How we handle your data.

This policy covers the Karuna Copilot web application — the distributor training program and the prospective-rep updates list. It does not cover Karuna's clinical platform, KarunaHOME, which has a separate policy maintained by Karuna Labs Inc.

What we collect

If you join the updates list

• Your email address (required).
• The page where you signed up (e.g. /signin, /updates) for analytics on which channels work.
• Your IP address and browser user-agent — captured server-side for spam protection. Stored alongside the email; not sold or shared.
• A random unsubscribe token so you can one-click opt out from any email footer without logging in.

If you're an authenticated Karuna rep

• The Google profile fields you authorize: name, email, and profile photo. Access is restricted to karunalabs.com accounts.
• Your training progress: which modules you've passed, your roleplay transcripts, your certification status, and any questions you asked the copilot. Used to grade your work and surface your readiness to your Sales Lead.
• For voice roleplays, microphone audio is streamed in real time through our dedicated LiveKit service to OpenAI so the simulated buyer can respond. We retain the finalized text transcript and operational metrics; we do not record or store the audio.
• If you connect HubSpot or Gmail for Do mode: encrypted OAuth tokens (AES-256-GCM at rest) that grant the copilot read/draft access. Tokens never leave our database in plaintext and you can disconnect at any time from the Do page.

What we do not collect

• No PHI (protected health information). The copilot is a sales training tool; if you paste PHI into a question, our guardrail layer flags and blocks it before the agent processes it.
• No buyer data beyond what HubSpot already has and what you authorized us to read.
• No third-party analytics cookies, no advertising trackers.

How we use it

• Updates list: we send program updates (cohort openings, training drops). About one email a month. You can opt out via any email footer or by emailing privacy@karunalabs.com.
• Training data: used to surface your readiness to your Sales Lead and to improve the program. We may use anonymized roleplay transcripts to improve the AI grader; any such use is reviewed by Karuna's Sales Lead first.
• OAuth tokens: only used to draft emails and create CRM tasks when you explicitly request them from the Do page. We never send email on your behalf or modify CRM records without your one-click confirmation.

Where it lives

Encrypted Postgres at a Supabase instance hosted in the United States (us-west-1). Typed grading calls are routed through Anthropic's zero-data-retention endpoint per Karuna's enterprise contract. Voice audio is transported transiently through the distributor app's separate LiveKit project to OpenAI Realtime; only finalized text turns and content-free performance metrics are written to our database.

How long we keep it

• Email list: until you unsubscribe (then 90 days for compliance audit, then deleted).
• Training records: 2 years from the rep's last activity.
• OAuth tokens: until you disconnect or revoke them via Google/HubSpot.

Your rights

You can request a copy of your data, ask for it to be deleted, or ask us to stop processing it. Send a note to privacy@karunalabs.com and we'll respond within 30 days.

Changes

If we change this policy materially we'll send an email to the address on file and update the effective date above.

Who runs this

Karuna Labs Inc. — see Terms for the full contact information.