Last updated: August 7, 2026. Effective for all Cureva users worldwide.
Cureva is operated by Lumina Path Inc., incorporated in British Columbia, Canada. Our address for privacy matters is: [email protected]. We are the data controller for all personal information collected through the Cureva app and website.
When you create a Cureva account, we collect your name, email address, and the password you choose. We may also collect your date of birth, which helps Eva personalize check-ins appropriately.
To provide our core service, Cureva collects health-related information you voluntarily provide, including: medication names, dosages, and schedules; vitals you log (blood pressure, heart rate, weight, glucose); symptoms and notes you share with Eva during check-ins; and health conditions you choose to disclose. This is considered Protected Health Information (PHI) under HIPAA and Personal Health Information under PIPEDA.
If you add family members or caregivers to your account, we collect their names, email addresses, and the notification preferences you set for them. Family members must consent before receiving any alerts.
We collect standard app usage data including pages visited, features used, session duration, and device type. This data is used in aggregate only, never linked to your health information.
When you contact us at [email protected], we retain those communications to assist you and improve our service.
For users in the European Economic Area, we process your data under the following legal bases: contract performance (to provide the service you signed up for); your explicit consent (for health data processing and communications); and legitimate interests (for security, fraud prevention, and product improvement using anonymized data only).
We do not sell your personal information. We do not share your health information with advertisers. We share information only in the following limited circumstances:
All data transmitted between the Cureva app and our servers is encrypted using TLS 1.3. All health data stored in our systems is encrypted at rest using AES-256. We conduct regular security audits and penetration testing. Access to health data by Cureva staff is strictly limited and logged.
We comply with HIPAA security rule requirements including administrative, physical, and technical safeguards for all Protected Health Information.
We retain your account information and health data for as long as your account is active, or as required by law. When you delete your account, your personal information and health data are permanently deleted within 30 days from our production systems and within 90 days from backup systems.
Depending on your location, you have the following rights regarding your personal information:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
HIPAA (USA): Cureva adheres to all HIPAA Privacy and Security Rule requirements for Protected Health Information.
PIPEDA (Canada): We comply with the Personal Information Protection and Electronic Documents Act and applicable provincial privacy legislation in British Columbia.
GDPR (EU/EEA): We comply with the General Data Protection Regulation for users in the European Economic Area. You may lodge a complaint with your local supervisory authority.
CCPA (California): California residents have additional rights under the California Consumer Privacy Act, including the right to know, delete, and opt out of sale (we do not sell personal information).
The Cureva website uses essential cookies (required for the site to function) and analytics cookies (to understand how visitors use our site). You may decline analytics cookies via the cookie banner. We do not use tracking cookies for advertising purposes.
Cureva is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us immediately at [email protected] and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice in the app at least 30 days before the change takes effect.
For privacy questions, requests, or concerns, contact us at [email protected]. We respond to all privacy inquiries within 30 days.