Privacy Policy

CuroVault ("CuroVault", "we", "us", or "our") helps you store and organize your family's health records. We know health information is the most sensitive kind of personal data there is, and India's Digital Personal Data Protection Act, 2023 ("DPDP Act") treats it that way. This policy explains, in plain language, what we collect, why, how long we keep it, how we protect it, and the rights you have over it.

1. What data we collect

We collect only what we need to provide the service:

• Account information, your mobile number (used to sign in), and optionally your name, email address, and profile photo.
• Health records you add, the prescriptions, lab reports, discharge summaries, and similar documents you upload or photograph, along with the information we read from them (such as medicines, test results, and dates).
• Family member profiles, details you choose to add for family members whose records you manage, such as their name and relationship to you.
• Usage and device information, basic technical data needed to run the app securely and fix problems (for example, app version and error logs). We do not use this to build advertising profiles.

We practice data minimization: we don't ask for more than the service needs. Where a limited identifier is enough, we prefer it over collecting more sensitive identity documents.

2. Why we use your data (and your consent)

We use your data only for clear, specified purposes:

• To store, read, and organize your health records so you can find and use them.
• To track medications and conditions over time and show them as a timeline.
• To generate plain-language summaries of documents at your request. These are informational and are never a diagnosis.
• To let you share selected records with a doctor through a time-limited QR code that you control.
• To keep your account secure and provide support when you contact us.

We process this data based on your consent, which you give when you sign up and when you take specific actions (such as sharing records). Consent is specific, informed, and something you can withdraw at any time. Withdrawing consent for a particular use stops that use going forward.

3. Sharing your records, always your choice

Your records are not shared with anyone unless you decide to share them. When you generate a QR code for a doctor, that share is:

• Explicit, you choose exactly which records are included;
• Limited in time, access expires automatically;
• Revocable, you can end access before it expires.

Your data is only ever used to provide the service to you. It is never used for advertising, and never shared with third parties for their own purposes.

4. How long we keep it

We keep your records for as long as your account is active, because that's the point of the service, your history stays available to you. If you delete a record, or delete your account, we remove the associated data from our active systems and delete or de-identify it from backups within a reasonable period. We keep only the minimum needed to meet any legal obligation, and no longer than required.

5. How we protect your data

• Encryption in transit, data moving between your device and CuroVault is encrypted using TLS.
• Encryption at rest, stored records and uploaded files are encrypted.
• Access controls, access to your records is restricted, and sensitive actions require you to be authenticated.
• Separation of data, we work to keep identifying information separate from clinical content, so the two aren't needlessly exposed together.

No system can promise perfect security, but we take reasonable safeguards seriously and improve them as we grow. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

6. Your rights

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct or update inaccurate or incomplete data.
• Erase your data, you can request full deletion of your account and records, not just deactivation.
• Withdraw consent at any time, as easily as you gave it.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Grievance redressal, raise a concern with us and receive a response.

To exercise any of these, email support@curovault.in and we'll help.

7. Children's data

If you add records for a child (a person under 18) as a family member, you confirm you are their parent or lawful guardian and consent on their behalf. We do not use children's data for advertising or for tracking, consistent with the DPDP Act's additional protections for children.

8. Where your data is stored and processed

Your records are stored in India. To read and summarize your documents, we use a trusted AI service provider that processes your data only on our instructions, and may do so on servers outside India, including in the United States. That provider does not use your data to train its models and retains it only briefly to return your result. Such transfers are currently permitted under the DPDP Act, which allows personal data to be transferred to any country the Government has not restricted. These providers act only as our processors, your data is never used for advertising or shared with third parties for their own purposes.

9. Changes to this policy

We may update this policy as CuroVault evolves or as the law changes. When we make a significant change, we'll update the "last updated" date above and, where appropriate, notify you in the app.

10. Contact & grievances

For any privacy question, request, or grievance, contact our grievance point of contact at support@curovault.in. We aim to acknowledge and respond within the timelines required under the DPDP Act.