HIPAA and your health data.

Cindra is built to handle health information the way a clinic would expect. Here is what that means in practice.

Draft, prepared for Karuna Labs Inc. and pending legal review. Effective date: October 2, 2026.

When HIPAA applies

The Health Insurance Portability and Accountability Act (HIPAA) governs “protected health information” held by covered entities such as clinics, and by the business associates that work for them. When a clinic or care team provides Cindra to its patients, Karuna Labs acts as that organization’s business associate, signs a Business Associate Agreement (BAA), and handles the information under HIPAA’s Privacy, Security, and Breach Notification Rules.

When you use Cindra on your own, without a care team, HIPAA may not technically apply to that relationship. We protect your information the same way regardless. The safeguards below are the baseline for every user, and our Privacy Policy gives you deletion and access rights whether or not HIPAA requires them.

This website’s waitlist collects only your name, email, and how you describe yourself. It does not collect health information.

Safeguards

• Encryption. Health information is encrypted in transit and at rest.
• Minimum necessary access. Only people whose role requires it can access identifiable information; access is role-based, logged, and reviewed.
• Audit trails. Access to and changes of health records are logged.
• Workforce training. Everyone at Karuna Labs who may encounter health information is trained on handling it and bound by confidentiality obligations.
• Vendor controls. Service providers that may touch health information sign business associate agreements with us and are limited to the work they do for us.
• Risk management. We assess risks to health information on an ongoing basis and address what we find.
• Breach notification. If a breach affects your health information, we notify affected people, the care team where applicable, and authorities as the law requires and without unreasonable delay.

What we don’t do

• We don’t sell health information.
• We don’t use what you tell Cindra for advertising.
• We don’t share your information with a care team unless you connect them, and then only what you choose to share.

Your rights

You can see what Cindra holds about you, correct it, export it, or delete it, from within the App or by emailing info@karunalabs.com with “Privacy” in the subject. If your care team provided Cindra to you, requests about your clinical record may need to go to them as the covered entity; we’ll help you get to the right place.

For clinics and care teams

If you’re evaluating Cindra for your patients, we’re glad to share our BAA, security documentation, and details of how data flows between the App and your team. Write to info@karunalabs.com with “Clinician” in the subject, or join the clinician waitlist.