Privacy Policy

Updated October 17, 2026 · Covers Cura and Cura Family

Cura is provided by Muhammad Haris Shahbaz. Contact m.haris4274@gmail.com for privacy questions or data requests.

Your routine on your device

Medication names, doses, schedules, stock and logged activity are stored on your device. Core reminders work without an account. Data leaves your device when you choose prescription scanning, Family sharing, an export, or purchases. Device backups are also subject to your Apple/device settings. Exported files are shared only through the destination you choose.

Prescription scanning and AI

Before each upload, Cura discloses that a third-party AI service processes the image and asks for your permission. If you accept, your prescription image is transmitted securely through Cura's service at apps.tryhexa.com to that third-party processor for transcription. Labels may include your name, prescription details and other sensitive information. Crop out information you do not want processed. Declining lets you enter medication details manually.

The consent screen links directly to the active third-party AI processor's privacy policy so you can review its identity and data-handling terms before deciding. Processor storage and retention are governed by its applicable service terms and privacy policy; do not assume that processing is on-device or that the provider has zero retention. Cura's scan endpoint does not save the image or transcribed result to your Family account. It records operational usage metadata such as provider, model, timing, token usage, status and errors. Images are not sent to optional analytics. Review and correct every extracted field against your prescription before saving; consult your pharmacist or doctor about medication decisions.

Optional Family accounts and sharing

Creating a Family account sends your email, chosen display name and password to our service. Passwords are stored as password hashes; session credentials are stored securely on your device. When you enable Family sharing, our service stores your medication names, doses, schedules, time zone and dose activity so your connected family members can view them and receive no-dose-logged alerts. Sharing begins only after you agree. Water, supplements and activity before sharing consent are excluded from Family sharing. You can pause sharing, revoke an invitation, or remove a connection. Pausing stops new updates; it does not itself delete your account or previously shared records.

Push delivery uses Expo and Apple's notification services, including a device push token. Alerts may be delayed by network or device conditions. Family is not emergency monitoring and an absent log does not establish whether medication was taken.

Apple Health

In the updated app, optional Apple Health sync writes only the water intake you log. We do not read Health records or upload HealthKit data. You can turn sync off in Cura and control permissions in Apple's Health settings. Existing Health samples remain until you remove them in Health. Earlier versions could write medication markers as mindfulness samples; the updated version stops those writes. You can inspect and delete Cura's older samples in the Health app.

Purchases and service providers

Apple processes payments. RevenueCat processes purchase receipts, purchase history, entitlement status and an app user identifier to validate Cura Pro and restore access. When you sign into Family, that identifier may be linked to your Family account to verify sharing access. Cura does not receive your payment card details. See RevenueCat's privacy policy and Apple's privacy policy. Our hosting, database and delivery providers process service data to operate Cura.

Analytics

The updated app disables optional Firebase analytics and Cura's optional server analytics. Earlier app versions may send app usage events to Firebase, including medication names in low-stock events. Updating stops those client events; contact us about deletion requests for previously collected information. We do not sell your health data or use it for advertising.

Retention and deletion

Local records remain until you delete them or clear Cura's local data. Use Family → Delete Family account to request deletion of the account, connections and shared health data. Server account records are deleted and related processor cleanup is performed by background jobs. Copies in operational backups and records required for security, transaction or legal obligations may remain according to the applicable retention requirements. Contact us for specific retention or access requests. Deleting Family does not erase local medication records, Health samples, or exports, and does not cancel App Store subscriptions. Cancel subscriptions through your App Store account settings.

Your choices

You may decline each scan upload, use Cura without Family, stop sharing, disable notifications, revoke Health permissions, export local data, clear local data, delete Family, or contact us to request access, correction or deletion. Information already sent cannot be recalled by withdrawing permission for future uploads. If the processor changes, the next scan asks for permission for the new processor.

Children and changes

Cura is not directed to children. Do not create accounts or share another person's data without appropriate permission. This page will be updated when our practices change; new AI recipients require a new disclosure before upload.