. Saying no, or stopping, has no consequence for you there, and the organisation is not told why.

You can withdraw your consent at any time. Kin can't work without your health data, so withdrawing it means closing your account: delete it from inside the app or email privacy@thekin.ai. Processing that happened before you withdrew stays lawful. Deletion then follows the timelines under Data retention.

How we use it

To deliver the product. Generate your patterns, surface insights, secure your account, and run the basic mechanics of the app.

To improve Kin. De-identified analysis to make patterns more accurate, covered by your consent above, and usage data to make the experience cleaner.

To communicate with you. Service notifications, product updates, and responses to your support requests. Marketing email is opt-in and easy to leave.

To keep things safe. Detect abuse, prevent fraud, and protect the service.

We never sell your data. We never rent it. We never share it with advertisers.

What organisations see

When you join Kin through a club, agency, federation or pilot, the organisation only ever sees aggregated, team-level patterns, built so that no individual can be singled out. They never see your individual check-ins, journal entries, voice entries or raw signals.

Kin does not make decisions about you. It does not select, rank or rate athletes, and it is not designed for selection, contract, medical or injury-risk decisions.

People you choose to share with

You can give a person you choose, such as a mental coach, practitioner or agent you work with, read access to your weekly reads and the inputs behind your rings for recent days. They never see your journal text, notes or voice entries.

You decide who has access, and you can switch it off at any time from inside the app.

Research participation

Kin may collaborate with universities and research partners. Your data is included in research only if you explicitly opt in through a separate consent in the app, governed by an approved ethics protocol.

You can withdraw your research consent at any time without losing access to Kin. Data shared with external researchers is de-identified before it leaves our systems.

Apple Health and wearables

On iOS, when you grant Apple HealthKit access, Kin reads sleep, activity, heart rate and workout data to power your patterns. Other wearables connect through Terra, which processes the data on our behalf to pass it to Kin with your permission.

HealthKit data is never used for advertising or data mining and is never shared with third parties for those purposes. You can revoke access at any time via Settings → Privacy & Security → Health → Kin on your iPhone, or from inside the Kin app.

Garmin data

This section explains how Kin handles data you choose to share from your Garmin Connect account. It applies in addition to the rest of this policy.

What we receive. If you connect your Garmin account to Kin, we receive data through the Garmin Connect Developer Program (Activity and Health APIs), limited to what you allow on Garmin's permission screen. This can include:

Activities: workouts and activity summaries, such as type, duration, distance, heart rate and training effect.
Health: daily summaries, sleep, heart rate variability, resting heart rate, stress, Body Battery, respiration and similar metrics.

We never receive your Garmin password. You can change which data you share at any time in Garmin Connect.

How we use it. We use Garmin data only to provide Kin to you: showing your training and recovery data in the app, credited to Garmin; generating personal insights that combine your Garmin data with your check-ins and notes; and comparing where you are now with your own history.

We do not sell Garmin data, use it for advertising, or share it in identifiable form with your club, coach or anyone else. Organisations only see team-level patterns, as described under What organisations see. Garmin data is not used to train AI models, ours or anyone else's.

Who processes it. Garmin data is processed on our behalf by the following providers, under data processing agreements, and only to run Kin:

Terra: receives Garmin data on our behalf, at an endpoint on Kin's own domain and using Kin's own Garmin credentials, and passes it to Kin in a standard format. Processed in the United Kingdom and the Netherlands, with some processing in the United States.
Supabase: the database and storage where your Garmin data is kept. Processed in the EU.
Anthropic: generates your personal insights from your data, and does not use it to train its models. Processed in the United States.

Where processing happens outside the EU/EEA, it is protected by Standard Contractual Clauses and additional safeguards.

Storage. Garmin data is stored encrypted in our database in the EU, and only the Kin team members who need it to operate the service can access it.

Disconnecting and deletion. You can disconnect Garmin at any time in the Kin app or in Garmin Connect. When you disconnect, we stop receiving new Garmin data immediately. Garmin data already received stays in your Kin history, so your past insights remain intact, until you delete your account. You can ask us to delete your Garmin data at any time by emailing privacy@thekin.ai. When you delete your account, your Garmin data is deleted as described under Data retention.

