Kiwi Kiwi Consumer Health Data Privacy Policy

Last updated: September 26, 2026

This policy describes consumer health data processed by Kiwi Kiwi LLC where Washington’s My Health My Data Act applies. The Act can cover biometric data used for optional Photo Verification even though Kiwi Kiwi is a dating service, not a health-care provider. It protects covered Washington residents and people whose consumer health data is collected in Washington.

1. Categories, sources, and purposes

Verification-related biometric information. If you choose Photo Verification, we and AWS/Amazon Rekognition process your liveness capture, a private facial representation, facial information in current and future profile photos, and associated verification information. The sources are your camera session, profile-photo submissions, and the resulting provider analysis. The purpose is to provide and maintain the optional verification feature and badge, not legal-identity verification or broad duplicate-account detection.

Health-related profile details and communications. Profiles, messages, reports, and support requests can contain health information that you or another person includes. Examples include information about physical or mental health, reproductive or sexual health, treatment, and body measurements or lifestyle information when they identify health status. We process it to provide the communication or other requested function, address the request, and comply with applicable legal obligations. We do not ask for medical records as a normal requirement of joining Kiwi Kiwi. Do not include unnecessary health information.

Information linking these records to a person. Account, message, media, consent, and request identifiers and timestamps can link the information to a person. Replacing a name with an identifier does not necessarily make the data anonymous. We do not infer unrelated health conditions for advertising from ordinary app activity. We do not use location-based boundaries around health-care facilities to identify or track people seeking care, collect their consumer health data, or send health-related advertising or notifications.

2. Collection and permission

We collect and use covered consumer health data with the required consent or to the extent necessary to provide a product or service you request, as permitted by the Act. Photo Verification has its own affirmative permission before processing. General Terms acceptance is not a substitute.

We do not add a new health-data category or purpose without the disclosure and affirmative consent required by law. Consent to verification does not authorize advertising, general-purpose model training, or broad face-based dedupe. Read the Verification and Face Processing Notice for the feature’s scope and withdrawal controls.

AWS/Amazon Rekognition processes verification biometric information on our behalf. Hosting, database, storage, communications, and support processors may handle the limited information necessary to provide the corresponding requested service. We use appropriate processing arrangements and restrict access and use to the authorized purposes. A disclosure to a processor qualifies for the Act’s processor treatment only when its use actually meets that treatment.

If you deliberately display health information in your profile or send it in a message, the intended members can receive that content through the requested feature. Those member recipients do not receive your private verification template or detailed camera-check data. Do not share information that you do not want the selected audience to receive.

We do not sell consumer health data or share it with advertisers or data brokers. We do not share consumer health data with corporate affiliates under this policy. We may provide information to competent authorities or other lawful recipients only to the extent a specific applicable legal exception or obligation permits or requires it. A business transfer does not remove the protections the Act requires.

Where a disclosure is sharing that requires a separate consent under the Act, we obtain that separate consent before the disclosure; a general feature permission does not silently replace it.

4. Your rights and requests

You may request confirmation of collection, sharing, or sale; access to your consumer health data; applicable information about third parties and affiliates to whom it was shared; withdrawal of consent; and deletion. Send a request to support@kiwikiwi.dating. You do not need to create an account. We may reasonably authenticate a request, including through an existing account, and ask only for information needed for that purpose.

For Photo Verification, Turn off Photo Verification on the Profile Verification screen removes the badge, stops future verification comparisons, and initiates prompt deletion/deindexing. For other covered health data, describe the information or use involved in your request. If withdrawing prevents a requested optional function, that function may end; your remaining applicable rights continue.

We comply without undue delay and within the Act’s applicable 45-day request period, with a single additional 45-day extension only when legally justified and explained within the initial period. Authentication steps do not automatically restart that deadline. Requests are free up to the number required by the Act; any fee or refusal for manifestly unfounded, excessive, or repetitive requests must meet its conditions.

5. Deletion and retention

We retain consumer health data only for its disclosed lawful purpose and the applicable period. Photo Verification has the narrower destruction schedule in its notice, including prompt deletion on withdrawal, account deletion, replacement of an obsolete reference or purpose end, and the nationwide 24-month last-interaction backstop. An earlier applicable deletion deadline controls. For an authenticated deletion request, we delete covered data and notify relevant processors and other recipients as the Act requires. Backup or archive deletion is not delayed beyond the Act’s permitted period, which is no more than six months after authentication; this is a maximum legal limit, not an intended waiting period for active face references.

Any retained data must fall within a specific applicable legal exception. We do not use a generic fraud, business, or backup label to avoid the Act’s deletion duties or restore withdrawn processing.

6. Appeals and contact

If we refuse a request, you may appeal by replying to the decision or emailing support@kiwikiwi.dating with enough information to identify the decision. We provide a written appeal response within the Act’s 45-day period. If the appeal is denied, we explain the decision and provide a way to contact the Washington Attorney General to complain.