Privacy Policy

Built with privacy in mind

Cura Well Plan was designed from the start to handle as little of your information as possible. In practice, that means:

• You can use Cura Well Plan anonymously — no account, no name, no sign-in required
• Your specific diagnosis details, anything you type or paste, and any document or photo you upload are not retained after your session ends
• Information is transmitted over encrypted (TLS) connections
• The small amount of information that is retained (only if you choose to give us an email address) is stored on managed cloud infrastructure that supports encryption at rest
• No individual data is ever sold or shared with advertisers, pharmaceutical companies, health systems, or research partners

What Cura Well Plan collects

Cura Well Plan is built to be used anonymously. You are never asked to create an account, provide your name, or verify your identity.

When you use the intake flow, Cura Well Plan processes:

• The information you choose to enter — whether you type it, paste it in, upload a document, or snap a photo of a report — including your role, disease category, and any diagnosis details you share
• Any document or photo you choose to upload, for the sole purpose of generating the questions and information shown to you in that session
• If you choose to leave an email address for updates, that email address — provided entirely at your option

Cura Well Plan does not require, request, or store your name, date of birth, address, insurance information, medical record number, or any other directly identifying information.

What Cura Well Plan keeps after your session ends

This is the most important part of this policy, so we're stating it plainly:

Cura Well Plan does not retain your specific diagnosis details, anything you typed or pasted beyond disease category, or any document or photo you upload. Once your session ends, that information is not kept.

The only two things Cura Well Plan retains are:

1. Your email address — but only if you chose to provide one, and only for the purpose of sending you updates.
2. The general disease category you selected (for example, "breast cancer" or "Alzheimer's," not your specific stage, your specific document contents, or any other detail) — paired with your email address, if you provided one, so that future updates can be relevant to the disease state you're following.

Nothing else from your session is retained in a form that can be tied back to you. If you did not provide an email address, nothing identifiable is retained at all.

Separately, Cura Well Plan keeps an anonymous, unlinked log of the questions people ask — the text of the question, a broad disease category, and a few topic tags. These entries do not contain your name, email address, IP address, the time of day, any uploaded document, or anything that connects two of your questions together or links a question back to you. They are used to improve Cura and may, in the future, inform the aggregated, de-identified research summaries described in the next section.

How Cura Well Plan handles sharing and selling of data

Cura Well Plan does not share, sell, rent, or disclose your individual information to any third party — including advertisers, pharmaceutical companies, health systems, or research partners. This applies to your email address, anything you typed or pasted, and anything you uploaded or photographed. No individual-level data — nothing that identifies you or could reasonably be linked back to you — leaves Cura Well Plan under any circumstance.

Cura Well Plan may, now or in the future, share or sell aggregated, de-identified information — for example, counts of how many people asked about a given topic in a given month, or broad trends in the kinds of questions people bring to Cura across a disease area. Aggregated, de-identified information contains no names, no email addresses, no IP addresses, no document contents, no individual questions or answers, and nothing that can reasonably be used to re-identify any individual user.

The line is simple: anything tied to you, or to your session, stays private and is never sold. Only fully anonymous, group-level patterns may ever be shared with outside partners such as researchers, health systems, or others working to improve patient information and care.

Documents and photos you upload

Documents and photos (for example, a snapshot of a lab report or pathology summary) uploaded for the purpose of generating follow-up questions are processed only to extract relevant information for your session, are not retained afterward in any form, and are never linked to any identifying information about you.

Cura Check accounts and saved reports

Cura Check is the one place on Cura Well Plan where you may choose to create an account. Using Cura Check without an account is always an option — if you don't sign in, nothing from your check is saved anywhere after you leave the page.

If you do create an account, here is exactly what happens:

• Your email address and password are handled by our authentication provider. We never see or store your password.
• The blood-test file you upload is never stored. It is read once to pull out lab values, shown to you for confirmation, and then discarded. No copy of the file, and no image of it, is kept.
• Only the values you confirm (for example total cholesterol, HDL, triglycerides, glucose or HbA1c, creatinine), the questionnaire answers used in scoring, and the resulting report are saved to your account — so you can see your trend over time.
• Saved reports are protected by database access rules so that only your own account can read them. They are not visible to other users.
• You can delete your saved data at any time from within Cura Check. Deletion removes your saved reports permanently; we do not keep a backup copy for our own use.

Information you enter into Cura Check is used only to generate and store your report. It is never sold, never used for advertising, and never shared with insurers, employers, health systems, or pharmaceutical companies.

