Privacy Policy

1. Who we are

Curevia is operated by Xiamen Tianyue Technology Co., Ltd. (厦门添越科技有限公司), Room 1202, No. 29 Sunban South Road, Xiamen City, Fujian Province, China. Contact [email protected] or +86 180 3011 1401. We coordinate medical travel; we do not diagnose, prescribe or provide medical treatment.

2. Information we process

Account information includes your email, name, password hash, contact details, country and language. Patient and caregiver information may include names, dates of birth, relationships, health records, medication lists, passport details and documents you choose to provide. We also process requested plans, bookings, messages, support requests, uploaded photos and files, and wallet and transaction records. Security and operational records may include IP addresses, sign-in times, device information and error logs. Camera and photo access is used when you choose to capture or upload content.

3. Why we use information

We use information to operate your account, organise requested travel and appointments, communicate with you, coordinate authorised services, process payments and refunds, protect accounts, and meet applicable record-keeping obligations. Health information is used for requested coordination and record-management features, not advertising. We do not sell personal information. You can choose not to provide optional information, although the services that need it may then be unavailable.

4. Sharing and service providers

Within the scope you authorise, necessary records and booking details may be shared with the hospitals, interpreters and other service providers you select. We do not sell personal data, and we use no advertising networks, analytics SDKs or data brokers.

The processors we rely on are:

• Sign-in — if you choose Google Sign-In or Sign in with Apple, that provider confirms your identity and passes us your email address and, where you allow it, your name.
• Membership payments — sold through Apple In-App Purchase on iOS and through Google Play Billing on Android. The store processes the payment and returns a transaction record; we never see your payment method.
• Other payments — services delivered in person are paid on a checkout page hosted by our payment providers (PayPal, Airwallex, Stripe, depending on the method you pick). They handle card and account details under their own privacy policies; Curevia stores only the transaction reference and amount, never a card number.
• No AI customer service — Curevia does not use AI as customer service. Your messages are answered by members of our team, never by an AI chatbot; the records you upload are read and organised by our staff; and trip estimates are calculated from our price list by fixed rules. Some specific checks, such as identity verification and receipt scanning, may use automated recognition technology from our service providers; it does not reply to you or make decisions for you. Records uploaded before 27 October 2026 may also carry details that were extracted automatically on our own servers at the time; the app labels them as auto-extracted.
• Our staff — team members see health information only when the task they are handling needs it, and every download of an original record is logged.
• Alibaba Cloud — object storage for the files you upload, and, where receipt scanning is switched on, optical character recognition of receipt images.
• Email delivery — an email provider sends verification and notification messages to your address.

Information may also be disclosed when required by law or necessary to address fraud, security incidents or legal claims. Do not upload another person’s records unless you have authority to do so.

5. Where information is processed

Two places, and they are different: the production application server and database are in Bangkok, Thailand, while the files you upload — medical records, photos and receipt images — are stored in Alibaba Cloud object storage in Shenzhen, mainland China. Account details, health information you type in and the case summaries our staff write are therefore processed and stored in Thailand; uploaded files are stored in mainland China. When you request coordination in China, necessary information is also provided to the hospitals and service providers you select there. Payment providers process information in accordance with their own policies. Depending on where you live, these activities involve international data transfers. Contact us before uploading information if you need further details about a proposed transfer.

6. Retention and deletion

We retain information needed to provide services while your account is active. Account deletion requests have a seven-day cooling-off period, after which deletion or anonymisation is processed. Transaction, consent and audit records needed for legal obligations, disputes or security may be retained with restricted use and access. Retention depends on the record and its purpose; a deletion request does not necessarily remove records we must retain. Contact us for information about a particular record or deletion request.

7. Your choices and rights

Under Me > Account & privacy, you can request data export or account deletion. If you cannot use the app, see how to delete your account without signing in. You can correct patient information, manage caregiver access and withdraw permissions or consent where the relevant controls are available. You can also contact [email protected] for access, correction, deletion, objections, withdrawal of consent or a privacy complaint. We may need to verify your identity before acting on a request. Rights and applicable exceptions depend on your location. You may contact the data-protection authority in your jurisdiction.

8. Children and family records

Curevia is not directed to children under 16 as account holders. Information about a minor patient must be provided and managed by a parent, guardian or other appropriately authorised caregiver. Contact us if you believe a child has opened an account without appropriate involvement.

9. Security and updates

We use HTTPS, hashed passwords, access controls and audit records to protect information. No system can guarantee absolute security. We will update this policy when our practices change and provide notice where required. This policy is effective from 27 October 2026. Privacy questions: [email protected].