Privacy Policy

1. Who we are

Cureva is operated by Cureva Health, based in British Columbia, Canada. Our address for privacy matters is: [email protected]. We are the data controller for all personal information collected through the Cureva app and website.

2. What information we collect

Account information

When you create a Cureva account, we collect your name, email address, and the password you choose. We may also collect your date of birth, which helps Eva personalize check-ins appropriately.

Health information

To provide our core service, Cureva collects health-related information you voluntarily provide, including: medication names, dosages, and schedules; vitals you log (blood pressure, heart rate, weight, glucose); symptoms and notes you share with Eva during check-ins; health conditions you choose to disclose; journal entries, documents and photos you choose to upload; and, only if you connect it, readings from Apple Health or Health Connect. If you use voice input with Eva, your device's speech recognition converts what you say into text; only the resulting text is kept and no audio recording is saved. Cureva is not a HIPAA covered entity, so information you enter yourself is not protected health information under HIPAA, but it is personal health information under PIPEDA and comparable laws, and we treat and protect it as sensitive health information.

Family member information

If you add family members or caregivers to your account, we collect their names, email addresses, and the notification preferences you set for them. Family members must consent before receiving any alerts.

Caregiver accounts. If you use Cureva as a caregiver, we collect your name, email address, whether you are a family or professional caregiver, your relationship to each person you look after, and your activity on the shared care list. Caregivers can delete their own account at any time from their profile in the app.

Caregiver access and Eva. A caregiver you connect sees only what you allow, and you can change or remove that at any time, per caregiver. A connected caregiver may also chat with Eva about you; those conversations use information about you that you have allowed them to see, and they count towards your daily Eva message allowance. Whether one caregiver can see what another caregiver did on your shared to-do list is your choice, per caregiver, and is off unless you turn it on.

Usage data

We collect standard app usage data including pages visited, features used, session duration, and device type. This data is used in aggregate only, never linked to your health information.

Communications

When you contact us at [email protected], we retain those communications to assist you and improve our service.

3. How we use your information

• To provide Eva's core caretaking functions: daily check-ins, medication tracking, family alerts, and doctor reports
• To personalize Eva's conversations and recommendations based on your health profile
• To send you product updates and waitlist communications (with your consent)
• To improve Cureva's AI and product features using anonymized, aggregated data only
• To comply with legal obligations and respond to lawful requests

4. Legal basis for processing (GDPR)

For users in the European Economic Area, we process your data under the following legal bases: contract performance (to provide the service you signed up for); your explicit consent (for health data processing and communications); and legitimate interests (for security, fraud prevention, and product improvement using anonymized data only).

5. Who we share data with

We do not sell your personal information. We do not use advertising pixels or ad networks anywhere on our site or in our app. Your health information is never used for advertising. We share information only in the following limited circumstances:

• Family members and caregivers: Only with contacts you explicitly authorize in your account settings
• Healthcare providers: Only when you choose to share a doctor report, and only to the provider you specify
• Service providers: We use the following vendors to operate Cureva, each bound by a data processing agreement and limited to the purpose listed:
  • OpenRouter: routes Eva's conversations to AI models (Anthropic) to generate responses
  • Cheaper Inference (AI gateway) and the AI model providers it routes to (such as Anthropic, Google and OpenAI): process the text of your Eva conversations and the health summaries you request in order to generate responses
  • Stripe, Apple and Google: process subscription payments and in-app purchases. We do not receive or store your full card number
  • Apple Push Notification service, Firebase Cloud Messaging and Expo: deliver reminders and app updates to your device
  • Twilio: sends SMS alerts when a scheduled check-in or medication is missed, only to a phone number you have opted in; message and data rates may apply, reply STOP to cancel or HELP for help
  • SendGrid and Brevo: deliver account, billing, and product emails
  • Sentry: captures technical error data to help us fix bugs
  • PostHog and Google Analytics: measure product and website usage in aggregate
  • Supabase: hosts our database and backend infrastructure
  • Railway: runs our application servers, which process your data in order to operate the service
  • Cloudflare: hosts and delivers our website
  • Groq: speech-to-text, used only if you send a voice recording to Eva; the recording is deleted as soon as it has been converted to text
• Legal requirements: When required by law, court order, or to protect the safety of users

