Privacy Policy

1. Introduction

This Privacy Policy describes how ISRA AI LLC, a New Mexico limited liability company ("ISRA AI," "Khayal," "Company," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with the Khayal mobile application, caregiver portal, admin portal, and related services (collectively, the "Service"), available at khayal.isra-ai.co.

Because Khayal is designed to support the care of Health Users, it may collect sensitive health-related information. Please read this Policy carefully before using the Service. This Policy supplements, and does not replace, the general ISRA AI LLC corporate Privacy Policy at www.isra-ai.co, which governs only our corporate marketing site.

2. Categories of Information We Collect

• Account and Identity Information: name, email, phone number, role (Caregiver, Care Provider, or Health User), relationship to the Health User, and authentication credentials.
• Health and Wellbeing Information ("Health Data"): vitals readings, medication names and schedules, medical history records (conditions, allergies, surgical and family history), caregiver- or care-provider-entered observations, AI-generated wellbeing summaries, and alert/event history (e.g., missed medication, fall-risk flags). This is sensitive information and is treated with heightened protections as described in Section 6.
• Voice and Audio Data: voice recordings and derived transcripts captured when a user interacts with the Service's voice features, processed via third-party speech-to-text and text-to-speech providers.
• Communications Data: messages, notes, and appointment information entered or exchanged through the Service.
• Device and Usage Data: device identifiers, push notification tokens, app version, crash logs, and general usage analytics.
• Location Information: where a feature requires it (e.g., certain alerting features), we may collect approximate or precise location with your permission.
• Payment Information: subscription and billing details are collected and processed by our third-party payment processor(s) (e.g., Stripe) or app store billing systems; ISRA AI LLC does not store full payment card numbers on its own servers.

3. How We Collect Information

We collect information:

1. directly from Caregivers, Care Providers, and Health Users who enter it into the Service;
2. automatically through your use of the Service;
3. from linked accounts (e.g., when a Caregiver creates a Caregiver–Health User link); and
4. from third-party AI processing providers that return derived data (e.g., a transcript generated from a voice recording).

4. How We Use Information

We use collected information to:

• Provide, operate, and personalize the Service, including the caregiver portal, admin portal, alerting system, and AI-generated summaries;
• Facilitate communication and information-sharing among linked Caregivers, Care Providers, and the Health User;
• Generate reminders, wellbeing summaries, pattern-based alerts, and appointment-preparation content;
• Process payments and manage subscriptions;
• Improve the Service, including model performance, through aggregated or de-identified analysis where feasible;
• Detect, investigate, and prevent fraud, abuse, or security incidents;
• Comply with legal obligations and respond to lawful requests;
• Communicate with you about the Service, including service updates and, where you have opted in, product news.

We do not use Health Data to serve third-party advertising, and we do not sell Health Data.

5. Third-Party Service Providers

We share information with the following categories of third-party providers, each acting under contractual confidentiality and data-protection obligations, solely to operate the features described:

• Speech-to-text processing (e.g., Deepgram, with Whisper used as a fallback for certain language variants) — processes voice recordings into text;
• AI / large language model processing (e.g., Gemini) — powers conversational features, summaries, and plain-language explanations;
• Text-to-speech processing (e.g., ElevenLabs) — converts text responses into spoken audio;
• Backend infrastructure and database hosting (e.g., Supabase) and push notification delivery (e.g., Firebase Cloud Messaging);
• Payment processing (e.g., Stripe) and, where applicable, banking services (e.g., Mercury) used for our own corporate financial operations;
• Analytics and crash-reporting providers, used in de-identified or aggregated form where possible.

We do not permit these providers to use your information for their own independent purposes unrelated to providing services to us, except as required to comply with law.

6. Special Handling of Health Data

Because Health Data is particularly sensitive, we apply the following additional practices:

1. We limit internal access to Health Data to personnel and systems that need it to operate the Service;
2. We do not sell Health Data or share it with third parties for marketing purposes;
3. Health Data associated with a Health User is shared within the Service only with Caregivers and Care Providers who hold an active, authorized link to that Health User;
4. Where required by applicable state law (including state health-data privacy statutes such as Washington's My Health My Data Act, or comparable laws in other states), we will honor applicable consent, access, deletion, and opt-out rights specific to health data, in addition to the general rights described in Section 9;
5. We are not a HIPAA-covered entity or business associate unless we have entered a separate written Business Associate Agreement; the Service is not designed as a system of record for a licensed healthcare provider's medical record-keeping obligations.

