Version française

CuraWeight Privacy Policy

Effective date: October 2, 2026

1. Who we are and what this policy covers

CuraWeight is a health information app operated by Curawe, Inc., a Delaware C-corporation ("CuraWeight," "we," "us," or "our"). Our business address is 34159 Fremont Blvd #1019, Fremont, CA 94555, and our website is curaweight.com. The Service is currently offered to users located in the United States and Canada. If you live in Canada, Section 13 also applies to you.

This Privacy Policy explains what information we collect when you use the CuraWeight mobile and web applications and related services (together, the "Service"), how we use that information, who we share it with, and the choices and rights you have. It applies to all users of the Service.

CuraWeight helps people who are losing or maintaining weight, with or without medication, track their progress and understand their data, and it includes an AI assistant named "Cura" that produces personalized information. CuraWeight provides information, not medical advice. It does not diagnose, prescribe, or recommend dosage changes, and it is not a substitute for care from a qualified healthcare provider.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information we collect

We collect the following categories of information.

2.1 Account information

When you create an account, we collect:

• Your email address.
• Your display name.
• Your authentication provider (for example, whether you signed up with email and password, Sign in with Apple, or Google Sign-In).
• Session and authentication tokens used to keep you signed in.

If you sign in with Google, we receive basic Google account identity information (such as your email address and name) through that sign-in process. If you sign in with Apple, we receive your name and your email address, or Apple's private relay email address if you choose to hide your email, along with an Apple account identifier.

2.2 Health and medication information you provide

The Service is designed for you to log health-related information. Depending on how you use it, this may include:

• Body weight and body measurements.
• The weight-loss medication you take, if any, your dose, and your dose records.
• Side effects and symptoms you record.
• Period and cycle information you choose to log or share, such as period days and flow, cycle length and pattern, and whether you are in perimenopause.
• Food entries, including descriptions you type, food search terms, scanned product barcodes, and food photos you submit for analysis.
• Water intake, sleep, mood, and energy entries.
• Progress photos and other notes or measurements you choose to add.
• Information you enter in your profile (for example, height, age, sex, conditions, goals, and insurance details you choose to provide).
• The messages you send to Cura and the content of your conversations.

You decide what to enter. Some of this information is health-related and sensitive, and we treat it accordingly (see Section 8, Security).

2.3 Usage and device information

When you use the Service, we and our service providers may automatically collect technical information, such as:

• Device and app information (for example, device type, operating system, and app version).
• Diagnostic and error information, including crash reports and performance measurements, used to keep the Service reliable.
• General usage information about how features are used.

We aim to limit diagnostic data to what is needed to operate and improve the Service, and we instruct our error-monitoring provider to exclude health information from error reports.

Product analytics. After you create an account and agree to our Consumer Health Data Privacy Policy, the app sends usage events to our product analytics provider so we can see which features help people and where they get stuck. These events record what you did, not what you entered: for example, which path you chose when you signed up, which kind of entry you saved (such as food or weight), and which screens, tools and home-screen cards you open. They never include your weight, doses, foods, symptoms, conditions, medication names, period or cycle information, messages, photos, or the text you type. You can turn this off at any time in the app, in Profile under Privacy.

Sign-up progress before you have an account. Before you create an account, the app counts how far people get through the sign-up questions, in aggregate form, on our own servers. A count records only the path, the sex you selected (if any), and the question screen reached. We do not store an identifier, device information, or IP address with these counts, and we share only weekly totals that include at least 5 people. We do not attempt to re-identify these counts.

Weekly counts for sensitive features. Some features could reveal your sex, your reproductive health, or something about your health if their use were linked to you: the period log, the PCOS guide, the period, PCOS and contraception cards on the home screen, and home-screen cards that appear because of something in your health information (for example a weight plateau, symptoms you logged, or an upcoming appointment). The app never sends product analytics events about these features. Instead, the first time a device uses one of them in a week, the app adds one to a weekly count on our own servers. To put those counts in context, the app also adds one, once a week, to a count of active users whose profile sex is female and a count of active users who track periods. Your device remembers which counts it has already added that week, and forgets this when you sign out. A count records only the feature or group it belongs to. We do not store an account identifier, device information, or IP address with these counts, and we share only weekly totals that include at least 5 devices with our product analytics provider. We do not attempt to re-identify these counts. These counts are made only after you agree to our Consumer Health Data Privacy Policy, and they stop when you turn off sharing in Profile under Privacy.

Our website. curaweight.com counts page views without cookies. It records only which kind of page was viewed (the home page, a guide, About, or a legal page), not the page address, where you came from, or anything you type.

