What does KIBBO do with the hospital's data?
Loading the whole fleet into KIBBO means concentrating on one platform the inventory of the institution's critical equipment: what exists, where it is and what state it is in. It is reasonable to ask what happens to that data.
This page documents the security measures in place and how to verify them. The detail a procurement committee needs is answered through direct contact with the technical lead.
How the information travels
All traffic between the browser and KIBBO travels encrypted over HTTPS, on both sites: kibbo.io and app.kibbo.io. A request that arrives unencrypted is redirected to the secure channel. There is no entry over HTTP. The session is kept in a cookie the browser does not expose to page scripts (HttpOnly), that only travels over HTTPS (Secure) and that does not accompany requests originating on other sites (SameSite=Lax). Form submission is protected against CSRF.
VerifiableIt is in the site's HTTP headers. Anyone can see it.
Who gets into the account
Access to app.kibbo.io is behind a login. The sign-in and the registration form use reCAPTCHA v3, which works invisibly: it evaluates behavior and stops automated attempts without asking anything of the person signing in.
VerifiableThe reCAPTCHA script is in the code of both forms.
What KIBBO cannot do
KIBBO is a web application and explicitly declares what the browser does not allow it to do: it does not access the camera, the microphone, the device location or payment methods. It is not a promise from the company: it is written in the site's permissions policy (Permissions-Policy) and the browser enforces it.
It is a list of negatives, and that is why anyone can verify it.
VerifiableIt is in the site's HTTP headers.
The data belongs to the institution that loads it.
The data the institution loads belongs to the institution: the policy declares it the exclusive property of the user. No sensitive data is collected: no health information is recorded, only equipment. It is hosted on Amazon Web Services servers located in the United States: an international transfer that the policy declares and the user consents to.
VerifiableIt is in the privacy policy and the terms, both published.
Who is on the other side
KIBBO was developed by LEEX, a company that knows what working with medical equipment is like, not just with software. LEEX has 40 years of experience in medical equipment, over 30,000 devices and a presence in more than 7 countries.
- years
- 40
- devices
- +30,000
- countries
- +7
The data an institution loads into KIBBO belongs to that institution.
The questions this page does not answer
A procurement committee usually needs more detail than fits here. For those questions there is direct contact with the technical lead for app.kibbo.io.
In summary
The data an institution loads into KIBBO belongs to that institution. KIBBO does not collect sensitive data or people's health information, encrypts traffic over HTTPS, and hosts the information on Amazon Web Services servers. The assistant sends each query's results to AI from OpenAI, an external provider; invoices and delivery notes are also read with AI from OpenAI.
Technical content reviewed by Gustavo González.