Product, workflow and regulation—without the hand-waving.

The consumer product is provider-agnostic. It can help a person prepare for and remember conversations across primary care, hospital care and specialties. The same boundary applies everywhere: Companion organizes the patient’s information and recorded conversation; it does not independently diagnose or recommend treatment.

Potentially, yes—for example with a physiotherapist, dentist, dietitian or other professional—provided recording is appropriate and lawful in that setting. The product itself does not assume that the other participant is a physician.

Yes, in principle. The user still needs to follow the platform’s terms, local recording law and the other participant’s expectations. Audio capture quality may vary depending on whether the consultation audio is available to the browser microphone.

Companion can be used by a person supporting someone else when that is appropriate and permitted. Age, capacity, parental responsibility, consent and privacy requirements can change the legal analysis, so the app should not treat these situations as identical to an adult managing their own account.

No. A patient can use Companion independently. If the patient wants to share information, the clinician can view a temporary browser share without a Companion account.

No for the consumer product. There is no requirement for EHR access, SSO, FHIR or a hospital deployment in order for the patient to use Companion.

The patient’s account is private by default. A recipient sees information only when the patient creates and sends a share. Temporary sharing is separate from persistent account access.

Yes. The current sharing model creates a frozen, time-limited snapshot containing only the sections the patient selected. Receiving a share does not give the clinician access to the rest of the account.

The recording and transcript remain the source material. The product tells users that AI-organized text can contain errors. Clinicians should not treat a patient-provided AI summary as automatically verified clinical documentation.

No. Companion is a patient-side memory and organization tool. It is not the provider’s legal medical record and does not replace the provider’s own documentation, portal or patient-information duties.

The current consumer product is designed as a direct-to-consumer personal health-information and visit-memory service. It is not offered as a healthcare provider, insurer, EHR or diagnostic/treatment service. Exact obligations still depend on the relationship with users, providers and subprocessors.

Not automatically. HIPAA applies to covered entities and business associates. HHS guidance says a consumer-selected app that is not provided by or on behalf of a covered entity is generally outside HIPAA once the individual directs information to it. If a provider contracts with Companion to create, receive, maintain or transmit PHI on the provider’s behalf, a business-associate relationship can arise.

Not merely because a patient independently chooses Companion and shows or sends the clinician information. HHS says a patient-designated app does not create a business-associate relationship by that fact alone. A BAA may become necessary if Companion is contracted to handle PHI on behalf of the clinician or organization.

No. The FTC Health Breach Notification Rule can apply to vendors of personal health records and related consumer health technologies that are not covered by HIPAA. State privacy and consumer-protection laws may also apply. “Not HIPAA” never means “no privacy obligations.”

No. The current intended purpose is to capture, organize, remember and share information about healthcare conversations, not to diagnose, monitor disease, predict outcomes or recommend treatment. If future features make medical claims or perform medical-purpose decision support, the FDA analysis would need to be revisited.

The current product boundary is deliberately narrower. Preparation AI elicits and organizes what the user wants to say. Visit summaries and Ask about this visit are grounded in the transcript and are instructed not to generate new diagnosis, triage, testing or treatment recommendations.

Companion does not create a new professional relationship between Kinvectum and the clinician. A clinician’s own professional and documentation duties still apply to information they receive and choose to rely on. We do not claim that use of Companion eliminates or creates malpractice risk in every jurisdiction.

Yes. For the direct-to-consumer Companion service, Kinvectum AB is the controller. Visit recordings, transcripts, medication information and health summaries are data concerning health and are treated as special-category personal data under Article 9 GDPR. Companion’s production Privacy Notice identifies the purposes, legal bases, processors and user rights for this processing.

Yes. Companion uses GDPR Article 9(2)(a) explicit consent for processing health data. The Article 6 basis is separate: core service processing relies on Article 6(1)(b), security and reliability processing uses Article 6(1)(f), and processing required by law uses Article 6(1)(c). Users can withdraw health-data consent for future processing; because the cloud health features require health-data processing, those features then stop, while export and deletion remain available.

No, not under its current intended purpose. Kinvectum’s current MDR qualification is that Companion is not medical-device software (MDSW): its intended purpose is to help people capture, organize, remember and share information about their own healthcare conversations, not to diagnose, prevent, monitor, predict or prognose disease, recommend treatment, calculate doses or provide medical-purpose clinical decision support. We maintain that boundary in product claims and functionality.

A release that introduces a medical intended purpose—for example diagnosis, disease monitoring or prediction, treatment recommendations, dose calculation or patient-specific clinical decision support—triggers a new MDR qualification and, where applicable, classification assessment before release. A feature name or disclaimer does not override the feature’s actual intended purpose.

No. Companion is not the healthcare provider’s electronic health record or system of record. It stores patient-controlled information for the consumer service. A clinician can choose to copy relevant patient-provided information into the provider’s own EHR, subject to the provider’s normal documentation rules.

The AI Act Article 50 transparency rules have applied since 2 August 2026. Companion identifies AI-guided preparation and AI-organized visit content as AI and keeps the underlying source material available for review. Companion does not use emotion recognition or biometric categorization. Under the current intended purpose Companion is not MDSW, so it is not currently classified as high-risk on the basis of being an MDR medical device; if that qualification changes, the AI Act classification is reassessed before release.

There is no single EU-wide recording rule. Companion therefore does not present recording as automatically lawful. The user must start each recording themselves, Companion tells users to inform the other participants, and the user must follow the law and clinic policy that apply where the recording takes place. If recording is not permitted in that setting, the recording feature must not be used there; Companion’s non-recording features remain available.

No, not merely because a patient independently uses the consumer service and later shows or sends a patient-controlled share to a clinician. In that flow the clinic has not engaged Kinvectum to process data on the clinic’s behalf. If a healthcare organization contracts with Companion for processing on its behalf, Kinvectum handles that as a separate organizational relationship and puts the required Article 28 processor terms and applicable security terms in place before processing on the organization’s behalf.

No, not by itself. A Companion share is patient-provided information. Once a clinician receives it, the healthcare organization’s applicable national documentation, professional and retention rules determine whether and how the information is incorporated into the clinical record.