Privacy Policy
The types of personal and wellness data we collect;
How we use, store, and disclose that data;
The rights of Users under applicable laws; and
Our legal obligations regarding data protection.
This Policy is designed to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
124, the General Data Protection Regulation (GDPR)125, the California Consumer Privacy Act (CCPA)126, and other applicable U.S.
federal, state, and international privacy laws.
Scope of Policy
This Privacy Policy applies to:
Clients who use our Services for spiritual, religious, or mental health support;
Providers who deliver licensed services through our Platform;
Visitors to our websites and mobile applications; and
Any individual whose data is collected in the course of providing Services.
CurityCare collects the following categories of data:
Personal Identification Data
Name, address, email, phone number;
Government-issued identification (for verification purposes only).
Wellness Data
Self-reported mental health, emotional, or spiritual well-being information;
Details regarding religious affiliation or faith tradition (optional and only when relevant to service delivery).
Transaction Data
Payment method details, transaction history, and invoices;
Billing addresses and tax-relevant details.
Technical Data
IP address, browser type, device identifiers;
Geolocation information (if consented to).
Lawful Basis for Processing (GDPR Compliance)
We process personal and wellness data under the following legal bases:
Consent – When the User voluntarily provides personal or wellness data for the purpose of receiving Services.
Contractual Necessity – Where processing is required to fulfill the Terms of Service.
Legal Obligation – To comply with legal, regulatory, or licensing requirements.
Legitimate Interests – For fraud prevention, network security, and service improvement.
HIPAA Compliance Statement
When a Provider is a covered entity under HIPAA, CurityCare acts as a Business Associate as defined under 45 C.F.R. § 160.103127. We enter into Business Associate Agreements (BAAs) with such Providers to ensure all Protected Health Information (PHI) is handled in accordance with HIPAA standards.
CurityCare retains personal and wellness data only as long as necessary to:
Fulfill the purposes outlined in this Policy;
Comply with applicable laws (including medical record retention laws);
Resolve disputes; and
Enforce agreements.
Data retention periods vary depending on jurisdiction, but generally:
Wellness Data – 7 years from last service date;
Financial Records – 7 years for tax compliance;
User Accounts – Deleted within 90 days of verified account closure, except where retention is legally mandated.
We implement administrative, technical, and physical safeguards, including:
Multi-factor authentication for account access;
Role-based access control for internal personnel;
Annual third-party ***** testing.
No method of transmission or storage is 100% secure; however, CurityCare meets or exceeds industry standards for security and data protection.
User Rights
Subject to applicable law, Users have the right to:
Rectify inaccuracies;
Delete personal data ("Right to be Forgotten” under GDPR);
Restrict processing;
Data Portability; and
Withdraw Consent at any time, without affecting the lawfulness of processing before withdrawal.
Requests to exercise rights should be submitted to:
Email:
CurityCare does not sell User data. Data may be disclosed:
To Providers solely for the delivery of Services;
To third-party service providers under confidentiality obligations;
As required by law, court order, or government regulation;
In connection with a corporate transaction such as a merger or sale.