Kinto app by NIH for Alz Assn

zauberflote

I've just read the top sticky announcement about this Kinto app they are so enthused about. While this is an interesting offering, I myself would be very leery of letting a free app of any kind learn any of my financial information. If anybody participates, please please make sure you forbid the app any permissions!  

I looked on the Apple store, and there is a Kinto Care app which does not seem to be the same thing. 

I'd love to be shown my gut feeling is wrong on this one!

Joydean

Thank you for sharing your gut feeling on this! I have the same feeling’s!

Iris L.

Who, exactly, is Kinto?  I clicked the link, I still don't know.

Iris

[Deleted User]

The user and all related content has been deleted.

[Deleted User]

The user and all related content has been deleted.

GothicGremlin

I have the same questions as Victoria2020. When I see things like this the first place I start is with the privacy aspect. So.. putting on my privacy advocate hat (yep, it's my day job) --

https://www.kinto.care/privacypolicy

There is the usual boilerplate - what we collect, who we collect it from, don't use our site if you're under 18, other definitions (what is HIPAA, etc), etc. I don't have any issues with a lot of it.

At a quick glance - things that jumped out at me --

They use third party trackers that the user may be able to delete, but as a privacy advocate looking at a healthcare site, I'm giving them side-eye for this practice.

They collect data about you from partners and third parties and aggregate it.

They display ads, sometimes targeted ads, which means using data about you that they've collected.

The good news is that they sometimes de-identify personally identifiable information, the bad news (that they don't state) is that de-identified data can often be reconstructed. More side-eye from me.

They'll share data about you with research partners, including market research.

If they sell their business they state - "In the event of such an event, an acquiring company will be responsible for informing you about material changes to the way your data is used."

So, they'll tell you about it and so will the acquiring company, but it doesn't sound like you get any input about what becomes of your data. Take it or leave it - which may difficult to do once you're in deep.

They secure your information, but state -- "Unfortunately, the transmission of information via the Platform and computing devices is not completely secure. Although we strive to protect Personal Information, we cannot guarantee the security of your personal information transmitted on our Platform. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Platform."

My s.o. is actually happy Kinto included the above paragraph (he's a security guy), and believes that what they're saying about security is true, and that this is probably about as good as it gets.

Overall, it's not a horrible privacy policy, but it could be better. They get some points for making their privacy policy fairly easy to read. There's jargon in it, but not so much as to make it unreadable.


Note - you have more rights under CA law, so if you live in CA, be aware.

[Deleted User]

The user and all related content has been deleted.

GothicGremlin

Oh for sure, Victoria!

Partner and affiliate data sharing is something that privacy advocates have worked long and hard to limit, or at least to give us all an ability to opt-out of. We've made little headway in the twenty years I've been doing this, in fact, there's been much back-sliding during that time. It's frustrating. So I do what I can, where I can.

It used to be a lot easier to find out who is sharing data with whom - most companies listed their partners and affiliates in their privacy polices. No more. Now we have to work a lot harder to find them all.

But here's an interesting site that I've used --
https://www.partnerbase.com/

I did a couple of tests -- this Alzheimer's site has two partners; kinto.care is not listed (they may not have been discovered by partnerbase yet); and facebook has, well, type in facebook and see what comes up. It isn't pretty.

And if you're trying to figure out why you're getting a data breach notice from some company you've never heard of, check in on the data sharing practices of the companies you do business with. While you're there, opt-out of data sharing, if it's practical for you.

M1

Thank you all for doing this legwork. Way beyond my bandwidth too. Who needs more obligations? Geez, give me something that actually helps. This is all about the marketing and wanting to make money on the need, sounds like to me.