CuraPass helps you keep your own medical history in one place and share it with the clinicians and family you choose. That means we handle some of the most sensitive information there is. This policy explains what we collect, why, who else is involved, how long we keep it, and the choices you have.
CuraPass is provided by MEZ & MEZ LTD (company number 16860410), 1 Derbyshire Lane, Stretford, Manchester, M32 8BH, United Kingdom. We are the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Questions about privacy: support@curapass.com.
If you connect Health Connect, the app can read your heart rate, blood pressure, blood oxygen, body temperature, breathing rate and weight, for example readings from a smartwatch. It reads only while you are using the app: when you ask it to import, and, if you turn on automatic sync, each time you open the app. When you import, we save only the readings you select. With automatic sync on, we save the newest reading of each type to your passport; summaries such as today’s average heart rate are shown on your phone and are not uploaded. You can turn automatic sync off, or disconnect CuraPass in Health Connect, at any time. We never write to Health Connect and we do not read it while the app is closed.
CuraPass’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
If you subscribe, payment is handled by Stripe (on the website) or Google Play (in the Android app). We do not receive or store your card number. We keep a record of your subscription, the amounts and dates of payments, and the payment provider’s reference numbers.
| Purpose | Legal basis |
|---|---|
| Providing your account and the service you signed up for | Contract |
| Storing and showing your health information, and sharing it with the people you choose | Your explicit consent, which you can withdraw at any time (see “Your rights”) |
| Keeping accounts secure and preventing misuse (for example, sign-in protection and two-step verification) | Legitimate interests |
| Taking payments and keeping financial records | Contract and legal obligation |
| Sending service emails (verification, password reset, important changes) | Contract |
| Keeping medical records after an account is deleted | Legal obligation / legitimate interests (see “How long we keep it”) |
We do not sell your data, we do not use it for advertising, and we do not use your health information to make automated decisions about you.
We use a small number of providers to run CuraPass. They may only use your data to provide their service to us.
People you share with. When you share a link or QR code, or connect a caregiver or provider, they can see the information you chose to share. You can revoke links and connections at any time, but we cannot recall information someone has already seen or saved.
We may also disclose information if the law requires it, or to protect someone’s vital interests in an emergency.
Your data is stored in the United Kingdom. Some of our providers may process data in other countries; where they do, we rely on the safeguards UK law requires, such as UK adequacy regulations or the UK International Data Transfer Agreement.
See how to delete your account.
Data is encrypted in transit (HTTPS). Passwords are stored hashed. You can turn on two-step verification. Access to health information is restricted to you and the people you choose, and share links can be revoked or set to expire. No system is perfectly secure; if a breach affected you, we would tell you and the Information Commissioner’s Office where the law requires it.
You must be 18 or over to create an account. A parent or legal guardian may keep a child’s records in their own account and is responsible for that information.
You have the right to:
To use any of these rights, email support@curapass.com. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live.
If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect.