Last updated: September 2, 2026. Effective for Cureva users in Canada, the United States, and Australia.
Cureva is operated by Cureva Health, based in British Columbia, Canada. Our address for privacy matters is: [email protected]. We are the data controller for all personal information collected through the Cureva app and website.
When you create a Cureva account, we collect your name, email address, and the password you choose. We may also collect your date of birth, which helps Eva personalize check-ins appropriately.
To provide our core service, Cureva collects health-related information you voluntarily provide, including: medication names, dosages, and schedules; vitals you log (blood pressure, heart rate, weight, glucose); symptoms and notes you share with Eva during check-ins; and health conditions you choose to disclose. This is considered Protected Health Information (PHI) under HIPAA and Personal Health Information under PIPEDA.
If you add family members or caregivers to your account, we collect their names, email addresses, and the notification preferences you set for them. Family members must consent before receiving any alerts.
We collect standard app usage data including pages visited, features used, session duration, and device type. This data is used in aggregate only, never linked to your health information.
When you contact us at [email protected], we retain those communications to assist you and improve our service.
For users in the European Economic Area, we process your data under the following legal bases: contract performance (to provide the service you signed up for); your explicit consent (for health data processing and communications); and legitimate interests (for security, fraud prevention, and product improvement using anonymized data only).
We do not sell your personal information. We do not use advertising pixels or ad networks anywhere on our site or in our app — your health information is never used for advertising. We share information only in the following limited circumstances:
Cureva is based in British Columbia, Canada, and most of the service providers listed above are located in the United States. This means your information, including health information, may be transferred to and processed in the United States, where privacy laws may differ from those in your country. We require every service provider that processes personal information on our behalf to sign a data processing agreement committing them to protections comparable to Canadian and applicable privacy law, and we limit each provider to the specific purpose listed above.
All data transmitted between the Cureva app and our servers is encrypted using TLS 1.3. All health data stored in our systems is encrypted at rest using AES-256. We conduct regular security audits and penetration testing. Access to health data by Cureva staff is strictly limited and logged.
We implement administrative, physical, and technical safeguards for Protected Health Information in alignment with HIPAA security rule requirements.
We retain your account information and health data for as long as your account is active, or as required by law. When you delete your account, your personal information and health data are permanently deleted within 30 days from our production systems and within 90 days from backup systems.
Depending on your location, you have the following rights regarding your personal information:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
HIPAA (USA): Cureva is designed to support HIPAA Privacy and Security Rule requirements for Protected Health Information.
My Health My Data Act (Washington State): See our separate Consumer Health Data Privacy Notice, which describes the health data we collect, why, and who it is shared with in more detail, as required by Washington law.
PIPEDA and PIPA (Canada): We comply with the Personal Information Protection and Electronic Documents Act and, for British Columbia residents, the Personal Information Protection Act.
CCPA (California): California residents have additional rights under the California Consumer Privacy Act, including the right to know, delete, and opt out of sale (we do not sell personal information).
Privacy Act 1988 (Australia): If you access Cureva from Australia, we handle your personal and health information in line with the Australian Privacy Principles, including obtaining your consent before collecting health information and taking reasonable steps to protect it when it is processed by our service providers outside Australia.
GDPR (EU/EEA): Cureva is not currently marketed to users in the European Economic Area, and we are in the process of putting the additional safeguards GDPR requires in place, including an EU representative. If you are located in the EEA and have questions about your data, contact us at [email protected] before creating an account.
The Cureva website uses essential cookies (required for the site to function) and analytics cookies (to understand how visitors use our site). You may decline analytics cookies via the cookie banner. We do not use tracking cookies for advertising purposes.
Cureva is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us immediately at [email protected] and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice in the app at least 30 days before the change takes effect.
For privacy questions, requests, or concerns, contact us at [email protected]. We respond to all privacy inquiries within 30 days.