Privacy Policy

1. Overview

This Privacy Policy explains what information Curavo collects, how it's used, who it's shared with, and the choices you have. Curavo is built by Crestline AI LLC ("Crestline AI," "we," "us"). It's written to describe, plainly, how the app actually works today.

2. Information We Collect

Account information. Your email address, which we use to send you a one-time sign-in link. We don't collect or store a password.

Health-related information you enter. Anything you choose to add to Curavo: profile details, medications and dosages, symptoms, check-in responses, and any AI-generated summaries or reports based on that information.

Technical information. Standard web server logs (like IP address and browser type) generated automatically when you use the site, kept only for security and troubleshooting.

We do not currently collect payment information, since Curavo is free to use.

3. Information About Someone You Care For

If you enter medication or health information about someone you care for rather than yourself, we treat that information the same way we treat your own — stored under your account, accessible only to you. By entering it, you're confirming you have that person's permission or the legal authority to do so, as described in our Terms of Service.

4. How We Use Your Information

We use the information you provide to:

Operate your account and let you sign in;
Generate the medication summaries, interaction alerts, symptom assessments, and reports Curavo provides;
Maintain and improve the reliability and safety of the Service;
Communicate with you about your account (for example, sign-in emails).

We do not use your health information for advertising, and we do not sell it.

5. AI Processing (Anthropic)

When you ask Curavo to analyze your medications or symptoms, the relevant information is sent to Anthropic's Claude API to generate that analysis. Anthropic processes this information to return a response to Curavo and, per Anthropic's own policies at the time this was written, does not use API data submitted this way to train its models. Anthropic acts as our data processor for this specific purpose — it doesn't have its own independent use of your data outside of generating the response Curavo requested.

6. Where Your Data Is Stored

Your Curavo data is stored in a database hosted by Supabase (built on PostgreSQL). Access is restricted at the database level so that only your signed-in account can read or write your own records — not other Curavo users, and not Crestline AI staff browsing casually. The application itself runs on Render. Both Supabase and Render are our infrastructure subprocessors: they host the systems Curavo runs on, and don't use your data for their own purposes.

We share information only with:

The subprocessors named above (Anthropic, Supabase, Render) — solely to provide the Service to you;
Law enforcement or regulators, if required by valid legal process;
A successor organization, if Crestline AI is ever acquired or merges — you'd be notified and this Policy would continue to apply.

We do not sell your information to data brokers or advertisers, and we do not share it for third-party marketing.

8. Export, Deletion & Retention

You can export your data or permanently delete it at any time from within the app. Deleting your data removes your stored record from our database; it is not recoverable afterward. We keep minimal technical logs (Section 2) for a limited time for security purposes even after account deletion.

9. Security

Data is encrypted in transit (HTTPS) between your device, Curavo's servers, and our subprocessors. Sign-in uses passwordless email links rather than stored passwords, and access to your data is restricted at the database level to your account only. No system is perfectly secure, and we can't guarantee absolute security — but we've designed Curavo so that no password exists to be stolen, and so that a bug in one user's session can't expose another user's records by default.

10. Cookies & Tracking

Curavo does not use third-party advertising or analytics trackers. We use only the minimum technical cookies/tokens needed to keep you signed in (managed by our authentication provider, Supabase).

11. Children's Privacy

Curavo is intended for adults (18+). It is not directed at children, and we don't knowingly collect information directly from children. A parent or guardian may use Curavo to track a child's medications as part of their caregiving, under the terms in Section 3.

12. Your Privacy Rights

Beyond the export and deletion controls in Section 8, you may have additional rights depending on where you live — for example under California's CCPA/CPRA, or health-data-specific state laws like Washington's My Health My Data Act. This section needs attorney input to confirm which state-specific disclosures Curavo is required to include, and whether Curavo's data practices (in particular, use of a third-party AI processor for health-adjacent data) trigger any state health-data-specific consent or opt-out requirements.

Separately: Crestline AI LLC should confirm with an attorney whether HIPAA applies to Curavo. As a direct-to-consumer app that isn't operating on behalf of a doctor, hospital, insurer, or other covered entity, Curavo likely falls outside HIPAA's definition of a "covered entity" or "business associate" today — but this should be confirmed, and revisited if Curavo ever sells to or integrates with healthcare providers.

13. Changes to This Policy

We may update this Privacy Policy as Curavo changes. If we make material changes, we'll notify you by email or an in-app notice before they take effect.

14. Contact Us

Questions about this Policy or your data? Email us at privacy@mycuravo.com.