Your health data is sacred.
We treat it that way.
Designed to support HIPAA requirements. Encrypted in transit and at rest. Built with security as the foundation, not an afterthought.
Encryption for uploaded documents
Encrypted connections to our servers
Health data records sold or shared with advertisers
Compliance frameworks: HIPAA, PIPEDA, GDPR, CCPA
Security practices,
explained plainly.
Health data is the most sensitive data that exists. Here is exactly what we do to protect it.
Encryption at rest
Health data is encrypted at rest, and uploaded documents are encrypted with AES-256, the Advanced Encryption Standard, NIST, 2001, which is widely used across industry and government.
Encryption in transit
All data moving between your device and our servers is encrypted in transit. Your health conversations with Eva are private.
Access controls
Staff access to health data is strictly limited, role-based, and logged. Only engineers directly responsible for operating the service can access any data, and only when required.
Designed to support HIPAA
We implement administrative, physical, and technical safeguards aligned with HIPAA Security Rule requirements for Protected Health Information.
Regular security audits
We conduct regular security assessments and penetration testing. Vulnerabilities are triaged and resolved on a defined timeline based on severity.
Zero data sales
We do not sell your personal data or health information to any third party, including advertisers, data brokers, or pharmaceutical companies. Ever.
You own your data. Always.
At any time, you can download a full copy of your data from the app (Privacy, Download my data). At any time, you can delete your account and all associated data permanently. Deletion from production systems is completed within 30 days; deletion from backup systems within 90 days.
Family alerts and data sharing are always opt-in. You choose who sees what. We never share data with another family member unless you explicitly authorize it in your account settings.
If you share a doctor report, we send it only to the healthcare provider you specify. That report is not stored on our servers after delivery.
Built to the
highest standards.
Designed to support HIPAA, PIPEDA, GDPR, and CCPA requirements. Encrypted in transit and at rest. Built in Canada.
HIPAA
Health Insurance Portability and Accountability Act (USA). All Protected Health Information is handled under HIPAA-aligned policies and technical safeguards.
PIPEDA
Personal Information Protection and Electronic Documents Act (Canada). We comply with Canadian federal and BC provincial privacy requirements.
GDPR
General Data Protection Regulation (EU/EEA). Users in Europe have full rights under GDPR including access, deletion, and portability.
CCPA
California Consumer Privacy Act (USA). California users have additional rights including the right to know, delete, and opt out of data sales (we do not sell data).
Found a security issue?
We take security reports seriously. If you discover a security vulnerability in Cureva, please report it responsibly by emailing support@cureva.app with the subject line "Security Disclosure".
We will acknowledge your report within 48 hours, investigate promptly, and keep you informed of our progress. We do not pursue legal action against researchers who follow responsible disclosure principles.
Privacy built in
from day one.
Built for families who trust Eva with what matters most. Join the waitlist. 7-day trial, no card needed.
Eva supports, tracks, and informs. She does not diagnose or prescribe. Your doctor makes the decisions. Eva is an AI companion who can guide you, but she never gives medical advice.
Ready to try Eva?
Free 7-day trial included. Join the waitlist and your spot is reserved.