What KIBBO does with a hospital's data.
Loading the whole fleet into KIBBO means concentrating on one platform the inventory of the institution's critical equipment: what exists, where it is and what state it is in. It is reasonable to ask what happens to that data.
This page documents the security measures in place and how to verify them. The detail a procurement committee needs is answered through direct contact with the technical lead.
How the information travels
All traffic between the browser and KIBBO travels encrypted over HTTPS, on both sites: kibbo.io and app.kibbo.io. A request that arrives unencrypted is redirected to the secure channel. There is no entry over HTTP. The session is kept in a cookie the browser does not expose to page scripts (HttpOnly), that only travels over HTTPS (Secure) and that does not accompany requests originating on other sites (SameSite=Lax). Form submission is protected against CSRF.
VerifiableIt is in the site's HTTP headers. Anyone can see it.
Who gets into the account
Access to app.kibbo.io is behind a login. The sign-in and the registration form use reCAPTCHA v3, which works invisibly: it evaluates behavior and stops automated attempts without asking anything of the person signing in.
VerifiableThe reCAPTCHA script is in the code of both forms.
What KIBBO cannot do
KIBBO is a web application and explicitly declares what the browser does not allow it to do: it does not access the camera, the microphone, the device location or payment methods. It is not a promise from the company: it is written in the site's permissions policy (Permissions-Policy) and the browser enforces it.
It is a list of negatives, and that is why anyone can verify it.
VerifiableIt is in the site's HTTP headers.
The data belongs to the institution that loads it.
The data the institution loads belongs to the institution, and only KIBBO accesses it: the policy declares it the exclusive property of the user. No sensitive data is collected: no health information is recorded, only equipment. It is hosted on Amazon Web Services and Hostinger servers located in the United States: an international transfer that the policy declares and the user consents to. The responsible company is registered with the National Registry of Databases.
VerifiableIt is in the privacy policy and the terms, both published.
Who is on the other side
KIBBO was developed by LEEX, a company with 40 years of experience in medical equipment and more than 30,000 devices managed across more than 7 countries. A company that knows what working with medical equipment is like, not just with software.
- years
- 40
- devices managed
- +30,000
- countries
- +7
The difference for a committee is not a seal: whoever administers this data manages medical equipment every day.
The questions this page does not answer
A procurement committee usually needs more detail than fits here. For those questions there is direct contact with the technical lead for app.kibbo.io.
In summary
The data an institution loads into KIBBO belongs to that institution. KIBBO does not collect sensitive data or people's health information, encrypts traffic over HTTPS, and hosts the information on Amazon Web Services and Hostinger servers. The responsible company is registered with the National Registry of Databases.
Technical content reviewed by Gustavo González, Founder of KIBBO.