Privacy Policy

Introduction

curavidas is a scheduling platform designed for therapists and their clients. This Privacy Policy describes how we collect, use, and protect your personal information when you use our services, including our website, booking widget, and related tools. By using curavidas, you agree to the practices described in this policy.

Information We Collect

We collect different types of information depending on how you interact with curavidas:

From clients:

• Name
• Email address
• Phone number
• Appointment type and scheduling details
• Meeting mode preference (video or phone)
• IP address
• Timezone

From therapists:

• Email address
• Name
• Profile image
• Timezone and calendar provider preference
• Full Google Calendar access (all calendars and events in your Google account), including calendar names, access roles, IDs, and event details — requested so we can list your calendars, check availability across them, and create and manage appointment events. We only use this access for scheduling purposes and do not read, store, or process calendar events that curavidas did not create.
• Your calendar selection — which calendar is your primary (where appointments are created) and which additional calendars are checked for busy-time conflicts
• Widget customization settings (colors, fonts, logos, header text)
• Encrypted OAuth tokens (for calendar and video integrations)

How We Use Your Information

We use the information we collect for the following purposes:

• Scheduling and managing appointments between therapists and clients
• Listing all Google calendars in your account so you can choose which ones to sync with curavidas
• Creating, updating, and removing calendar events on your selected primary calendar when appointments are booked, rescheduled, or cancelled
• Querying free/busy availability across your selected calendars to prevent double-booking. We use Google's free/busy API, which returns only busy time windows — not event titles, descriptions, or attendee details.
• Receiving real-time notifications from Google when your primary calendar changes, so appointment availability stays up to date
• Periodically verifying that your calendar connection is still active
• Sending transactional emails, including appointment confirmations, reminders, reschedule notices, and cancellation notices
• Tracking email delivery status (such as whether an email was delivered or bounced) to ensure reliable communication
• Abuse prevention through rate limiting using IP addresses
• Audit logging to maintain the security and integrity of our platform by recording selected platform actions and operational metadata
• Monitoring platform performance and reliability through privacy-friendly analytics

HIPAA readiness and Protected Health Information

curavidas recognizes that scheduling data associated with therapy services may constitute Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). curavidas is designed with a HIPAA-conscious, privacy-first posture while readiness review is in progress.

To support privacy and security, curavidas maintains the following safeguards:

• Sensitive credentials and authentication tokens are encrypted at rest using AES-256-GCM encryption.
• All data is transmitted over TLS-encrypted connections.
• Transactional emails are sent through a protected email path while BAA and vendor evidence review is in progress.
• Infrastructure, hosting, and vendor relationships are subject to security and BAA evidence review before formal HIPAA use.
• Access to PHI is limited to the therapist who owns the data and authorized platform administrators for support purposes only.
• Selected security and operational audit logs record key platform actions.

Formal HIPAA use depends on a signed Curavidas Business Associate Agreement, appropriate therapist configuration, therapist policies, and completed vendor and security evidence review.

Data Security

We take the security of your data seriously. curavidas implements the following measures to protect your information:

• OAuth credentials are encrypted at rest using AES-256-GCM encryption before being stored in our database.
• All connections between your browser, our servers, and third-party services are encrypted using TLS.
• Rate limiting is applied to all public-facing endpoints to prevent abuse.
• Audit logs track actions performed on the platform for security monitoring.
• Error tracking, when enabled, is configured to scrub personally identifiable information before data leaves our servers.

Cookies & Local Storage

curavidas uses only essential cookies required for the service to function. We do not use tracking cookies or any third-party advertising cookies.

• Session cookie: A single essential cookie managed by NextAuth to maintain your authenticated session.
• Local storage: We may store widget preferences in your browser's localStorage on an opt-in basis. This data stays on your device and is not transmitted to our servers.

Analytics and Monitoring

curavidas uses operational monitoring tools to maintain reliability and diagnose errors. No third-party advertising trackers are used.

• Error tracking and performance monitoring (Sentry): When enabled, collects error reports and performance telemetry to help us identify and fix issues. Error reports are configured to scrub personally identifiable information, including client names, email addresses, and phone numbers, before transmission.
• External uptime monitoring (UptimeRobot): Periodically checks public endpoints and records availability status and response timing so we can detect outages.

Third-Party Services

We integrate with the following third-party services to provide our platform:

• Google Workspace (Google Calendar, Google Meet): We request full Google Calendar access to list all calendars in your account, query free/busy availability across your selected calendars (time windows only — no event content is read), create and manage appointment events on your primary calendar, receive real-time calendar change notifications, and generate video meeting links. Access is limited to scheduling purposes only.
• Zoom: For video appointment links.
• Paubox: For protected transactional email delivery, including booking confirmations and appointment reminders, while readiness and evidence review is in progress.
• Amazon Web Services (AWS): For database hosting and infrastructure.
• Cloudflare: For DNS management, proxy protection, and content delivery.
• Sentry: For error tracking and performance monitoring when enabled.
• UptimeRobot: For external availability monitoring.

Appointment details, including appointment type names and scheduling information, may be shared with these services as necessary to provide the platform's functionality. Each of these services has its own privacy policy. We encourage you to review their policies for information on how they handle your data.

Email Communications

curavidas sends transactional emails related to appointment scheduling, including booking confirmations, reminders, reschedule notices, and cancellation notices. These emails are delivered through Paubox through a protected email path while readiness and evidence review is in progress. We track email delivery status (such as whether an email was successfully delivered or bounced) to ensure reliable communication. You may unsubscribe from non-essential email communications at any time using the unsubscribe link included in each email.

Embeddable Booking Widget

When our booking widget is embedded on a third-party website, client data submitted through the widget is transmitted directly to curavidas and is subject to this Privacy Policy. Analytics tools or tracking scripts already present on the host website may independently collect data about your interaction with the widget. curavidas does not control the data collection practices of third-party websites. Please refer to the privacy policy of the website where you are using the widget for more information.

Data Retention

• Appointment records are retained for as long as the therapist's account is active, consistent with professional record-keeping requirements for healthcare providers.
• Audit logs and notification records are retained for operational and compliance purposes.
• Rate limiting data is automatically purged when the tracking window expires.
• Calendar cache data is temporary and expires within 24 to 48 hours.

Your Rights

You have the following rights regarding your personal information:

• Access: You may request a copy of the personal data we hold about you.
• Deletion: You may request that we delete your personal data. We will respond to deletion requests within 30 days, subject to any legal or professional record-keeping obligations.
• Opt-out of emails: You can unsubscribe from non-essential emails at any time using the unsubscribe link included in each message.

California residents (CCPA): We do not sell personal information. California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, to request deletion, and to non-discrimination for exercising these rights.

State privacy law rights: Depending on your state of residence, you may have additional privacy rights under applicable state laws. Please contact us to exercise any of these rights.

Children's Privacy

curavidas is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can take appropriate action.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of curavidas after any modifications constitutes acceptance of the revised policy. We encourage you to review this page periodically.

Contact Information

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: