Privacy Policy

Who is responsible for your data

Cura Global Technologies, Inc., a Delaware corporation, decides how and why your personal information is used, and is responsible for it. For anything about your data, write to privacy@curaglobaltech.com. For anything else, info@curaglobaltech.com reaches us just as well.

What we collect

Only what the platform actually asks for:

• When you register: your name, email address, and a password. The password is stored only as an irreversible hash, so nobody at Cura can read it.
• If you are a patient: your date of birth and nationality, which providers need to answer a request, and optionally a phone number.
• If you make a booking: the treatment, the provider, your preferred dates, the price at the time you booked, and anything you type into the request.
• Optionally, a passport number and an emergency contact, if you choose to give them.
• Optionally, a scan of your passport, if a booking needs one. It is visible to you and to the provider you sent it to.
• If you write to us: your name, email, and the message.
• Automatically: your IP address and browser identifier, kept so we can tell an attack from ordinary traffic.
• If you are a provider: your organisation’s details, services, prices, and the documents you upload to support them.

Clinical documents

If a provider asks you for a report, a scan, or test results in order to answer your request, you can attach it to the conversation on that booking. That is the only route: Cura never asks for clinical information at registration, in a profile, or anywhere else.

Sending one is always your choice. You can answer a provider directly instead, and a booking can be made and completed without ever attaching a document.

A document you attach is visible to you, to the provider on that booking, and to Cura staff who need it to resolve a problem you have raised. It is not visible to other providers, it is not used to build a profile of you, and it is never sold or shared for advertising.

You can delete a document you uploaded, and deleting it removes it from storage rather than hiding it. Deleting your account removes them all.

We are still building the stronger protections described in the next section. Until they are in place, send us only what a provider has actually asked for.

What changes in a later phase

Health information is sensitive under the law almost everywhere we operate, including China’s Personal Information Protection Law, and it deserves handling that goes beyond ordinary personal data. Some of that handling is still being built, and we would rather say so plainly than imply it is already finished.

These are what we are committing to, and what you should expect as the platform matures:

• We will ask for your consent separately and specifically when it arrives, not through these terms and not as a tick box inside a booking form. You will be able to say no and go on using Cura.
• Health information is sensitive under the law almost everywhere we operate, including China’s Personal Information Protection Law, and it will be handled that way: encrypted where it is stored, every access recorded, and kept only as long as your booking needs it.
• Only the provider you send a document to will be able to see it. Not other providers, and not anyone at Cura without a reason recorded against your file.
• You will be able to withdraw a document, and withdrawing it will delete it rather than hide it.
• This page will be rewritten before the feature is switched on, never after.

None of this is live yet. If you are reading this and the platform will not let you attach a report, that is the current state working as described, not a fault.

Why we are allowed to hold it

• To provide the service you asked for: an account, a booking, a reply. Without this data there is no booking.
• Because you consented, for the optional things: a passport scan, a passport number, an emergency contact. You can withdraw that consent and ask us to delete them.
• Because we have to: keeping records of what was agreed, and of moderation decisions, so we can answer a complaint or a regulator.
• Because we have a legitimate interest in keeping the platform up and safe, which is why we keep an IP address against abuse.

A passport scan and a passport number are sensitive information in most places we operate. We ask for them only where a booking needs them, we never require them to browse, and you can ask us to remove them.

Who else sees it

A short list, and it is the whole list:

• The provider you send a booking request to sees that request and its attachments. That is the point of sending it.
• Resend, which delivers our email. It sees the address we are writing to and the contents of that message.
• Cloudflare R2, which holds our encrypted backups.
• Our own staff, when answering a support question or reviewing a provider.
• A court or regulator, if we are legally required to disclose something.

Translation between English and Chinese runs on our own server. No third party sees the text of your booking or your messages in order to translate them.

Where your data lives, and why it crosses a border

Our servers are in Singapore. If you are in mainland China, using Cura means your personal information is sent out of China to Singapore, and on to the country of any provider you send a booking request to.

That transfer is not incidental, it is how a cross-border booking works: a provider in Japan cannot answer a request it cannot see. We are telling you plainly rather than burying it, because it is the one thing about this platform a reader in China most needs to know before signing up.

How long we keep it

• Your account and profile: until you ask us to delete them.
• Bookings and their history: kept after the treatment, because they are the record of what was agreed between you and a provider.
• A passport scan: deleted on request, and you can send a booking without one.
• Contact messages: kept while we deal with them and for a period afterwards, so "I wrote and nobody replied" can be checked.
• Abuse records such as IP addresses: kept briefly, then discarded.

What you can ask for

Write to privacy@curaglobaltech.com and we will act on any of these:

• A copy of what we hold about you.
• A correction, if something is wrong.
• Deletion of your account and the data that is not part of a booking record we are required to keep.
• Withdrawal of consent for anything optional, such as a passport scan.
• An explanation of anything in this policy that is not clear.

Depending on where you live, you may also have the right to complain to a data protection authority. We would rather you told us first, but that right is yours either way.

How it is protected

• Passwords are hashed with argon2id and are never stored or logged in a readable form.
• Passport numbers are not returned by the API by default.
• Uploaded documents are reached through short-lived links that are authorised each time, never through a guessable address.
• Passwords, tokens, cookies, and passport numbers are stripped from our logs.
• Access to production data is limited to people who need it.

No system is perfectly secure, and we do not claim otherwise. If we discover a breach affecting you, we will tell you.

Children

Cura is not for children. Do not create an account for someone under the age at which they can agree to this where they live. A parent or guardian arranging treatment should use their own account.

Changes

If we change how we use your data, we will change this page and update the date at the top. Where the change is significant, we will tell you rather than rely on you noticing.