Privacy Policy

Last updated: May 27, 2026 · Effective: May 27, 2026

Short version: We collect only what's needed to run the app. We never sell your health data. You own your data and can delete it at any time. We comply with PIPEDA (Canada) and CCPA (California).

1. Who We Are

Cureva is operated by Lumina Path (Cureva), a sole proprietorship registered in British Columbia, Canada. References to "we", "us", or "Cureva" in this policy mean Lumina Path (Cureva).

Contact: hello@cureva.app

2. What We Collect

Category	Data collected	Why
Account	Name, email address	To create and manage your account
Health — Medication	Medicine names, doses, schedules, dose logs (taken/skipped/missed/snoozed)	Core product — medication reminders and adherence tracking
Health — Vitals	Blood pressure, glucose, weight, and other self-reported vitals (optional)	Trends and doctor report generation
Clinical	Doctor names, clinic email addresses, appointment requests	Doctor connection and report delivery features
Caregiver	Caregiver account link, relationship label, permission level	Caregiver mode — read-only adherence view
AI interactions	Your check-in messages with Eva (our AI caretaker)	Personalised AI responses — context kept for 7 days
Billing	Stripe customer ID, subscription plan	Payment processing — card details go directly to Stripe, not us
Device	Push notification token (Firebase FCM)	Medication reminders and alerts
Usage	App navigation, feature usage, error logs	Bug fixing and product improvement

3. How We Use Your Data

Sending medication reminders at your scheduled times
Generating AI caretaker check-ins via Eva
Producing formatted health reports for your doctor (only on your request)
Alerting caregivers when you miss a dose (only if you set up caregiver access)
Processing your subscription payment via Stripe
Sending service emails (welcome, password reset, subscription receipts)
Improving the product using anonymised, aggregated analytics

We never use your data to train AI models. We never sell your data. We never share it with advertisers.

4. Where Your Data Is Stored

Cureva stores data in the following locations:

Primary database: Supabase (PostgreSQL) — hosted on AWS US East (N. Virginia, USA). Supabase holds SOC 2 Type II certification.
Cache / AI memory: Upstash Redis — US region. Eva conversation context, retained for 7 days then automatically deleted.
Push notifications: Google Firebase (FCM) — US servers.
Email: SendGrid (Twilio) — US servers.
Payments: Stripe — PCI DSS Level 1 certified. We never store raw card numbers.

All data transfers from Canada to the US are protected under contractual safeguards with each provider.

5. Your Rights Under PIPEDA (Canada)

Right to access: Request a copy of all personal data we hold about you.
Right to correction: Ask us to correct inaccurate data.
Right to erasure: Delete your account and all associated data. Available in-app under Settings → Delete My Account, or by emailing us.
Right to withdraw consent: You may withdraw consent at any time by deleting your account.
Right to complain: You may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

6. Your Rights Under CCPA (California)

California residents have the right to know what personal information is collected, the right to deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact hello@cureva.app.

7. Data Retention

Active account data: retained while your account is open.
Deleted accounts: all health data purged within 30 days. Billing records retained 7 years (legal requirement).
Eva AI memory: auto-deleted after 7 days of inactivity.
Dose logs: retained for 2 years to support long-term adherence trends, then anonymised.

8. Data Security

All data in transit is encrypted with TLS 1.3.
All data at rest is encrypted by Supabase (AES-256).
Health data is never stored in plain text.
Access to production data is restricted to authorised administrators only.
In the event of a breach affecting your personal data, we will notify you within 72 hours as required by applicable law.

9. Children

Cureva is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal information, contact us immediately.

10. AI Caretaker (Eva)

Eva is powered by OpenAI GPT-4o. Your check-in messages and medication context are sent to OpenAI's API to generate responses. OpenAI processes this data under their data processing agreement and does not train models on API data. Eva never provides medical advice — always consult your doctor for medical decisions.

When you use the Medicine Info feature, the name of a medicine is sent to openFDA, the U.S. FDA's public drug-label database, to look up its label information. Only the medicine name is sent — never your account details, identity, or any other personal information. openFDA is a public U.S. government service and the information it returns is not verified by the FDA.

11. Third-Party Links

The app may contain links to external resources (e.g., health articles). We are not responsible for the privacy practices of those websites.

12. Changes to This Policy

We will notify you of material changes via email or in-app notification at least 14 days before they take effect. The current version is always available at cureva.app/privacy.

Questions or requests?

Email us at hello@cureva.app — we respond within 5 business days.
Lumina Path (Cureva) · British Columbia, Canada