CURVE CARE PRIVACY POLICY
Data controller: Lullya Abdulhadi, Arab Republic of Egypt.
Contact: set your contact email
1. WHAT CURVE CARE IS
Curve Care helps people living with scoliosis organise their day, run breathing and Schroth sessions, and track how they are doing. Curve Care is not a medical device. It provides no diagnosis, no treatment plan and no medical advice. It does not replace your doctor or physiotherapist. Always follow the plan they have given you.
2. WHAT WE COLLECT
Only what you enter yourself and what is technically required to run your account. Account data: email, username, display name, avatar emoji, language, theme, and an age band (under 15 / 15 to 17 / 18 or older). We never store your date of birth. Content you create: tasks, study sessions, breathing and Schroth sessions, mood entries, pain level if you choose to record it, journal entries, schedule items and reminders. Technical data: sign-in timestamps and a hashed fingerprint of your IP address used only to limit password-guessing attempts. We never store raw IP addresses.
3. WHAT WE NEVER DO
We do not use advertising trackers, analytics cookies or advertising cookies. We do not sell, rent or share your data with advertisers or data brokers. We do not access your contacts, your location or your camera. We do not carry out behavioural profiling or tracking of any user, at any age. We do not use your data for research or to train artificial intelligence models. We show no advertising to anyone.
4. SENSITIVE DATA AND YOUR EXPLICIT CONSENT
Mood, pain level and journal entries are sensitive personal data under Egyptian Law 151 of 2020. We process them only with your explicit, electronically written consent, recorded separately with its date and version. This consent is entirely optional: decline it and the app works fully without those features. You may withdraw it at any time in Settings, and you will then be offered deletion of everything already recorded.
5. CHILDREN AND GUARDIAN CONSENT
Under 15: an account is created only with the explicit consent of a parent or legal guardian, who confirms the data covered, the purpose, and a validity period of twelve months, after which consent must be renewed. From 15 to under 18: the user may consent for themselves. In both cases a guardian may at any time request access to, correction of, or deletion of a minor's data, or withdraw consent entirely, by writing to the contact address above. We apply data minimisation: every health field is optional and no unnecessary data is requested.
6. WHO CAN SEE YOUR DATA
You can, always and in full. The administrator can see your account details, aggregate counts of your activity, and can send you a password reset link, suspend your account or delete it. The administrator cannot see or set your password, cannot sign in as you, and cannot edit anything you wrote. If an administrator opens your personal content they must record a written reason, the action is written to a permanent log that cannot be altered or deleted, and you receive a notification in the app showing the date and the reason. There is no silent access. Nobody else sees your data, except under a binding lawful or judicial order, and we will tell you unless the law prevents us.
7. WHERE YOUR DATA IS STORED
On cloud infrastructure operated by our service providers, located outside the Arab Republic of Egypt. Under Law 151 of 2020 this transfer requires your explicit consent, which we ask for separately when you create your account. Without it an account cannot be created, because the service cannot run without this hosting. We transfer only the minimum data needed to operate.
8. HOW LONG WE KEEP IT
While your account is active. Deleting your account erases everything permanently with no recovery; only a minimal security record (email, deletion date, event type) is kept for legal and anti-abuse purposes. Accounts unused for 24 months are deleted automatically after 30 days' notice by email.
9. YOUR RIGHTS
Under Law 151 of 2020 you have the right to be informed, to access your data, to correct it, to erase it, to object to particular processing, and to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Export and deletion are available inside the app, instantly and without needing to ask. For anything else, write to the contact address.
10. SECURITY
Passwords are hashed and readable by nobody, including the administrator. Database-level isolation prevents any user reaching another user's data. Every administrator action is verified on the server and permanently logged. Rate limiting blocks password-guessing. All traffic is encrypted. No system is completely secure. If a breach affects your data we will notify the Personal Data Protection Center within 72 hours of discovering it and inform you within three working days, describing the measures taken.
11. CHANGES
We will notify you in the app before any material change takes effect, and ask for fresh consent if the change widens what we collect.
12. CONTACT AND COMPLAINTS
set your contact email. If our response does not satisfy you, you may complain to the Personal Data Protection Center of the Arab Republic of Egypt.