Consent to Collect Consumer Health Data

Effective date: September 30, 2026

CuraeAI Inc. ("CuraeAI") asks for this consent separately from your acceptance of our Terms of Service. You give it by ticking its own box. It covers the consumer health data CuraeAI collects to provide your personal health record, and it is described in full in our Consumer Health Data Privacy Policy.

What you consent to. By giving this consent, you agree that CuraeAI may collect and use your consumer health data as follows.

1. The consumer health data we collect:

   • health records imported from the health systems you choose to connect, such as conditions, medications, allergies, test results, vital signs, imaging, immunizations, procedures, visits, clinical notes and documents, family history, and insurance claims and coverage;
   • documents and images you upload, your answers to health questionnaires (including mood and anxiety questionnaires), and health information you add yourself;
   • sensitive information that appears in those records, which can include sexual and reproductive health, mental health, substance-use treatment and genetic test results;
   • scores, labels and — where AI features are switched on — summaries and findings we derive from your records; and
   • the fact that you use CuraeAI, the health systems you connect or search for, and the apps you connect through Curae Connect.

2. Why we collect it and how we use it:

   • to build, organize and show you your personal health record;
   • to calculate the scores and estimates the Service shows you;
   • where AI features are switched on, to produce the summaries you ask for and to extract findings from clinical notes, using AI models CuraeAI runs on its own servers in Microsoft Azure data centers in the United States, as described in our AI Processing Disclosure;
   • to carry out the sharing you choose;
   • to keep the Service and your data secure and to keep audit records of who accessed them; and
   • to comply with the law.

   We do not sell your consumer health data, use it for advertising, or use it to train AI models.

3. Who receives it:

   • the people and apps you choose to share with, each time you choose to share — every sharing action is a separate choice, and an authorization you sign at that moment under our Sharing Authorization;
   • the health systems you connect, which receive your authorization and our import requests; and
   • our processors, which handle it only to provide the Service to you: Amazon Web Services (hosting, storage and email), Microsoft (the servers our own AI models run on, where AI features are switched on) and MongoDB (the directory in which health systems you search for are looked up).

   Our email hosting provider receives the messages you send to our email addresses. Don't include health information in an email to us.

4. How to withdraw this consent. You can withdraw it at any time in Settings, or by emailing privacy@curaeai.com from the email address on your account. Because CuraeAI cannot keep a health record without collecting health data, withdrawing this consent closes your account: when you confirm by the link we email you, you lose access at once, and your consumer health data is permanently deleted within 30 days of your request, as our Consumer Health Data Privacy Policy explains. You can also stop collection from a particular health system at any time by disconnecting it. If your account was made through Curae Connect and you have not finished setting up a full account, withdraw this consent in Curae Connect: open it from the app, choose Manage sharing, and delete your account. When you confirm on that screen, sharing with the app ends at once, and your consumer health data is permanently deleted within 30 days of your request.

This consent does not cover selling your data, which we do not do, or any new category of data or new purpose, for which we ask you separately.