Consumer Health Data Privacy Notice
Last updated: September 2, 2026. This notice is provided separately from our general Privacy Policy, as required by Washington State's My Health My Data Act, and describes specifically how we handle consumer health data.
1. What counts as consumer health data here
Under this notice, "consumer health data" means any information that identifies your physical or mental health status, including but not limited to:
- Medication names, dosages, and schedules
- Vitals you log, such as blood pressure, heart rate, weight, and blood glucose
- Symptoms, notes, and anything you tell Eva during a check-in
- Health conditions you choose to disclose
- Data synced from Apple Health or Google Health Connect, if you connect a wearable
- Precise location, when you use the "find nearby pharmacies" feature
2. Why we collect it
We collect this data for one purpose: to run the service you signed up for. Specifically, to let Eva check in on your medications and vitals, alert your family or caregivers if something is missed, generate reports you choose to share with your doctor, and personalize Eva's conversations with you. We do not collect health data for advertising, and we do not use it to build profiles for any purpose beyond providing Cureva to you.
3. Who we share it with
We do not sell consumer health data, and we do not share it with any data broker or advertiser. We share it only with the following service providers, each under a data processing agreement limiting them to the purpose listed:
- OpenRouter: receives the content of your conversations with Eva to route them to an AI model (Anthropic) and generate her responses
- Twilio: receives a reminder message and your phone number, only if you opt in, to send an SMS dose reminder when push notifications are not available
- SendGrid and Brevo: receive your email address and relevant account details to deliver emails
- Sentry: may receive technical details about app errors, with health-related screen content masked
- Supabase: stores your health data in our database, encrypted at rest
- Any family member or caregiver you explicitly connect to your account, limited to what you choose to share with them
- Your healthcare provider, only when you choose to send them a report
We do not share consumer health data with PostHog or Google Analytics. Those tools receive general product-usage data only (pages visited, features used), never linked to the health information above.
4. No geofencing
We do not use geofencing, the practice of using a person's location to identify when they are at or near a health care facility to send them notifications, collect data, or target advertising. Location is used only if you actively choose to search for nearby pharmacies, and is not stored to build a history of where you have been.
5. Your rights
You can, at any time, by emailing [email protected]:
- Confirm whether we are collecting, sharing, or selling your consumer health data
- Access the consumer health data we hold about you
- Withdraw your consent to our collection or sharing of your consumer health data
- Request deletion of your consumer health data. We will delete it from our production systems within 30 days and from backups within 90 days, and will notify any service provider or affiliate we shared it with to do the same
We will not deny you service, charge you a different price, or provide a lower quality of service because you exercised any of these rights.
6. How to reach us
For questions about this notice or to exercise any of the rights above, contact us at [email protected]. We respond within 30 days. This notice works alongside, and does not replace, our general Privacy Policy and Terms of Service.