Email address and disease category (optional)

If you choose to provide an email address to receive updates, it is stored together with the general disease category you selected (not your specific diagnosis details), solely so that future updates sent to you are relevant to that disease state. This information is used only to send you updates and is never shared or sold to any third party. You can unsubscribe at any time. Providing an email address is never required to use any feature of Cura Well Plan.

If you email a summary or plan to yourself, the message is sent through our email delivery provider and the address you entered is retained on that list until you unsubscribe.

Anonymous usage and traffic measurement

To understand what people need and whether the site is working, Cura Well Plan records a small amount of anonymous, aggregated usage information. Specifically:

• Session summaries: broad category selections (such as topic area or general disease category), whether a document was uploaded (yes/no), whether an email was requested (yes/no), whether the flow was completed, and the hour the session occurred — never the exact time, never your name, and never the contents of what you wrote.
• Question logs: the text of questions asked, stored unlinked — with no email address, no IP address, no account identifier, and nothing tying two questions together or back to you.
• Traffic source: the general channel a visit came from (for example a search engine, an AI assistant, or a direct visit) and whether the request appeared to be an automated crawler. We do not store IP addresses or build visitor profiles.

None of this is used to identify you, and none of it is combined with your email address or Cura Check account.

Service providers that process data for us

Cura Well Plan relies on a small number of vendors to operate. They process information only to provide their service to us, under their own security and confidentiality obligations, and are not permitted to use it for their own purposes:

• Cloud hosting and database — runs the site and stores the limited data described above, encrypted in transit and at rest.
• AI model providers — text you submit and text extracted from an uploaded document are sent to a large language model to generate your questions, summaries, or report. This is transmitted securely and is not retained by Cura Well Plan afterward.
• Email delivery — sends the messages you ask us to send.

We may also disclose information if required to do so by law, legal process, or to protect the safety of a person or the integrity of the service. Given how little we retain, there is typically very little to disclose.

Security of your information

Information is transmitted over encrypted (TLS) connections and stored on managed cloud infrastructure with encryption at rest and row-level access controls that restrict saved Cura Check reports to the account that created them. Access to production systems is limited to those who need it to operate the service.

No method of transmission or storage is completely secure. While we design the service to hold as little of your information as possible — which is itself the strongest protection we can offer — we cannot guarantee absolute security.

About HIPAA and health-data laws

People sometimes ask whether Cura Well Plan is "HIPAA compliant." We want to be straightforward about this rather than use a label that can be misleading.

HIPAA does not apply to Cura Well Plan. HIPAA governs healthcare providers, health plans, healthcare clearinghouses, and the vendors they contract with to handle protected health information. Cura Well Plan is none of those — it is a standalone educational tool you use on your own, not on behalf of a hospital, clinic, or insurer. We don't receive your medical records from a provider, and we don't send anything back to one.

What that means in practice: the protections described above — anonymous use, no retention of diagnosis details or documents, no sale of individual data — are the actual commitments Cura Well Plan makes to you, and they are designed to be more restrictive than what HIPAA would require of a covered entity. We do not, however, claim a HIPAA certification, because no such certification exists and HIPAA's framework was not written for a service like this one.

Separate consumer health-data laws — including Washington's My Health My Data Act and New York's 2025 health information privacy law — may apply to Cura Well Plan depending on where you live, and this policy is intended to be consistent with those laws.

Children and age requirements

Cura Well Plan is intended for adults 18 and older. It is not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child has provided us an email address, contact us at hello@curawellplan.com and we will delete it.

Cookies and analytics

Cura Well Plan does not currently use third-party analytics tools (such as Google Analytics), advertising trackers, or cross-site tracking cookies. The site uses only the minimal browser storage required for the app to function during your session — and, if you sign in to Cura Check, to keep you signed in. If this ever changes, this policy will be updated before any such tool is introduced.

Your rights and choices

Because Cura Well Plan does not retain your specific diagnosis details, documents, or session content, there is generally no individual record to access or correct beyond your email address and disease category, if provided, and any Cura Check reports you chose to save.

• Email: unsubscribe from any message, or ask us to delete your address and the associated disease category.
• Cura Check: view, export, or permanently delete your saved reports and account from within Cura Check.
• Access, correction, deletion, and opt-out rights under laws such as the CCPA/CPRA, Washington's My Health My Data Act, and other state privacy laws — we honor these requests regardless of where you live. We do not sell personal information and do not use it for targeted advertising, and we will not discriminate against you for exercising any of these rights.

To make a request, email hello@curawellplan.com. We respond within 30 days.

How to contact us

Questions about this policy, or about anything Cura Well Plan does with information, can go to hello@curawellplan.com.

Changes to this policy

Cura Well Plan may update this privacy policy from time to time. Material changes will be reflected with an updated effective date at the top of this page.