2.4 Subscription information

If you purchase a subscription, the purchase itself is processed by the Apple App Store or Google Play. We and our subscription service receive your subscription and entitlement status and store receipt information tied to an app user identifier. We do not receive your payment card details.

2.5 Data you import from Apple Health or Health Connect

If you choose to connect Apple Health or Health Connect, we read the following data, with your permission: steps, workouts, sleep, weight, body fat, lean body mass, heart rate, resting heart rate, and blood pressure. We use it the same way as data you log yourself. We only read this data. We never write to Apple Health or Health Connect, never use this data for advertising, and never sell it. You can turn off access at any time in your phone's settings.

3. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the Service, including creating and securing your account.
• Store and display the health and medication information you log.
• Generate personalized insights, summaries, food analysis, and chat responses through Cura.
• Provide customer support and respond to your requests.
• Monitor, troubleshoot, and improve the reliability, quality, and security of the Service.
• Understand how features are used, as described in Section 2.3, so we can improve the Service.
• Process subscriptions and billing for paid plans (see Section 4).
• Comply with legal obligations and enforce our terms.

We do not use your health information to make automated decisions that produce legal or similarly significant effects about you.

4. Third parties and sub-processors

To deliver the Service, we rely on third-party service providers ("sub-processors") that process information on our behalf and under our instructions. The table below lists the kinds of providers we use or intend to use, what each does for us, and the category of data that flows to each based on how the Service is built. A current list of our service providers is available on request by emailing us at hello@curaweight.com.

Food search in the app is powered by the fatsecret Platform API (platform.fatsecret.com).

We require our sub-processors to handle information consistently with this policy and to process it only as needed to provide their service to us. We do not authorize them to use your health information for their own purposes.

5. Third-party AI processing disclosure

CuraWeight uses third-party artificial intelligence providers to power Cura and related features. When you use these features, the text and images you submit may be sent to AI model providers to generate a response:

• When you chat with Cura or generate insights, summaries, side-effect analysis, provider-prep documents, or appeal letters, your messages and the relevant health-data context are sent to our AI model providers for processing.
• When you submit a food photo or food description, the image data and related text are sent to our AI model providers for analysis.
• When you ask Cura a question, your question is also sent to our AI providers to search our clinical library for relevant passages.

These providers process this information on our behalf to deliver the requested feature. We seek contractual terms that restrict each provider's use of your information to providing the service to us. Please avoid entering information you do not want processed by these providers, and remember that Cura provides information, not medical advice.

6. Data retention

We retain your information for as long as your account is active and as needed to provide the Service. When you delete your account, the personal information associated with it is deleted from our production systems at that time, and residual copies in encrypted backups are purged within 60 days through our backup rotation. We may retain limited records where the law requires it (for example, records of subscription transactions for tax and accounting purposes) and a minimal deletion record that does not identify you.

7. California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the following rights regarding your personal information:

• Right to know and access: You may request the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete: You may request that we delete personal information we collected from you, subject to certain exceptions permitted by law.
• Right to correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: You may direct us not to sell or share your personal information.
• Right to limit use of sensitive personal information: You may direct us to limit the use of sensitive personal information to what is necessary to provide the Service.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

Sale and sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

How to exercise your rights. You may submit a request by contacting us at the address in Section 11. We will verify your request, typically by confirming information associated with your account, before responding. You may use an authorized agent to submit a request on your behalf, subject to verification. We will respond within the timeframes required by law (generally within 45 days, with one permitted extension), and we will not charge a fee for a verifiable request unless it is excessive or repetitive.

Washington and Nevada residents. If you are a Washington or Nevada consumer, our separate Consumer Health Data Privacy Policy, available at curaweight.com/consumer-health-data, describes our practices for consumer health data and the additional rights available to you under those states' laws.

8. Security

We use industry best practices for health data security to protect your information. This includes:

• Encryption of data in transit using TLS, and encryption of data at rest.
• Access controls that limit who can access stored information.
• Instructions to our error-monitoring provider to exclude health information from diagnostic data.
• Ongoing monitoring and safeguards intended to protect the confidentiality and integrity of your information.

Support access. Authorized CuraWeight administrators can view your account in read-only mode only when you allow it by reporting a problem, for up to 14 days or until we finish looking into that report, whichever comes first, or in limited emergency cases (a suspected break-in to your account, a safety concern, or a legal obligation) with a recorded reason. We log who viewed the account, when, and which parts of the app they opened. Screenshots you attach to a problem report are stored by us and deleted 30 days after we resolve the report, or 90 days after you filed it if it is still open.

No app or online service can promise perfect security, and we cannot guarantee that your information will never be accessed in a way this policy does not intend. CuraWeight is a consumer health information app. It is not a HIPAA-covered entity, and this policy does not represent that the Service is subject to HIPAA.

