Consumer Health Data Privacy Notice

Short version: We collect the health information you choose to give Eva so she can track it and remind you. We never sell it, never use it for advertising, and share it only with the specific vendors listed below, each limited to the job we hired them for.

1. What counts as consumer health data here

Under this notice, "consumer health data" means any information that identifies your physical or mental health status, including but not limited to:

Medication names, dosages, and schedules
Vitals you log, such as blood pressure, heart rate, weight, and blood glucose
Symptoms, notes, and anything you tell Eva during a check-in
Health conditions you choose to disclose
Data synced from Apple Health or Google Health Connect, if you connect a wearable
Precise location, when you use the "find nearby pharmacies" feature

2. Why we collect it

We collect this data for one purpose: to run the service you signed up for. Specifically, to let Eva check in on your medications and vitals, alert your family or caregivers if something is missed, generate reports you choose to share with your doctor, and personalize Eva's conversations with you. We do not collect health data for advertising, and we do not use it to build profiles for any purpose beyond providing Cureva to you.

3. Who we share it with

We do not sell consumer health data, and we do not share it with any data broker or advertiser. We share it only with the following service providers, each under a data processing agreement limiting them to the purpose listed:

OpenRouter — receives the content of your conversations with Eva to route them to an AI model (Anthropic, Google, or OpenAI, depending on availability) and generate her responses
Twilio — receives the alert message and your caregiver's phone number to send SMS notifications when a check-in or medication is missed
SendGrid and Brevo — receive your email address and relevant account details to deliver emails
Sentry — may receive technical details about app errors, with health-related screen content masked
Supabase — stores your health data in our database, encrypted at rest
Any family member or caregiver you explicitly connect to your account, limited to what you choose to share with them
Your healthcare provider, only when you choose to send them a report

We do not share consumer health data with PostHog or Google Analytics — those tools receive general product-usage data only (pages visited, features used), never linked to the health information above.

4. No geofencing

We do not use geofencing — the practice of using a person's location to identify when they are at or near a health care facility to send them notifications, collect data, or target advertising. Location is used only if you actively choose to search for nearby pharmacies, and is not stored to build a history of where you have been.

5. Your rights

You can, at any time, by emailing [email protected]:

Confirm whether we are collecting, sharing, or selling your consumer health data
Access the consumer health data we hold about you
Withdraw your consent to our collection or sharing of your consumer health data
Request deletion of your consumer health data — we will delete it from our production systems within 30 days and from backups within 90 days, and will notify any service provider or affiliate we shared it with to do the same

We will not deny you service, charge you a different price, or provide a lower quality of service because you exercised any of these rights.

6. How to reach us

For questions about this notice or to exercise any of the rights above, contact us at [email protected]. We respond within 30 days. This notice works alongside, and does not replace, our general Privacy Policy and Terms of Service.