Privacy Policy
Effective date: [insert date at launch]
Built with privacy in mind
Cura Well Plan was designed from the start to handle as little of your information as possible. In practice, that means:
- You can use Cura Well Plan anonymously — no account, no name, no sign-in required
- Your specific diagnosis details, anything you type or paste, and any document or photo you upload are not retained after your session ends
- Information is transmitted over encrypted (TLS) connections
- The small amount of information that is retained (only if you choose to give us an email address) is stored on managed cloud infrastructure that supports encryption at rest
- No individual data is ever sold or shared with advertisers, pharmaceutical companies, health systems, or research partners
What Cura Well Plan collects
Cura Well Plan is built to be used anonymously. You are never asked to create an account, provide your name, or verify your identity.
When you use the intake flow, Cura Well Plan processes:
- The information you choose to enter — whether you type it, paste it in, upload a document, or snap a photo of a report — including your role, disease category, and any diagnosis details you share
- Any document or photo you choose to upload, for the sole purpose of generating the questions and information shown to you in that session
- If you choose to leave an email address for updates, that email address — provided entirely at your option
Cura Well Plan does not require, request, or store your name, date of birth, address, insurance information, medical record number, or any other directly identifying information.
What Cura Well Plan keeps after your session ends
This is the most important part of this policy, so we're stating it plainly:
Cura Well Plan does not retain your specific diagnosis details, anything you typed or pasted beyond disease category, or any document or photo you upload. Once your session ends, that information is not kept.
The only two things Cura Well Plan retains are:
- Your email address — but only if you chose to provide one, and only for the purpose of sending you updates.
- The general disease category you selected (for example, "breast cancer" or "Alzheimer's," not your specific stage, your specific document contents, or any other detail) — paired with your email address, if you provided one, so that future updates can be relevant to the disease state you're following.
Nothing else from your session is retained in a form that can be tied back to you. If you did not provide an email address, nothing identifiable is retained at all.
Separately, Cura Well Plan keeps an anonymous, unlinked log of the questions people ask — the text of the question, a broad disease category, and a few topic tags. These entries do not contain your name, email address, IP address, the time of day, any uploaded document, or anything that connects two of your questions together or links a question back to you. They are used to improve Cura and may, in the future, inform the aggregated, de-identified research summaries described in the next section.
Documents and photos you upload
Documents and photos (for example, a snapshot of a lab report or pathology summary) uploaded for the purpose of generating follow-up questions are processed only to extract relevant information for your session, are not retained afterward in any form, and are never linked to any identifying information about you.
Email address and disease category (optional)
If you choose to provide an email address to receive updates, it is stored together with the general disease category you selected (not your specific diagnosis details), solely so that future updates sent to you are relevant to that disease state. This information is used only to send you updates and is never shared or sold to any third party. You can unsubscribe at any time. Providing an email address is never required to use any feature of Cura Well Plan.
About HIPAA and health-data laws
People sometimes ask whether Cura Well Plan is "HIPAA compliant." We want to be straightforward about this rather than use a label that can be misleading.
HIPAA does not apply to Cura Well Plan. HIPAA governs healthcare providers, health plans, healthcare clearinghouses, and the vendors they contract with to handle protected health information. Cura Well Plan is none of those — it is a standalone educational tool you use on your own, not on behalf of a hospital, clinic, or insurer. We don't receive your medical records from a provider, and we don't send anything back to one.
What that means in practice: the protections described above — anonymous use, no retention of diagnosis details or documents, no sale of individual data — are the actual commitments Cura Well Plan makes to you, and they are designed to be more restrictive than what HIPAA would require of a covered entity. We do not, however, claim a HIPAA certification, because no such certification exists and HIPAA's framework was not written for a service like this one.
Separate consumer health-data laws — including Washington's My Health My Data Act and New York's 2025 health information privacy law — may apply to Cura Well Plan depending on where you live, and this policy is intended to be consistent with those laws.
Your rights
Because Cura Well Plan does not retain your specific diagnosis details, documents, or session content, there is generally no individual record to access or correct beyond your email address and disease category, if provided. If you provided an email address, you can request its removal — along with the associated disease category — at any time by [contact method].
Changes to this policy
Cura Well Plan may update this privacy policy from time to time. Material changes will be reflected with an updated effective date at the top of this page.