Privacy Policy

Who We Are

Kairos Financial is a financial services team operating under Virtuity Financial Partners ("we," "us," or "our"). We provide financial needs analysis and planning services to individuals and families. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our Financial Needs Analysis platform at fna.patrickpuorro.com.

We are committed to protecting your privacy in compliance with the Gramm-Leach-Bliley Act (GLBA), the California Consumer Privacy Act (CCPA), and applicable state insurance data security laws.

Information We Collect

To prepare your Financial Needs Analysis, we collect the following categories of personal information:

• Identity information — full name, date of birth, Social Security Number
• Contact information — email address
• Household information — marital status, dependents, household size
• Financial information — income, expenses, debts, assets, savings, retirement accounts
• Insurance information — existing life, health, and disability policies
• Employment information — employer, occupation, employment status
• Goals and preferences — retirement age, income replacement goals, coverage preferences

How We Use Your Information

We use your personal information solely for the following purposes:

• Preparing and delivering your personalized Financial Needs Analysis report
• Communicating with you about your analysis and follow-up appointments
• Complying with legal and regulatory obligations
• Maintaining records required by insurance and financial services regulations

We do not sell your personal information to third parties. We do not use your information for targeted advertising. We do not share your information with affiliates for independent marketing purposes.

How We Protect Your Information

We implement industry-standard security measures to protect your personal information:

• Encryption in transit — all data transmitted over HTTPS/TLS
• Encryption at rest — database encrypted with AES-256
• Access controls — your data is accessible only to your assigned advisor and platform administrators
• Authentication — client access requires one-time passcode verification via your email
• Session security — advisor sessions expire automatically after 30 minutes of inactivity
• Audit logging — all access to your records is logged with timestamp and identity
• Report expiry — report links expire after 90 days

Our platform is hosted on Cloudflare's global network and Supabase, both of which maintain SOC 2 Type II compliance and industry-standard data protection agreements.

Data Retention

We retain your Financial Needs Analysis data for a minimum of 5 years from the date of your last interaction, as required by applicable financial services regulations. After this period, records may be securely deleted upon request.

If you wish to have your data deleted before the end of this retention period, please contact us. We will honor deletion requests to the extent permitted by law and regulation.

Your Rights (California Residents)

If you are a California resident, the CCPA provides you with the following rights:

• Right to Know — request disclosure of what personal information we have collected about you
• Right to Delete — request deletion of your personal information, subject to legal retention requirements
• Right to Correct — request correction of inaccurate personal information
• Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights
• Right to Opt-Out of Sale — we do not sell personal information; this right is satisfied by default

To exercise any of these rights, contact your advisor or email us at the address below. We will respond within 45 days.

GLBA Privacy Notice

As required by the Gramm-Leach-Bliley Act, we provide the following notice regarding our information sharing practices:

• For our everyday business purposes — we share information to process your FNA and service your account. You cannot opt out of this sharing.
• For joint marketing with other financial companies — we do not share your information for this purpose.
• For affiliates' everyday business purposes — we do not share your information for this purpose.
• For non-affiliates to market to you — we do not share your information for this purpose.

Third-Party Service Providers

We use the following service providers who may process your data on our behalf, each bound by appropriate data processing agreements:

• Supabase — secure database storage (SOC 2 Type II, GDPR compliant)
• Cloudflare — content delivery and API security (SOC 2 Type II)
• Resend — transactional email delivery

These providers are contractually prohibited from using your data for any purpose other than providing services to us.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of our platform after changes constitutes acceptance of the updated policy.