7. International Data Transfers

ISRA AI LLC is incorporated in New Mexico, United States, with personnel located in Pakistan, and it uses infrastructure and AI service providers that may process data in the United States and other countries. As a result, your information, including Health Data and voice recordings, may be transferred to, stored, and processed in the United States, Pakistan, and other jurisdictions whose data protection laws may differ from those of your home country. By using the Service, you acknowledge and consent to this cross-border processing. Where required by law, we implement contractual or other safeguards for such transfers.

8. Data Retention

We retain Health Data and other account information for as long as an account remains active, and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and support continuity of care records if an account is reactivated, after which it is deleted or de-identified, except where a Caregiver has requested earlier deletion in accordance with Section 9.

If you delete your account, your data is deleted as described in Section 10 rather than retained for the period above.

9. Your Rights and Choices

Subject to applicable law, Caregivers, Care Providers, and Health Users (or their authorized representatives) may have the right to:

• Access a copy of the information held about them or the Health User they are linked to;
• Correct inaccurate information;
• Request deletion of an account or specific data, subject to retention needed for other linked users' continuity of care or legal compliance;
• Withdraw consent for a Caregiver–Health User data link, where they established it;
• Opt out of non-essential communications;
• Where applicable under state law (e.g., CCPA/CPRA and similar state laws), exercise rights to know, delete, correct, and limit use of sensitive personal information.

To exercise any of these rights, contact us at info@isra-ai.co. We may need to verify your identity and authority (e.g., as the registered Caregiver) before acting on a request involving a Health User's data.

You can also delete your account yourself at any time, in the app or by email. See Section 10.

10. Deleting Your Khayal Account

This section explains how to delete your account in Khayal, the app by ISRA AI LLC, and what happens to your data when you do.

In the app

Open Khayal → Profile (Caregivers: Settings) → Delete Account → confirm. Your account is deleted after a 5-second countdown, which you can cancel.

Without the app

If you no longer have the app, have lost your phone, or can't log in, email info@isra-ai.co with the subject "Delete my Khayal account". Send it from the email address on your account, or include the phone number you registered with. We will delete your account within 30 days and confirm by email.

What is deleted

Your profile, health readings, medicines and medication history, medical reports and uploaded documents, medical history, appointments and doctors, AI chat history and summaries, alerts, feedback, and all links with caregivers, care providers and health users.

What is kept

• Records a care provider added for a health user stay on that health user's account.
• Limited information we are required by law to keep may be retained for the period the law requires.
• Backups are overwritten within 30 days.

11. Health Users Who Cannot Independently Consent

Where a Health User is onboarded by a Caregiver because the Health User is unable to independently manage a digital account, the onboarding Caregiver represents that they have appropriate legal authority (such as family authorization, healthcare power of attorney, or guardianship, as applicable under local law) to consent to the collection and sharing of that Health User's information through the Service, and agrees to notify us promptly if that authority changes or ends.

12. Children's Privacy

The Service is designed for use by adult Caregivers and Care Providers on behalf of Health Users. The Service is not directed to children under 18, and we do not knowingly collect information directly from children. If we learn that we have inadvertently collected a child's information, we will delete it.

13. Data Security

We use administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, or disclosure, including role-based access controls reflecting the Caregiver / Care Provider / Health User permission structure. No system is completely secure, and we cannot guarantee absolute security. We will notify affected users and, where required, regulators, in the event of a data breach involving Health Data, in accordance with applicable breach-notification laws.

14. Cookies and Similar Technologies (Web Portal)

The caregiver and admin web portals (app.khayal.isra-ai.co style domains) may use cookies and similar technologies for authentication, session management, and analytics. You can manage cookie preferences through your browser settings.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes affecting how Health Data is used will be communicated via in-app notice or email prior to taking effect. The "Last Updated" date above reflects the most recent revision.

16. Contact Us

For privacy questions, access requests, or to exercise your rights:

ISRA AI LLC
A New Mexico limited liability company
Email: info@isra-ai.co
App: khayal.isra-ai.co