6. International data transfers

Cureva is based in British Columbia, Canada, and most of the service providers listed above are located in the United States. This means your information, including health information, may be transferred to and processed in the United States, where privacy laws may differ from those in your country. We require every service provider that processes personal information on our behalf to sign a data processing agreement committing them to protections comparable to Canadian and applicable privacy law, and we limit each provider to the specific purpose listed above.

Where your health information is kept: the Cureva database, including your health information, documents and photos, is stored at rest in Canada (AWS ca-central-1, Montreal). While it is being processed to run the service, it can pass through application servers and providers in the United States.

7. Data security

All data transmitted between the Cureva app and our servers is encrypted using TLS 1.3. All health data stored in our systems is encrypted at rest using AES-256. We carry out regular internal security reviews. Our database and backend hosting provider, Supabase, maintains SOC 2 Type 2 certification. Access to health data by Cureva staff is strictly limited and logged.

We implement administrative, physical, and technical safeguards for Protected Health Information in alignment with HIPAA security rule requirements.

If a breach occurs: if we discover a breach of unsecured personal or health information, we will notify affected individuals by email without unreasonable delay and no later than 60 days after discovery, describing what happened, what information was involved, and what we are doing about it. For Canadian residents we report to the Privacy Commissioner and notify affected people as soon as feasible where a breach creates a real risk of significant harm, and we keep a record of every breach for 24 months. For Australian residents we notify the OAIC and affected people as soon as practicable once we are aware a breach is likely to cause serious harm. For EU/UK residents we notify the supervisory authority within 72 hours of becoming aware of a reportable breach. Where required (including under the FTC Health Breach Notification Rule for U.S. users and under applicable Canadian, Australian, EU/UK, and state breach-notification laws), we will also notify the relevant regulator (and the media, if a breach affects 500 or more residents of a state or jurisdiction) within the timeframe that law requires.

8. Data retention

We retain your account information and health data for as long as your account is active, or as required by law. When you delete your account, your personal information and health data are permanently deleted within 30 days from our production systems and within 90 days from backup systems.

9. Your rights

Depending on your location, you have the following rights regarding your personal information:

• Access: Request a copy of all personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and all associated data
• Portability: Request your health data in a machine-readable format
• Withdrawal of consent: Withdraw consent for any processing based on consent, at any time
• Objection: Object to processing for legitimate interests

You can delete your account yourself, at any time, inside the app: Profile, then Delete account (caregivers: your profile, then Delete account). To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. Compliance

HIPAA (USA): Cureva is designed to support HIPAA Privacy and Security Rule requirements for Protected Health Information.

My Health My Data Act (Washington State): See our separate Consumer Health Data Privacy Notice, which describes the health data we collect, why, and who it is shared with in more detail, as required by Washington law.

PIPEDA and PIPA (Canada): We comply with the Personal Information Protection and Electronic Documents Act and, for British Columbia residents, the Personal Information Protection Act. Canadian residents may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in British Columbia, the Office of the Information and Privacy Commissioner (oipc.bc.ca). Information held by our providers outside Canada may be accessible to courts and authorities in those countries. The person responsible for the protection of personal information at Cureva can be reached at [email protected].

India (Digital Personal Data Protection Act, 2023): If you use Cureva from India, we process your personal data only with your consent or for another purpose the Act allows. When we ask for your consent we tell you what we collect and why, and you can withdraw consent at any time as easily as you gave it. You may ask us to give you access to your data, correct it, complete it or erase it, and you may nominate another person to exercise these rights for you. Cureva is for people aged 18 and over in India. Our contact for grievances is [email protected], and we will respond within 30 days; if you are not satisfied, you may complain to the Data Protection Board of India. Your information may be transferred outside India, which the Act allows except to countries the Government of India restricts.

