How we handle your data.

This Privacy Policy applies to the Cura mobile app, website, and related services (together, “Cura”), operated by Cura Health (“we,” “us”). By creating an account or using Cura, you agree to this policy. If you do not agree, please do not use Cura.

Cura is an educational health tool, not a healthcare provider, health plan, or clearinghouse. As such, Cura is generally not a “covered entity” under HIPAA, and your use of Cura does not create a doctor–patient relationship. Your health information is still sensitive, and we treat it that way.

We collect only what we need to operate Cura for you.

• ·Account data. Your email address, used for one-time-passcode sign-in. We do not store passwords.
• ·Health data you provide. Lab results, genetic reports (e.g. 23andMe/AncestryDNA exports), wearable metrics (sleep, HRV, respiration, activity), imaging reports, symptoms, and lifestyle or history you enter or upload.
• ·Conversations. The questions you ask Cura and the case context generated from your data, so your case file compounds over time.
• ·Payment data. Subscriptions are processed by Stripe. We receive subscription status and billing metadata; we never see or store your full card number.
• ·Usage data. Basic device, log, and diagnostic information needed to keep the service reliable and secure.

• ·To provide Cura’s core function: reading your data across domains to surface patterns, context, and better questions for your doctor.
• ·To maintain your longitudinal case file so insights improve as you add data.
• ·To process your subscription and lab orders.
• ·To secure the service, prevent abuse, and meet legal obligations.
• ·To communicate with you about your account and material changes to the service.

Cura’s reasoning is powered by large language models operated by enterprise AI providers acting as our processors under contract. Your data is sent to these providers solely to generate your results.

• ·Your health data and conversations are not used to train third-party foundation models.
• ·We do not use your individual health data to advertise to you or anyone else.

We do not sell your personal or health data. We share it only with service providers (“subprocessors”) that help us run Cura, each bound by contract to protect it:

• ·Hosting & database — for storing your account and case data.
• ·AI providers — for generating reasoning and explanations (see section 4).
• ·Stripe — for payment processing.
• ·Lab partners — only when you choose to order a test, and only the data needed to fulfill that order.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition (in which case this policy continues to govern your data).

We keep your data for as long as your account is active. If you delete your account, we delete your personal and health data from our active systems within 30 days, except where we are legally required to retain limited records (e.g. payment records). Backups are purged on a rolling schedule.

You can access, export, correct, or delete your data at any time from within the app, or by contacting us. Depending on where you live, you may have additional rights under laws such as the GDPR, the California Consumer Privacy Act (CCPA/CPRA), and the Washington My Health My Data Act — including the right to know, delete, and opt out of any sharing of sensitive data. We honor these requests regardless of where you live.

Much of what you add to Cura is “consumer health data” — information that identifies your past, present, or future health. This includes your lab results, genetic data, wearable metrics, imaging, symptoms, and the health-related questions you ask. Some states, including under the Washington My Health My Data Act and Nevada’s consumer health data law, give this category special protection. We extend these protections to all users regardless of where you live.

• ·Consent. We collect your consumer health data only with your consent, to provide the features you ask for. We do not collect it for advertising.
• ·No sale. We do not sell your consumer health data, and we will not share it for anyone else’s purposes without your valid authorization.
• ·Withdraw & delete. You can withdraw your consent, and you can have your consumer health data deleted, at any time from within the app or by contacting us.
• ·Genetic data. Genetic information is especially sensitive. We process it only with your explicit consent, use it solely to generate your own insights, never sell it, and delete it when you delete your account.

We protect your data with encryption in transit and at rest, scoped access controls, and least-privilege practices. No system is perfectly secure, but we treat health data with the heightened care it deserves and will notify you and regulators of qualifying breaches as required by law.

Cura is intended for adults 18 and older. We do not knowingly collect data from children. If you believe a minor has provided us data, contact us and we will delete it.

We may update this policy as Cura evolves. If we make material changes, we will notify you in the app or by email before they take effect. The “last updated” date above always reflects the current version.

Questions, requests, or concerns about your privacy? Reach us at privacy@curahealth.io. See also our Terms of Service.