K Health

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• No SOC 2 Type I/II, no ISO 27001, and no HITRUST CSF (the gold standard in healthcare) are documented, despite these being critical for healthcare SaaS. These are concerning gaps for a company handling protected health information at scale (4M+ users).
• The privacy policy states K Health may have 'sold' or 'shared' personal information with advertising/marketing and analytics partners in the previous 12 months. This is problematic for a HIPAA-governed healthcare platform and contradicts its privacy-first positioning.
• Unlike peer healthcare vendors, K Health does not maintain a public trust center with detailed security documentation, compliance attestations, or third-party audit reports.
• K Health's primary site sits behind Cloudflare anti-bot protection, and its privacy policy pages can return HTTP 403 errors to automated tools, which makes independent verification of its security claims difficult; review the policies directly in a browser.
• While historical data (400M+ anonymized notes) is clearly used for model training, the policy on current customer data usage is ambiguous, and no explicit opt-out mechanism is documented.
• GDPR and HIPAA compliance is stated in the privacy policies, but no formal audit reports or third-party certifications (like SOC 2 with applicable controls) are publicly available to verify implementation.
• The service requires upload of a government ID and facial imagery (selfie) for identity verification, but the handling of this biometric data and its retention policies are not clearly documented.
• Marketing positions K Health as secure and compliant, but the formal certifications (SOC 2, ISO 27001, HITRUST) expected for a $900M healthcare platform are absent from the public record.