How we handle your information
This page is maintained by Cura Well Plan to answer common security and privacy questions about the app. It describes controls that are in place today — it is not a certification or a substitute for our Privacy and Terms.
Last updated July 2026
What we build, and what we don't do
Cura Well Plan is an educational health information hub with an AI assistant. It provides plain-language explanations and suggested questions for your doctor. It is not a medical device, not a diagnosis, and not a replacement for professional care.
We do not sell identifiable personal information, and we do not share your questions or intake responses with advertisers.
Authentication & account access
Sign-in is optional. When you choose to create an account, we support email + password and Google sign-in. Passwords are managed by our backend provider and are never stored by us in plain text.
You can use the AI assistant without an account. If you sign in, you can sign out at any time from the header menu.
Data storage & access controls
Application data is stored in a managed Postgres database with row-level security enabled on user-facing tables. Server-side code enforces access rules so that people only see records tied to their own session or email.
Anonymous question logs used to improve the service are stored without names, emails, IP addresses, or account identifiers, so they cannot be linked back to an individual.
Encryption in transit
The site is served over HTTPS. Requests to our AI provider, email provider, and payment provider are made server-side over TLS.
Subprocessors we rely on
We use a small number of vetted providers to run the service:
- Lovable Cloud — application hosting, database, authentication, and email delivery infrastructure.
- Anthropic (Claude) — the AI model that generates answers and intake summaries. Prompt content is sent to Anthropic to produce a response.
- Stripe — processes donations and supporter subscriptions. Card details are entered on Stripe's own hosted checkout and are never sent to our servers.
- Google Search Console — read-only search analytics for the marketing site.
Email you receive from us
Transactional email (conversation transcripts, intake results, supporter receipts) is sent from notify.curawellplan.com. You can unsubscribe from any non-essential message using the link at the bottom of the email.
Reporting a security concern
If you think you have found a security issue, or you want to report something that looks wrong with how your information is handled, email us at hello@curawellplan.com. Please avoid sharing sensitive personal health details in the initial report.
For a medical emergency, call your local emergency number. Do not use email or the AI assistant for urgent care.