Privacy

Who is responsible

This website is published by the KanzenKai Foundation, a non-profit organisation registered in Bulgaria under number 208631083, at 52 Nikola Petkov Blvd, Sofia 1632, Bulgaria.

For any question about this page or about your data, write to zen@kanzenkai.org.

What this site collects

Nothing. There are no forms, no sign-up, no newsletter, no analytics, no cookies and no third-party scripts on this website. We do not know who visits it.

If you write to us by email, we hold that email in order to answer you. We keep such messages for up to twelve months and then delete them. The lawful basis is our legitimate interest in answering the people who contact us.

Who processes data on our behalf

That is the complete list for this website. It has no other processors, because there is nothing else to process.

• Vercel — hosting and content delivery for this website, served from the Frankfurt region. The provider keeps standard technical request logs.

The application is a separate service

The application at app.kanzen.health is where health information is actually stored, and it is a different processing context with its own account, its own storage and its own notices. Nothing you enter there is visible to this website, and this website sends nothing to it beyond the link you click.

The record itself is stored in the European Union: the application runs in the Frankfurt region and its database is in the eu-central-1 region.

If you choose to connect an external AI service such as ChatGPT from the application, only the sections and permissions you approve are exposed to that connection. You can revoke future access from Sharing, but information already disclosed to the external service cannot be pulled back by Kanzen. The Data and AI page explains this connection in more detail.

If you connect ChatGPT, OpenAI becomes a separate recipient

Connecting ChatGPT from the application discloses health data to OpenAI, the company that operates ChatGPT. OpenAI is not our processor. It is a separate recipient that you choose, acting under its own terms with you, and what it does with the data after disclosure is governed by that agreement rather than by ours.

Nothing is disclosed in advance. No connection exists until you create one, and data leaves only when you or ChatGPT use that connection.

The lawful basis is your explicit consent to the processing of special-category health data, under Article 9(2)(a) of the GDPR. You give it on the connection screen, which lists the sections and the permissions before the connection is created, and you can withdraw it at any time from Sharing.

OpenAI is established outside the European Union, so a connection is likely to involve a transfer of health data to a third country. We do not state a transfer safeguard here, because we have not established one we can prove. This is the same reason we state no processing region for our own AI provider: we would rather leave the question open than close it with something unverified.

Withdrawing the connection stops future access. It cannot pull back what has already been disclosed. No notice can promise that, and we will not write one that implies it.

• Which categories may be disclosed depends on what you grant. The sections you can choose from are: conditions, allergies, medications, immunisations, procedures, implants, encounters, measurements, laboratory results, document metadata, the journal, nutrition, and the health profile.
• A section you do not grant is never queried, so nothing about it — not a value, not a count, not an empty list — reaches the connected service.

Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability under the GDPR, and the right to complain to a supervisory authority — in Bulgaria, the Commission for Personal Data Protection.

You can request a copy of your data or ask for it to be deleted. Today we do this on request at zen@kanzenkai.org, within one month. One-click export and deletion are on the roadmap — we will announce them the day they work.

How long the application keeps things

The record itself is kept for as long as you keep your account. Kanzen is not a healthcare provider and does not hold medical documentation on anyone else’s behalf, so no statutory retention period applies to it and nothing justifies keeping a record after you ask for it to be erased.

The periods below therefore protect something other than your health data — accountability, security or recovery — and never the record itself.

• Identity, profile, contacts, clinical entries, documents and the history of corrections to them — until you delete your account, and erased on request.
• Audit and security events, consent evidence after a sharing arrangement ends, support messages after a case closes, and revoked agent credentials — 12 months, then deleted.
• Logs and telemetry, background jobs, and the window in which an assistant action can still be undone — 30 days.
• Agent credentials you issue to an external assistant — until you revoke them, and at most 90 days by default, 365 days at the outside.
• Backups — at most the platform plan’s horizon, which is up to 7 days of daily backups.

What erasure actually does

An erasure request is confirmed and carried out without undue delay and within one month. If it turns out to be complex the GDPR allows two further months, and we would tell you inside the first.

Access is cut before anything is destroyed: sharing arrangements, sessions, connected assistants and any download links. Derived copies go with it — indexes, exports, queued jobs and cached objects. One audit line about the deletion remains, and it records that the deletion happened, not what was in the record.

A restored backup never brings a deleted person back. The list of erased accounts survives the restore and is applied again before access is reopened.

Changes to this page

If this site ever starts collecting anything — a form, a newsletter, a measurement of any kind — this page changes before that feature ships, not after. The date at the top tells you when it last changed.