CuraWeight Consumer Health Data Privacy Policy

Effective date: July 2, 2026

This Consumer Health Data Privacy Policy explains how Curawe, Inc., a Delaware C-corporation located at 34159 Fremont Blvd #1019, Fremont, CA 94555 (curaweight.com) ("CuraWeight," "we," "us," or "our"), collects, uses, and discloses consumer health data through the CuraWeight mobile and web applications and related services (the "Service"), and the rights you have over that data.

This policy is provided to meet the requirements of the Washington My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (SB 370, NRS ch. 603A). It applies to consumers who reside in Washington or Nevada, or whose consumer health data is collected in those states. Our general Privacy Policy describes our practices for all other personal information. If this policy and the general Privacy Policy conflict with respect to consumer health data, this policy controls for consumers covered by these laws.

Categories of consumer health data we collect

Depending on how you use the Service, we collect the following categories of consumer health data:

• Health measurements you log, including body weight, body measurements, and progress photos.
• Medication information, including the weight-loss medication you take, dose amounts, and injection or dose records.
• Symptoms and side effects you record.
• Nutrition and consumption information, including food entries you type or describe, food photos you submit for analysis, scanned product barcodes, and water intake.
• Wellness entries, including sleep, mood, energy, and activity.
• Health-related profile details you choose to provide, including height, age, sex, health conditions, health goals, and insurance details.
• Health information contained in your messages with Cura, our AI assistant.
• Information the Service derives from the data above, such as personalized insights, summaries, trend analyses, and documents you ask the Service to prepare (for example, provider-visit summaries and insurance appeal letters).

Purposes for collection and how the data is used

We collect and use consumer health data to provide the Service you request, specifically to:

• Store and display the health and medication information you log.
• Generate personalized insights, summaries, food analysis, and Cura chat responses.
• Prepare provider-visit and insurance-appeal documents when you request them.
• Provide customer support you request.
• Maintain the security, reliability, and integrity of the Service.
• Comply with legal obligations.

We do not use consumer health data for advertising, and we do not sell consumer health data.

Sources of consumer health data

We collect consumer health data from the following categories of sources:

• Directly from you, when you enter, upload, or send information in the Service.
• From your device with your permission, when you use the camera to scan a barcode or take a food or progress photo.
• Generated by the Service itself, when it produces insights, summaries, or analyses from the data you have provided.

Consumer health data we share, and with whom

We do not sell consumer health data. We do not share consumer health data with affiliates; Curawe, Inc. has no affiliates. We do not share consumer health data with third parties for their own purposes.

To operate the Service, we disclose consumer health data to service providers (processors) that act on our behalf under contracts that restrict their use of the data to providing services to us. The categories of processors are:

• Artificial intelligence providers that generate Cura chat responses, insights, analyses, and food-photo results from the data you submit.
• Retrieval providers that match your questions to our clinical knowledge base.
• Authentication and cloud hosting providers that store and transmit your data.
• A diagnostics provider for error monitoring, with health information excluded from error reports.
• Food-data providers that receive food search terms and barcodes, which are not sent with your identity.

The current named list of these providers appears in the sub-processor table in our general Privacy Policy at curaweight.com/privacy.

If we ever propose to share consumer health data with a third party or an affiliate, we will first obtain your separate consent as required by law, and we will update this policy to list the categories of third parties and the specific affiliates involved.

Consent

We collect consumer health data only with your consent, or to the extent necessary to provide a service you have requested. We ask for your consent in the app before you begin logging health information, and we will obtain a new consent before collecting new categories of consumer health data or using your data for new purposes not described here.

We will obtain your separate consent before sharing consumer health data with any third party or affiliate, and a signed authorization before any sale of consumer health data. We do not sell consumer health data, so no such authorization is requested.

You may withdraw your consent at any time as described below.

Your rights

If you are a consumer covered by the Washington My Health My Data Act or Nevada's consumer health data law, you have the right to:

• Confirm and access. Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data, including a list of all third parties and affiliates with whom we have shared or sold it and contact information for each. Currently that list is empty, because we do not share or sell consumer health data with third parties or affiliates.
• Withdraw consent. Withdraw your consent to our collection or sharing of your consumer health data.
• Delete. Request deletion of your consumer health data. When you make a verified deletion request, we delete the data from our production systems at that time, residual copies in encrypted backups are purged within 60 days through our backup rotation, and we instruct our processors to delete it as well.
• Non-discrimination. Exercise these rights without being discriminated against.

How to exercise your rights

You can exercise these rights by:

• Emailing us at hello@curaweight.com from the email address associated with your CuraWeight account, or
• Using the controls in the app. Account deletion is available in the Profile area under account settings, and deleting your account deletes the consumer health data associated with it.

We will authenticate your request using information associated with your account. You will not be required to create a new account to exercise your rights, though we may ask you to use your existing account to verify your identity. We will respond within the timeframes required by law, generally within 45 days, with one permitted extension of 45 days where reasonably necessary, in which case we will notify you before the initial period ends.

Appeals

If we decline to act on your request, you may appeal by replying to our response or by emailing us at hello@curaweight.com with "Appeal" in the subject line. We will respond to your appeal in writing within the time required by law, generally 45 days, with an explanation of our decision. If your appeal is denied:

• Washington consumers may contact the Washington Attorney General to submit a complaint at www.atg.wa.gov.
• Nevada consumers may contact the Office of the Nevada Attorney General at ag.nv.gov.

Changes to this policy

If we make material changes to this policy, including collecting new categories of consumer health data or using consumer health data for new purposes, we will update the effective date, provide notice through the Service, and obtain any consent the law requires before the new collection or use begins.

Contact us

Curawe, Inc., attn: Privacy 34159 Fremont Blvd #1019 Fremont, CA 94555 hello@curaweight.com