Changes. We will not change how Garmin data is used or shared without updating this section and obtaining any approval required from Garmin.

Garmin and Garmin Connect are trademarks of Garmin Ltd. or its subsidiaries.

AI processing

Kin turns your data into insights with its own system, which uses AI models from third-party providers, including to transcribe voice entries. We send them what is needed to generate your insights, and nothing more.

Our AI providers do not use the data we send them, including voice recordings and transcriptions, to train their models. Under their terms they may keep requests, including recordings, for a limited period to detect misuse, after which they are deleted.

Kin compares you with yourself. Your data is not used to generate insights for other users.

AI insights are suggestions, not prescriptions. They can be wrong. Use your own judgement, and talk to your medical staff or a qualified professional about anything that matters.

Who we work with

We work with a small set of vendors to run Kin. Each is bound by a data processing agreement and may only use your data to provide its service to us.

Supabase: database and storage
Railway: server hosting
Anthropic: AI models
OpenAI: voice transcription
Terra: wearable connections
PostHog: product analytics
Sentry: error monitoring
Expo: push notifications
Resend: email
Lovable: website hosting

Apple Health is not one of our vendors. It is a source you choose to connect on your iPhone.

Where your data is stored

Kin is operated from the EU, and your account, check-ins and history are stored in the EU. Several of the vendors above, including our AI and transcription providers, are based in the United States and process data there when they provide their service. Those transfers are protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, together with technical measures such as encryption.

Security

Encryption in transit (TLS) and at rest.
Row-Level Security in the database, so you can only access your own data.
Encrypted tokens for third-party integrations.
Least-privilege access controls and audit logging on the team side.
Continuous monitoring and regular security reviews.

No system is perfect. If a breach affects your data, we will tell you and the relevant authorities as the law requires.

Data retention

Active accounts: data is retained for the lifetime of the account. Patterns become more useful the longer your history grows.
Account deletion: production data is removed within 30 days, and your wearable connections are disconnected.
Encrypted backups: purged within 90 days.
Research data: handled under the approved ethics protocol and your specific research consent.
De-identified statistics that cannot be linked back to you may be kept.

Limited records may be kept where the law requires it (for example accounting or legal claims), including the record of your consent.

Legal basis (GDPR)

If you are in the EU/EEA or the UK, we process your data on these bases:

Explicit consent (GDPR Art. 9(2)(a)): your health data, meaning check-ins, journal entries, voice entries and connected health and wearable data, including de-identified analysis to improve Kin's reads.
Consent: research participation, push notifications and marketing email.
Contract: running your account and providing the Kin service you signed up for.
Legitimate interests: securing the service, preventing abuse, fixing crashes and understanding how the app is used, using usage data and not the content of what you write or say.
Legal obligation: where we must keep or disclose data under applicable law.

Your rights

You have the right to:

Access the data we hold about you.
Rectify inaccurate information.
Export your data in a portable format.
Delete your account and associated data.
Restrict or object to certain processing.
Withdraw consent at any time, including research, integrations and notifications. Withdrawing your health-data consent means closing your account, as described above.
Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

You can delete your account, disconnect wearables and turn off notifications inside the app. For everything else, email privacy@thekin.ai. We respond within one month.

Age and guardian consent

Kin is intended for users aged 16 and over. If you are under 18, a parent or legal guardian must consent to your use of Kin on your behalf. We do not knowingly collect data from anyone under 16. If you believe a younger child has given us personal data, contact us and we will remove it.

Changes to this policy

We update this policy as Kin evolves. The version and effective date at the top of this page always reflect the current edition.

Every new version is shown to you inside the app, and you accept it before you continue using Kin. Until you do, we keep processing your data under the consent you already gave. If a change affects how we use your health data, we ask for your explicit consent again.

Contact

Privacy questions, data requests or complaints: privacy@thekin.ai. We respond.

Kin Wellness AB · Org.nr 559550-7483 · v2.1 · Effective 9 October 2026