CuraWeight Consumer Health Data Privacy Policy

Effective date: October 2, 2026

This Consumer Health Data Privacy Policy explains how Curawe, Inc., a Delaware C-corporation located at 34159 Fremont Blvd #1019, Fremont, CA 94555 (curaweight.com) ("CuraWeight," "we," "us," or "our"), collects, uses, and discloses consumer health data through the CuraWeight mobile and web applications and related services (the "Service"), and the rights you have over that data.

This policy is provided to meet the requirements of the Washington My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (SB 370, NRS ch. 603A). It applies to consumers who reside in Washington or Nevada, or whose consumer health data is collected in those states. Our general Privacy Policy describes our practices for all other personal information. If this policy and the general Privacy Policy conflict with respect to consumer health data, this policy controls for consumers covered by these laws.

Categories of consumer health data we collect

Depending on how you use the Service, we collect the following categories of consumer health data:

• Health measurements you log, including body weight, body measurements, and progress photos.
• Medication information, including the weight-loss medication you take, dose amounts, and injection or dose records.
• Symptoms and side effects you record.
• Reproductive health information you choose to log or share, such as period days and flow, cycle length and pattern, and whether you are in perimenopause.
• Nutrition and consumption information, including food entries you type or describe, food photos you submit for analysis, scanned product barcodes, and water intake.
• Wellness entries, including sleep, mood, energy, and activity.
• Activity and body data you choose to import from Apple Health or Health Connect: steps, workouts, sleep, weight, body fat, lean body mass, heart rate, resting heart rate, and blood pressure.
• Health-related profile details you choose to provide, including height, age, sex, health conditions, health goals, and insurance details.
• Health information contained in your messages with Cura, our AI assistant.
• Information the Service derives from the data above, such as personalized insights, summaries, trend analyses, and documents you ask the Service to prepare (for example, provider-visit summaries and insurance appeal letters).

Purposes for collection and how the data is used

We collect and use consumer health data to provide the Service you request, specifically to:

• Store and display the health and medication information you log.
• Generate personalized insights, summaries, food analysis, and Cura chat responses.
• Prepare provider-visit and insurance-appeal documents when you request them.
• Provide customer support you request.
• Maintain the security, reliability, and integrity of the Service.
• Understand how the Service is used, through coarse usage signals described below, so we can improve it. You can turn this off at any time.
• Comply with legal obligations.

We do not use consumer health data for advertising, and we do not sell consumer health data.

Sources of consumer health data

We collect consumer health data from the following categories of sources:

• Directly from you, when you enter, upload, or send information in the Service.
• From your device with your permission, when you use the camera to scan a barcode or take a food or progress photo.
• From Apple Health or Health Connect, when you choose to connect them. We only read this data.
• Generated by the Service itself, when it produces insights, summaries, or analyses from the data you have provided.

Consumer health data we share, and with whom

We do not sell consumer health data. We do not share consumer health data with affiliates; Curawe, Inc. has no affiliates. We do not share consumer health data with third parties for their own purposes.

To operate the Service, we disclose consumer health data to service providers (processors) that act on our behalf under contracts that restrict their use of the data to providing services to us. The categories of processors are:

• AI providers that generate Cura chat responses, insights, analyses, and food-photo results from the data you submit.
• AI providers that match your questions to our clinical knowledge base.
• Sign-in providers, and hosting and app delivery providers, that store and transmit your data.
• An error monitoring provider, with health information excluded from error reports.
• Food databases that receive food search terms and barcodes, which are not sent with your identity.
• A product analytics provider that receives coarse usage signals after you agree to this policy: which path you chose when you signed up (taking a medication, about to start one, or no medication), which kind of entry you saved (food, weight, dose, exercise, or symptoms), and which screens, tools and home-screen cards you open. It never receives the values you enter, and it never receives period, cycle, or reproductive health information linked to you. For features that could reveal this (the period log, the PCOS guide, and the period, PCOS and contraception cards), and for home-screen cards that appear because of something in your health information (for example a weight plateau, symptoms you logged, or an upcoming appointment), it receives only weekly totals of how many devices used each one, together with weekly totals of active users whose profile sex is female and of active users who track periods. These totals carry no account identifier, device information, or IP address, are shared only when they include at least 5 devices, and we do not attempt to re-identify them. You can turn sharing off at any time in the app, in Profile under Privacy, which also stops these counts.

Our general Privacy Policy at curaweight.com/privacy describes what each kind of provider does and the data it receives. A current list of our service providers is available on request by emailing us at hello@curaweight.com.

If we ever propose to share consumer health data with a third party or an affiliate, we will first obtain your separate consent as required by law, and we will update this policy to list the categories of third parties and the specific affiliates involved.

Consent

We collect consumer health data only with your consent, or to the extent necessary to provide a service you have requested. We ask for your consent in the app before you begin logging health information, and we will obtain a new consent before collecting new categories of consumer health data or using your data for new purposes not described here.

We will obtain your separate consent before sharing consumer health data with any third party or affiliate, and a signed authorization before any sale of consumer health data. We do not sell consumer health data, so no such authorization is requested.

You may withdraw your consent at any time as described below.

Your rights

If you are a consumer covered by the Washington My Health My Data Act or Nevada's consumer health data law, you have the right to:

• Confirm and access. Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data, including a list of all third parties and affiliates with whom we have shared or sold it and contact information for each. Currently that list is empty, because we do not share or sell consumer health data with third parties or affiliates.
• Withdraw consent. Withdraw your consent to our collection or sharing of your consumer health data.
• Delete. Request deletion of your consumer health data. When you make a verified deletion request, we delete the data from our production systems at that time, residual copies in encrypted backups are purged within 60 days through our backup rotation, and we instruct our processors to delete it as well.
• Non-discrimination. Exercise these rights without being discriminated against.

How to exercise your rights

You can exercise these rights by:

• Emailing us at hello@curaweight.com from the email address associated with your CuraWeight account, or
• Using the controls in the app. Account deletion is available in the Profile area under account settings, and deleting your account deletes the consumer health data associated with it.

We will authenticate your request using information associated with your account. You will not be required to create a new account to exercise your rights, though we may ask you to use your existing account to verify your identity. We will respond within the timeframes required by law, generally within 45 days, with one permitted extension of 45 days where reasonably necessary, in which case we will notify you before the initial period ends.

Appeals

If we decline to act on your request, you may appeal by replying to our response or by emailing us at hello@curaweight.com with "Appeal" in the subject line. We will respond to your appeal in writing within the time required by law, generally 45 days, with an explanation of our decision. If your appeal is denied:

• Washington consumers may contact the Washington Attorney General to submit a complaint at www.atg.wa.gov.
• Nevada consumers may contact the Office of the Nevada Attorney General at ag.nv.gov.

Changes to this policy

If we make material changes to this policy, including collecting new categories of consumer health data or using consumer health data for new purposes, we will update the effective date, provide notice through the Service, and obtain any consent the law requires before the new collection or use begins.

Contact us

Curawe, Inc., attn: Privacy 34159 Fremont Blvd #1019 Fremont, CA 94555 hello@curaweight.com