Privacy Policy

This policy applies to the MyCurer patient mobile applicationand the data we process through it. Your medical care and records are provided through your clinic or provider; where CurerTech processes Protected Health Information (PHI) on behalf of a clinic, we act as that clinic's service provider (business associate) under HIPAA, and the clinic's own notice of privacy practices also applies. This policy does not cover websites, products, or services that link to their own separate privacy notices.

Information you provide when you register and use the App

• Identity and contact details: first and last name, email address, phone number, mailing/physical address
• Date of birth and demographic information
• Account credentials (your password is handled through AWS Cognito; we do not store it in readable form)

Health information (provided by you and through your clinic)

• Medical records and health history made available to you by your provider
• Lab test results and diagnostic reports
• Appointments, appointment requests, and provider notes shared with you
• Prescription and medication information shared with you
• Insurance information and images of your insurance cards

Content you submit

• Documents you upload
• Images of insurance cards (processed with optical character recognition to read the information on them)
• Electronic signatures you apply to forms
• The content of secure messages you send to your care team

Technical information necessary to operate the App

• Device type and operating system version and basic app/diagnostic information needed to run and troubleshoot the App
• Authentication tokens, stored securely on your device and used to keep you signed in

What we do NOT collect or use

• We do not use third-party advertising, analytics, or tracking SDKs.
• We do not collect an advertising identifier and we do nottrack you across other companies' apps or websites.
• We do not access your location, contacts, or browsing history.

We use your information to:

• Provide the App's core features: viewing and requesting appointments; viewing lab results, documents, and records shared by your provider; secure messaging with your care team; submitting and managing insurance information; signing forms.
• Authenticate you and keep your account secure, including automatic sign-out after a period of inactivity.
• Send you service-related, in-app notifications (for example, appointment, lab-result, and request updates).
• Maintain, troubleshoot, and improve the reliability and security of the App.
• Comply with legal, regulatory, and healthcare recordkeeping obligations, and prevent fraud and misuse.

We do not use your health or personal information for advertising, and we do not sell it.

We share information only as needed to provide the service and as described here:

• Your clinic and care team. Providers, clinical staff, and the facilities and laboratories involved in your care, so they can deliver and coordinate care.
• Service providers (subprocessors). Vendors that host and operate the App under agreements that require them to protect your information and, where applicable, HIPAA business-associate agreements:
  • Amazon Web Services — cloud hosting and infrastructure
  • Amazon S3 — secure storage of documents and images
  • AWS Cognito — user authentication
• Legal, safety, and compliance. When required by law, regulation, subpoena, or legal process, or to protect the rights, safety, and security of patients, the public, or CurerTech.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy and applicable law.

We do not sell your personal or health information, share it for third-party marketing, or disclose it to unauthorized parties.

We use administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of data in transit (TLS 1.2 or higher) and encryption of stored data at rest
• Storage of credentials and authentication tokens in the device keychain (device-only, excluded from device backups)
• Automatic session timeout after inactivity and a privacy screen that hides app content in the device app switcher
• HIPAA-aligned cloud infrastructure, access controls, and audit logging

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain your information for as long as your account is active and as needed to provide the App, and thereafter as required to meet healthcare recordkeeping, legal, regulatory, and compliance obligations. When information is no longer required for these purposes, we delete or de-identify it. Because MyCurer supports a regulated healthcare service, some records may be retained for a period required by law even after you request deletion (see Section 8).

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated personal data (see Section 8)
• Receive your data in a portable format
• Opt out of non-essential communications (essential service and security messages may still be sent)
• File a complaint (see Section 12)

To exercise any of these rights, contact support@curertech.com. We may need to verify your identity before acting on a request. Some health information may also be subject to rights you can exercise directly through your clinic under HIPAA.

You can request deletion of your account and associated personal data from within the App: Profile → Account Settings → Delete Account. Because MyCurer is a regulated healthcare service, our support team verifies each request to protect your information, then completes deletion and confirms by email. Requests are completed within 90 days. Some records may be retained where required by law or healthcare regulation. You may also email support@curertech.com to request deletion.

The App sends in-app notifications related to your care and account (for example, appointment reminders, lab-result and request updates, and security notices). You consent to receive these service-related communications when you use the App. You may opt out of non-essential communications; essential service and security messages may still be sent.

The App requests the following device permissions, used only for the stated purposes:

• Camera — to capture images of your insurance cards.
• Photo Library — to select documents to upload and to save documents.

You can grant or revoke these permissions at any time in your device settings.

MyCurer is intended for use by patients of participating clinics and is not directed to children under 13. Where a patient is a minor, a parent or legal guardian must set up and manage the account on the patient's behalf and is responsible for the information provided. If you believe a child has provided us information without appropriate consent, contact support@curertech.com.

MyCurer helps you access health information that your clinic or provider makes available to you. Your clinic or provider is the "covered entity" responsible for your medical records under HIPAA, and CurerTech processes PHI on their behalf as a business associate under a business-associate agreement. Your HIPAA rights regarding your medical records — including access, amendment, and an accounting of disclosures — are exercised through your clinic or provider.

If you believe your privacy rights have been violated, you may file a complaint with us at support@curertech.com or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

We do not track you across other companies' apps or websites, and we do not use third-party advertising or analytics services in the App. Because we do not track users, we do not respond differently to browser "Do Not Track" signals.

The App and its data are hosted on cloud infrastructure located in the United States. If you access the App from outside the United States, you understand that your information will be processed in the United States.

The App may link to external pages, such as our Terms & Conditions, which open in your browser. We are not responsible for the privacy practices or content of third-party websites or services. Please review their policies separately.

We may update this Privacy Policy from time to time. We will post the updated policy at this URL and update the effective date shown on this page, and we will notify you of material changes through the App or by email where required. Your continued use of the App after an update takes effect constitutes acceptance of the updated policy.

CurerTech LLC
3S721 West Ave, Suite 500, Warrenville, IL 60555

• Privacy and support: support@curertech.com

If you believe your privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.