Privacy Policy

Effective and updated September 22, 2026

Curva is committed to protecting your privacy. This Privacy Policy explains what information Curva collects, why it is used, when it is shared, and the choices available to you when you use the Curva mobile application, this website, and related services (collectively, the “Services”).

1. Who operates Curva

The Services are operated by Curva in Washington, United States. “Curva,” “we,” “us,” and “our” refer to the operator of the Services. “You” means a visitor, account holder, patient user, clinician user, parent, or guardian using the Services.

2. Information we collect

Information you provide

• Account information: name, email address, account role, authentication credentials processed through Firebase Authentication, and account-creation time.
• Brace and health-related information: pressure readings measured by connected brace sensors, saved pressure ranges, wear sessions, session dates and duration, pressure alerts, reports, check-ins, and related summaries.
• Communications: patient-clinician messages, clinician notes, AI-assistant messages, and information entered in website contact forms.
• Support information: your name, email address, message, and other details you choose to include when contacting Curva.

Information collected through devices and use

• Bluetooth connection information: compatible device information and identifiers needed to find, pair with, and maintain a connection to Curva sensor hardware.
• App and device information: limited technical information needed for authentication, security, troubleshooting, and reliable operation, which may include device type, operating system, IP address, and timestamps.
• Local storage: functional preferences and limited session information stored on your device.

Curva does not intentionally collect payment-card information, billing or mailing addresses, phone contacts, photos, precise GPS location, advertising identifiers, or social-media profile information through the current Services.

3. How we use information

• Create and authenticate accounts and provide patient and clinician experiences.
• Connect to compatible sensors and display pressure readings in newtons.
• Track brace-wear sessions, saved pressure ranges, and pressure events.
• Generate daily and longer-term trends, reports, quality scores, and summaries.
• Enable messaging, notifications, and clinician notes.
• Provide AI-assisted explanations and summaries when the AI feature is used.
• Respond to support requests, maintain security, diagnose problems, and improve reliability.
• Comply with law and protect users, Curva, and others from fraud, abuse, or security threats.

Curva does not sell personal information. Curva does not use personal information for targeted advertising, behavioral advertising, Facebook Pixel tracking, or advertising retargeting.

4. AI features

Curva may use OpenAI services to produce AI-assisted chat responses and summaries. When you choose to use an AI feature, relevant chat text and summarized brace-pressure or wear information may be transmitted for processing. Curva is designed not to send your password to OpenAI. Avoid entering information that is unnecessary for your question.

AI output may be incomplete or incorrect. It supports explanation and communication; it is not a diagnosis, emergency service, or substitute for advice from a qualified clinician. Treatment and brace-adjustment decisions should be made with a healthcare professional.

5. When information is shared

Curva shares information only as needed to operate the Services, at your direction, or when legally required. Recipients may include:

• Google Firebase for account authentication, cloud functions, and database storage.
• OpenAI to process content submitted to enabled AI features.
• Render to host the Curva website.
• FormSubmit to deliver website contact-form messages.
• Linked users such as patient and clinician accounts intentionally connected within Curva.
• Legal and safety recipients where necessary to comply with law, prevent harm, investigate abuse, or protect rights.
• A successor if Curva is reorganized, merged, acquired, or transferred, subject to this Policy and applicable law.

Curva does not share information with advertising networks or data brokers.

6. Cookies, local storage, and analytics

The app uses local device storage for functional preferences. This website or its hosting infrastructure may use strictly necessary cookies, sessions, or similar storage for secure, basic operation. Curva does not currently use Google Analytics, Firebase Analytics, advertising cookies, Facebook Pixel, session replay, or cross-site advertising trackers.

7. Data retention and deletion

Curva retains account and service data while an account is active and as reasonably necessary to provide the Services, resolve disputes, maintain security, and meet legal obligations. You may request deletion through available account controls or by contacting Curva. Curva will delete or de-identify information unless retention is required or permitted by law. Limited copies may remain temporarily in backups and security logs. Deleting the app does not by itself delete cloud account data.

8. Security

Curva uses reasonable administrative, technical, and organizational safeguards appropriate to the information, including authenticated access and encryption in transit where supported. No storage or transmission system is completely secure. Keep your password confidential and notify Curva if you suspect unauthorized access.

9. International processing

Curva and its providers may process information in the United States and other countries where they operate. Where required, Curva will use appropriate safeguards for international transfers.

10. Your choices and privacy rights

• Request access to, correction of, or deletion of information associated with your account.
• Request restriction, object to processing, or withdraw consent where applicable.
• Stop sensor collection by disconnecting Bluetooth, ending a session, or revoking Bluetooth permission.
• Choose not to use the AI assistant.
• Delete your account where available and uninstall the application.

To exercise a privacy right, email eguan618@gmail.com. Curva may verify your identity and connection to the account before completing a request.

11. California privacy notice

For California users, the categories Curva may collect include identifiers; internet or electronic-network activity; health-related and sensor information; communications; and inferences or summaries produced from brace-use information. Curva does not sell personal information or share it for cross-context behavioral advertising, and does not knowingly sell or share personal information of users under 16 for those purposes. California residents may request access, correction, or deletion as provided by applicable law. Curva will not discriminate against you for exercising an applicable privacy right.

12. European and UK privacy rights

Where the GDPR or UK GDPR applies, Curva processes information as necessary to provide requested Services, pursue legitimate interests such as security and reliability, comply with legal obligations, and, where required, based on consent. Health-related information is processed only where an applicable legal basis and condition permit it, including explicit consent where required. Applicable rights may include access, correction, deletion, restriction, objection, portability, withdrawal of consent, and a complaint to a supervisory authority.

13. Children’s privacy

Curva is not offered for independent use by children under 13 and does not knowingly collect personal information directly from children under 13. A parent or guardian who believes a child under 13 submitted personal information should contact Curva so it can be reviewed and deleted as appropriate. Curva may support scoliosis care involving a minor when an authorized parent, guardian, or healthcare professional manages or supervises use.

14. Healthcare and emergency notice

Curva is a support and communication tool, not an emergency service. Do not use Curva to seek emergency assistance. Contact local emergency services for urgent medical needs. Unless a specific written arrangement states otherwise, use of the general consumer Services does not by itself make Curva a HIPAA-covered entity or create a clinician-patient relationship with Curva.

15. Links and third-party services

The Services may link to websites or services Curva does not control. Their privacy practices are governed by their own policies.

16. Changes to this Policy

Curva may update this Policy to reflect changes in the Services, technology, or law. The updated date will be revised when changes are posted. Additional notice or consent will be provided where required.

17. Contact Curva

Email: eguan618@gmail.com
Contact form: curva-web.onrender.com/contact.html
Curva, Washington, United States