This policy describes the consumer health data that Curialis Technologies, LLC (“Curialis,” “we”) collects through the Curialis Health Companion (the “Application”), how we use and share it, and how you can exercise your rights. It is our consumer health data privacy policy for the purposes of Washington’s My Health My Data Act (RCW 19.373) and similar state laws. It supplements our Privacy Policy at curialishealth.com/privacy; where the two differ about consumer health data, this policy governs.
1. The consumer health data we collect, and why
| Category | Examples | How we use it |
|---|---|---|
| Measurements you log or import | Examples: Blood pressure, resting heart rate, weight, blood oxygen saturation, blood glucose, and other biometric measurements | How we use it: To record them, show them back to you, and describe patterns in your own data when you ask |
| Nutrition | Examples: Meal logs, food and beverage intake, calorie and sodium estimates | How we use it: To record what you eat and answer your questions about it |
| Activity and sleep | Examples: Exercise sessions, steps, workout duration and intensity, sleep duration and quality | How we use it: To record them and describe how they relate to your other data |
| Well-being | Examples: Stress, mood and energy entries; notes you write; answers to the PHQ-2 and GAD-2 questionnaires if you complete them | How we use it: To record them and reflect them back to you; private notes are not read by the AI |
| Health information you choose to tell us | Examples: Conditions, medications, treatment plans, and instructions from your care team, in your own words | How we use it: To remember what you asked us to remember, and to follow instructions you set, such as a threshold you ask to be told about |
| Conversations | Examples: Text or voice you send to the Companion, which may contain any of the above | How we use it: To answer you and keep the context of your conversations |
| Information we create from the above | Examples: Summaries and observations about your own data; safety records created when you describe an emergency | How we use it: To give you summaries you request, and to keep a record of emergency instructions shown to you |
We also use consumer health data, with personal identifiers removed, to review how the Application is performing, and to keep it secure. We do not sell consumer health data, use it for advertising, or use it to train AI models.
2. Where it comes from
- Directly from you, when you log, write, speak, or upload.
- From Apple Health and connected devices, in the categories you authorize. The connection is read-only.
- From the Application itself, which creates summaries, observations and safety records from the above.
3. Who receives it
We share consumer health data only with:
- Service providers that operate the Application for us, under contract: Amazon Web Services (AI processing through Amazon Bedrock), which receives the content needed for each AI request, meaning your messages and the relevant wellness values; Supabase (database and sign-in), which stores the information described above; and Vercel (application hosting), through whose infrastructure it passes. Our analytics, email and push-notification providers receive no consumer health data.
- People you choose: when you create a share link or otherwise direct us to send information to someone, they receive the categories you select.
We have no affiliates that receive consumer health data, and we do not share it with advertisers or data brokers. When you look up a food, only the search text or barcode is sent to USDA FoodData Central or Open Food Facts; no consumer health data is sent.
4. Your rights
You have the right to:
- confirm whether we collect, share or sell your consumer health data;
- access that data, including a list of every third party and affiliate with whom we have shared it, with an active email address or other online way to contact each one;
- withdraw your consent to our collection and sharing of it;
- have it deleted, including from archived or backup systems. We will also tell our service providers to delete it; and
- exercise these rights without being treated differently for doing so.
5. How to exercise them
- In the app: edit, remove or export your entries, revoke share links, or delete your account (Settings → Delete account).
- By email: write to privacy@curialishealth.com from the email address on your account, so that we can confirm the request is yours.
We respond within 45 days of receiving your request. If we need more time, we will tell you within those 45 days and take no more than 45 more. Requests are free up to twice in any 12 months.
If we decline a request, we will tell you why. You may appeal by replying to our response with the word “Appeal.” We will answer your appeal in writing within 45 days and explain our decision. If we deny your appeal, you may contact the Washington State Office of the Attorney General at atg.wa.gov to file a complaint.
6. Consent
We collect consumer health data with your consent, for the purposes described in section 1, and to the extent necessary to provide the features you request. We will not share it with anyone other than the service providers and the people you choose, as described in section 3, without first asking for your separate consent. You may withdraw consent at any time by removing the data or deleting your account. If we want to collect or use consumer health data for a purpose not described here, we will tell you and ask first.
7. Deletion and residual copies
When you delete data or your account, it is deleted from our production database at once. We do not keep separate backups of it. Copies held by our service providers clear on their own schedules: our email provider keeps delivery logs for up to 30 days, and our AI provider does not store the content of AI requests.
8. Contact
Curialis Technologies, LLC · P.O. Box 41 · West Jefferson, North Carolina 28694 · privacy@curialishealth.com
9. Changes
We will post any change to this policy on this page with a new effective date. If a change would let us collect or share consumer health data in a new category or for a new purpose, we will ask for your consent first.