Kinship Privacy Notice

How Kinship handles your information

Who's responsible: Legacy FS Limited ("Kinship") is the controller for your account and platform information - including billing, identity verification and complaints. Where care is delivered in the member's own country, the Care Partner for that country (the local Kinship company named in the plan, listed in our Care Partner Schedule) is the controller for care and health information there - its own notice covers that, and we surface it when you (or your member) reach that moment. Today that means: in Nigeria, Kinship Management Service Limited.

What we collect: account details (name, email, phone, country); identity-verification information (documents and selfie, processed by our verification provider, Sumsub, acting as our processor); plan and payment information (card details are collected and stored by our payment provider, Stripe - we never hold full card numbers); your kin network as you build it; app usage.

Identity verification (KYC): everyone with a Kinship account is verified when the account is created - including supporters, and before any money moves - because verified identities keep every plan safe (fraud prevention and our legal obligations are the bases). Your verification documents stay with us and our verification provider: they are never shared with any Care Partner, care provider or benefit provider - only the fact that you passed, the date, and who verified you ever crosses. We also use verified name and date of birth to enforce who may hold which role on a plan (for example, a Plan Member cannot also be a supporter of their own plan) - that check is a condition of the roles, done in everyone's interest. Verification records are kept for as long as the law requires; where an account verifies but never transacts, we keep them for a shorter period.

Why (and the lawful basis): to run your account and plans (contract); to verify identity, enforce role eligibility and prevent fraud (legal obligation / legitimate interests); to handle complaints (legitimate interests / legal obligation); to process and reconcile refunds, which are recorded in our ledger and periodically reconciled (contract / legal obligation); to improve the product (legitimate interests); marketing only with your consent - a separate, unticked choice, withdrawable any time.

Sharing: with the Care Partner for the member's country: when a plan is set up we pass the member's enrolment details (name, address, date of birth, contact and care-relevant details) so care can be delivered. Every such transfer happens under the safeguards in a written data-sharing agreement between Legacy FS Limited and that Care Partner; where the country is not covered by a UK adequacy decision, that agreement contains the safeguards UK law requires. Country by country, today: Nigeria - Kinship Management Service Limited, an independent Nigerian company; Nigeria is not covered by a UK adequacy decision, so the transfer happens under the written data-sharing agreement between Legacy FS Limited and Kinship Management Service Limited. The Care Partner, as the holder of the group arrangement, passes enrolment details to the benefit provider to enrol the member; we never send anything to the benefit provider ourselves. Also with our service providers (verification, payments, hosting) under contract; never sold. When Kinship opens in a new country, this notice is updated with that country's Care Partner and transfer safeguards before any information moves.

The member's information: when you build a plan for someone else, you give us their name, age, city and contact so we can invite them. We hold it to make the invitation and set up the plan; their acceptance brings their own relationship (and their Care Partner's notice) into effect. Don't add someone who wouldn't want to be added.

Complaints: if you complain, we process what you tell us to investigate and respond, and we keep a record of the complaint and its outcome for as long as we need to show how it was handled and to meet our obligations. Where a complaint is about care in the member's country it's handled by that country's Care Partner under the shared complaints procedure; where it's about the member's health benefits we signpost you to the benefit provider and log only that we did.

Who we are: Legacy FS Limited, trading as Kinship, registered with the Information Commissioner's Office (registration ZC223785).

Your rights: access, correction, deletion, portability, objection - in Settings or by contacting privacy@withkinship.ai. If a self-serve option isn't available in the app yet, contact us and we'll handle your request directly. You can also complain to the ICO.

Retention: we keep information only as long as we need it for the purposes above - account information for a set period after your account closes, identity-verification records for as long as the law requires (with a shorter period where an account never transacts), and complaint records and our refund and reconciliation ledger entries for as long as accounting and regulatory rules demand. We're finalising the detailed retention schedule and will publish it in this notice.