CuraWeight Privacy Policy

Effective date: July 2, 2026

1. Who we are and what this policy covers

CuraWeight is a health information app operated by Curawe, Inc., a Delaware C-corporation ("CuraWeight," "we," "us," or "our"). Our business address is 34159 Fremont Blvd #1019, Fremont, CA 94555, and our website is curaweight.com. The Service is currently offered to users located in the United States.

This Privacy Policy explains what information we collect when you use the CuraWeight mobile and web applications and related services (together, the "Service"), how we use that information, who we share it with, and the choices and rights you have. It applies to all users of the Service.

CuraWeight helps people who use weight-loss medications track their progress and understand their data, and it includes an AI assistant named "Cura" that produces personalized information. CuraWeight provides information, not medical advice. It does not diagnose, prescribe, or recommend dosage changes, and it is not a substitute for care from a qualified healthcare provider.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information we collect

We collect the following categories of information.

2.1 Account information

When you create an account, we collect:

• Your email address.
• Your display name.
• Your authentication provider (for example, whether you signed up with email and password, Sign in with Apple, or Google Sign-In).
• Session and authentication tokens used to keep you signed in.

If you sign in with Google, we receive basic Google account identity information (such as your email address and name) through that sign-in process. If you sign in with Apple, we receive your name and your email address, or Apple's private relay email address if you choose to hide your email, along with an Apple account identifier.

2.2 Health and medication information you provide

The Service is designed for you to log health-related information. Depending on how you use it, this may include:

• Body weight and body measurements.
• The weight-loss medication you take, the dose, and your injection records.
• Side effects and symptoms you record.
• Food entries, including descriptions you type, food search terms, scanned product barcodes, and food photos you submit for analysis.
• Water intake, sleep, mood, and energy entries.
• Progress photos and other notes or measurements you choose to add.
• Information you enter in your profile (for example, height, age, sex, conditions, goals, and insurance details you choose to provide).
• The messages you send to Cura and the content of your conversations.

You decide what to enter. Some of this information is health-related and sensitive, and we treat it accordingly (see Section 8, Security).

2.3 Usage and device information

When you use the Service, we and our service providers may automatically collect technical information, such as:

• Device and app information (for example, device type, operating system, and app version).
• Diagnostic and error information, including crash reports and performance measurements, used to keep the Service reliable.
• General usage information about how features are used.

We aim to limit diagnostic data to what is needed to operate and improve the Service, and we instruct our error-monitoring provider to exclude health information from error reports.

2.4 Subscription information

If you purchase a subscription, the purchase itself is processed by the Apple App Store or Google Play. We and our subscription manager receive your subscription and entitlement status and store receipt information tied to an app user identifier. We do not receive your payment card details.

3. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the Service, including creating and securing your account.
• Store and display the health and medication information you log.
• Generate personalized insights, summaries, food analysis, and chat responses through Cura.
• Provide customer support and respond to your requests.
• Monitor, troubleshoot, and improve the reliability, quality, and security of the Service.
• Process subscriptions and billing for paid plans (see Section 4).
• Comply with legal obligations and enforce our terms.

We do not use your health information to make automated decisions that produce legal or similarly significant effects about you.

4. Third parties and sub-processors

To deliver the Service, we rely on third-party service providers ("sub-processors") that process information on our behalf and under our instructions. The table below lists the providers we use or intend to use, the purpose, and the category of data that flows to each based on how the Service is built.

We require our sub-processors to handle information consistently with this policy and to process it only as needed to provide their service to us. We do not authorize them to use your health information for their own purposes.

5. Third-party AI processing disclosure

CuraWeight uses third-party artificial intelligence providers to power Cura and related features. When you use these features, the text and images you submit may be sent to AI model providers to generate a response:

• When you chat with Cura or generate insights, summaries, side-effect analysis, provider-prep documents, or appeal letters, your messages and the relevant health-data context are sent to our AI provider for processing.
• When you submit a food photo or food description, the image data and related text may be sent to an AI provider for analysis, including a fallback provider if the primary analysis returns no result.
• When you ask Cura a clinical question, your query text may be sent to retrieval and reranking providers to find relevant passages from our clinical knowledge base.

These AI providers process this information on our behalf to deliver the requested feature. We seek contractual terms that restrict each provider's use of your information to providing the service to us. Please avoid entering information you do not want processed by these providers, and remember that Cura provides information, not medical advice.

6. Data retention

We retain your information for as long as your account is active and as needed to provide the Service. When you delete your account, the personal information associated with it is deleted from our production systems at that time, and residual copies in encrypted backups are purged within 60 days through our backup rotation. We may retain limited records where the law requires it (for example, records of subscription transactions for tax and accounting purposes) and a minimal deletion record that does not identify you.

7. California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the following rights regarding your personal information:

• Right to know and access: You may request the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete: You may request that we delete personal information we collected from you, subject to certain exceptions permitted by law.
• Right to correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: You may direct us not to sell or share your personal information.
• Right to limit use of sensitive personal information: You may direct us to limit the use of sensitive personal information to what is necessary to provide the Service.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

Sale and sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

How to exercise your rights. You may submit a request by contacting us at the address in Section 11. We will verify your request, typically by confirming information associated with your account, before responding. You may use an authorized agent to submit a request on your behalf, subject to verification. We will respond within the timeframes required by law (generally within 45 days, with one permitted extension), and we will not charge a fee for a verifiable request unless it is excessive or repetitive.

Washington and Nevada residents. If you are a Washington or Nevada consumer, our separate Consumer Health Data Privacy Policy, available at curaweight.com/consumer-health-data, describes our practices for consumer health data and the additional rights available to you under those states' laws.

8. Security

We use industry best practices for health data security to protect your information. This includes:

• Encryption of data in transit using TLS, and encryption of data at rest.
• Access controls that limit who can access stored information.
• Instructions to our error-monitoring provider to exclude health information from diagnostic data.
• Ongoing monitoring and safeguards intended to protect the confidentiality and integrity of your information.

No app or online service can promise perfect security, and we cannot guarantee that your information will never be accessed in a way this policy does not intend. CuraWeight is a consumer health information app. It is not a HIPAA-covered entity, and this policy does not represent that the Service is subject to HIPAA. We protect your information using the industry best practices for health data security described above.

9. Children

The Service is not directed to anyone under 18 years of age, and we do not knowingly collect personal information from children. You must be at least 18 years old to create an account, and we ask you to confirm this when you sign up. If you believe a child has provided us with personal information, please contact us at the address in Section 11 and we will take steps to delete it.

10. How to delete your account and your data

You can delete your account from within the app. In the Profile area, open account settings and choose the delete-account option, then confirm as prompted.

When you delete your account, the personal information associated with it, including your health entries, chat history, photos, and profile, is permanently deleted from our production systems, and your sign-in record is removed from our authentication provider. Residual copies in encrypted backups are purged within 60 days through our backup rotation, and we direct our service providers to delete personal information they process for us. We keep a minimal deletion record that does not identify you, and we may retain limited information where the law requires it (for example, records of subscription transactions).

Deleting your account does not cancel an active subscription. Manage or cancel subscriptions through your Apple App Store or Google Play account settings. You may also contact us using the information in Section 11 for help with a deletion request.

11. Contact us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Curawe, Inc., attn: Privacy 34159 Fremont Blvd #1019 Fremont, CA 94555 hello@curaweight.com

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date below and, where appropriate, provide additional notice through the Service. Your continued use of the Service after an update means you accept the revised policy.

Effective date: July 2, 2026