9. Children

The Service is not directed to anyone under 18 years of age, and we do not knowingly collect personal information from children. You must be at least 18 years old to create an account, and we ask you to confirm this when you sign up. If you believe a child has provided us with personal information, please contact us at the address in Section 11 and we will take steps to delete it.

10. How to delete your account and your data

You can delete your account from within the app. In the Profile area, open account settings and choose the delete-account option, then confirm as prompted.

When you delete your account, the personal information associated with it, including your health entries, chat history, photos, and profile, is permanently deleted from our production systems, and your sign-in record is removed from our sign-in provider. Residual copies in encrypted backups are purged within 60 days through our backup rotation, and we direct our service providers to delete personal information they process for us. We keep a minimal deletion record that does not identify you, and we may retain limited information where the law requires it (for example, records of subscription transactions).

Deleting your account does not cancel an active subscription. Manage or cancel subscriptions through your Apple App Store or Google Play account settings. You may also contact us using the information in Section 11 for help with a deletion request.

11. Contact us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Curawe, Inc., attn: Privacy 34159 Fremont Blvd #1019 Fremont, CA 94555 hello@curaweight.com

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date below and, where appropriate, provide additional notice through the Service. Your continued use of the Service after an update means you accept the revised policy.

13. Residents of Canada

If you live in Canada, this section applies to you in addition to the rest of this policy. We handle your personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA), and, if you live in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, along with any other provincial privacy law that applies to you.

Person in charge of protecting personal information. Prash Jain, Co-founder and Chief Technology Officer of Curawe, Inc., is responsible for the protection of personal information at CuraWeight. You can reach this person at hello@curaweight.com, with "Privacy" in the subject line, or by mail at the address in Section 11.

Consent. We collect, use and share your personal information with your consent, for the purposes described in this policy, or as the law otherwise allows or requires. Your health information is sensitive, so we ask for your express consent before we store it in your account: you give it at sign-up, and you decide what you enter. You can turn off product analytics at any time in Profile under Privacy.

Plan preview before you have an account. Before you sign up, the app shows you a plan built from your quiz answers, such as your weight, goal, medication, dose and the concerns you pick. To build it, the app sends those answers to our servers, and our servers send them, or numbers worked out from them, to our AI model providers (Section 5) to write a short paragraph about your plan. We do not store your answers with anything that identifies you. The paragraph is saved and reused for anyone whose answers give the same medication, dose and concerns, the same answer about tracking a menstrual cycle, the same answers to a few other questions, and the same targets worked out from their weight and goal, such as daily water and protein. It is saved with the path you chose, but not with your other answers or with anything that identifies you. Your IP address is kept for up to 24 hours to limit how often a preview can be asked for. Apart from this preview and the sign-up counts described in Section 2.3, your answers stay on your device until you create an account, and they are saved to your account only after you give the consent above.

Withdrawing consent. You can withdraw your consent at any time, subject to legal or contractual limits: turn off sharing in Profile under Privacy, disconnect Apple Health or Health Connect in your phone's settings, delete entries, or delete your account (Section 10). If you withdraw a consent we need to provide a feature, we may no longer be able to provide it.

Where your information is stored. We are based in the United States. Our service providers, listed by kind in Section 4, store and process your information in the United States and may do so in other countries. While it is there, it is subject to the laws of those countries, and their courts, law enforcement and national security authorities may be able to obtain it. We use contracts and other safeguards to protect your information when a service provider handles it for us.

Your rights. Subject to the exceptions the law allows, you can:

• Ask whether we hold personal information about you, see it, and learn how we use it and who we share it with.
• Ask us to correct information that is inaccurate, incomplete or out of date. You can also correct most of it yourself in your profile.
• Withdraw your consent, as described above.
• Get a copy of the personal information you gave us, in a structured, commonly used technological format. You can also export your data in the app, in Profile.
• Ask us to delete your personal information. You can also delete your account in the app (Section 10).

To make a request, write to the person in charge of protecting personal information at hello@curaweight.com. We may ask you to confirm your identity first. We will answer within 30 days, and we will not charge you for a reasonable request.

Automated decisions. We do not make decisions about you based only on automated processing of your personal information.

Confidentiality incidents. If an incident involving your personal information creates a risk of serious harm to you, we will tell you, and we will report it to the privacy authorities, as the law requires.

Complaints. If you are not satisfied with how we handled your request or your information, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you live in Quebec, to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). If you live in Alberta or British Columbia, you can also contact the privacy commissioner of your province.

Language. This policy is available in French and in English, in the app and on our website (curaweight.com/fr/privacy).

Effective date: October 2, 2026