Quebec (Law 25): For Quebec residents, before information leaves Quebec we assess the legal framework of where it is going and use written agreements to protect it, we ask for your express consent before collecting health information, and you may ask for a copy of your information in a portable format. You may complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

PHIPA (Ontario): For users in Ontario, Cureva handles personal health information in alignment with the Personal Health Information Protection Act. All health data is stored in Canada (AWS ca-central-1, Montreal). Cureva is not a health information custodian under PHIPA. Ontario users who believe their health information rights have not been respected may contact the Information and Privacy Commissioner of Ontario at ipc.on.ca.

HIA (Alberta): For users in Alberta, Cureva handles health information in alignment with the Health Information Act. All health data is stored in Canada (AWS ca-central-1, Montreal). Alberta users may contact the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca.

CCPA (California): California residents have additional rights under the California Consumer Privacy Act, including the right to know, delete, and opt out of sale (we do not sell personal information).

CPRA and other U.S. state privacy laws (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others): Depending on where you live, you may have the right to access, correct, delete and receive a copy of your personal information, to opt out of targeted advertising, sale and certain profiling, and to limit our use of sensitive personal information. We do not sell personal information, we do not share it for targeted advertising, and we use health information (which these laws treat as sensitive) only to provide Cureva to you, with your consent. We collect that consent before collecting health data. To use any of these rights, email [email protected]. If we decline a request you may appeal by replying to our decision and asking for a review; we will answer your appeal within 45 days. You may also contact your state attorney general.

Artificial intelligence and automated processing: Eva is an AI companion, not a person, and we tell you so in the app. Eva supports, tracks and informs; she does not diagnose or prescribe. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. You can always reach a person at [email protected].

CMIA (California): We handle California residents' medical information in alignment with the Confidentiality of Medical Information Act. We never use or disclose it for marketing purposes, and we never share it with an employer.

Privacy Act 1988 (Australia): If you access Cureva from Australia, we handle your personal and health information in line with the Australian Privacy Principles, including obtaining your consent before collecting health information and taking reasonable steps to make sure our service providers outside Australia handle it in line with those principles. We disclose information to service providers in Canada and the United States, and our AI providers may process it in other countries. If you are unhappy with how we handle your information, email [email protected] and we will reply within 30 days; if it is not resolved you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

GDPR (EU/EEA) and UK GDPR: Cureva Health is a Canadian company. The European Commission has recognised Canada's federal privacy law (PIPEDA) as providing adequate protection under Decision 2002/2/EC, which covers transfers to Cureva in Canada as a commercial organisation. It does not cover onward transfers by us or our providers to other countries. Cureva does not yet offer the service to people in the EU/EEA, the UK or Switzerland. Before it does, we will appoint EU and UK representatives, put in place the transfer safeguards required for onward transfers to countries without an adequacy decision, including the United States (the EU-US Data Privacy Framework where the recipient is certified, and otherwise Standard Contractual Clauses with the UK Addendum), and publish the representatives' details here. For health data (special category data under Article 9), we collect your explicit consent before processing. You can withdraw this at any time by emailing [email protected] or by deleting your account. Withdrawing does not affect processing that happened before, but we may then be unable to provide the service. EU/EEA and UK residents have the right to lodge a complaint with their national supervisory authority. For all EU/UK data requests, contact [email protected] and we will respond within 30 days.

11. Cookies and tracking

The Cureva website uses essential cookies (required for the site to function) and analytics cookies (to understand how visitors use our site). You may decline analytics cookies via the cookie banner. We do not use tracking cookies for advertising purposes.

12. Children's privacy

Cureva is for adults aged 18 and older and is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, contact us immediately at [email protected] and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice in the app at least 7 days before the change takes effect.

14. Contact us

For privacy questions, requests, or concerns, contact us at [email protected]. We respond to all privacy inquiries within 30 days.