Privacy Policy
Effective Date: August 2026
Curiflow Inc. ("Curiflow," "we," "us," or "our") provides a platform that converts healthcare documents into structured data. Customers use it through our API, web console and related services (together, the "Services"). This Privacy Policy explains how we collect, use, disclose and protect information when you visit www.curiflow.com (the "Site") or use the Services.
1. Scope
This policy covers:
- Visitors to the Site;
- Account users: people who register for, sign in to, or manage a Curiflow account or API keys; and
- Customer Data: documents, files and other content that our customers submit to the Services, and the outputs we generate from it.
2. Our Role
- Account, Site and usage information. Curiflow decides how this information is used and is responsible for it as described in this policy.
- Customer Data. We process Customer Data on behalf of our customers and on their instructions. Where Customer Data includes protected health information (PHI) under HIPAA, Curiflow acts as a business associate. Our handling of PHI is governed by our agreement with the customer and the Business Associate Agreement (BAA) we sign with them.
If this policy conflicts with a customer's written agreement or BAA, the agreement or BAA governs how we handle that customer's data.
3. Information We Collect
a. Account and contact information. Your name, business email address, organization and role, and any other information you give us when you create an account, request access, contact us or communicate with our team.
b. Customer Data. Documents and files submitted to the Services through the API or console, and the structured outputs we produce from them. Customer Data may contain PHI or other sensitive information about patients and other individuals.
c. Usage and technical data. IP addresses, API request metadata (for example timestamps, endpoints called, response codes and job identifiers), API key and client identifiers, browser and device type, and service logs. We collect this to operate, secure and meter the Services.
d. Cookies and similar technologies. The Site and console use cookies needed for sign-in, security and basic functionality. See Section 13.
4. How We Use Information
We use account, contact and usage information to:
- provide, operate, maintain and support the Services;
- authenticate users and manage accounts and API keys;
- monitor, secure and troubleshoot the Services, and detect and prevent fraud, abuse and security incidents;
- measure usage for billing and capacity planning;
- communicate with you about the Services, including service notices and responses to your requests; and
- comply with legal obligations and enforce our agreements.
We use Customer Data only to provide the Services to the customer who submitted it, as instructed by that customer and permitted by our agreement with them. Examples include processing documents, returning results, providing support the customer asks for, and keeping the Services secure.
5. Artificial Intelligence and Model Training
The Services use machine learning models to process documents. Curiflow does not use Customer Data, including any PHI, to train, fine-tune or otherwise improve any machine learning model. Models process Customer Data only to generate output for the customer who submitted it.
6. How We Share Information
We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We disclose information only in the following cases:
- Subprocessors and service providers that help us run the Services (see Section 7). They are contractually required to protect the information and to use it only to provide services to Curiflow. Any subprocessor that handles PHI is bound by a BAA.
- At a customer's direction or with consent, for example when a customer instructs us to send outputs to a system or third party they choose, or when you otherwise ask us to share your information.
- Legal requirements, when required by law, regulation, legal process or a valid request from a public authority.
- Protection of rights and safety, when we believe in good faith that disclosure is necessary to investigate, prevent or respond to fraud, abuse, security incidents or illegal activity; to enforce our agreements; to establish, exercise or defend legal claims; or to protect the rights, property or safety of Curiflow, our customers or others.
- Business transfers, in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business or assets. Any successor must protect the information as described in this policy.
Disclosures of Customer Data, including PHI, are made only as permitted by our agreement with the customer, the BAA and applicable law.
7. Subprocessors
Our subprocessors include:
| Subprocessor | Purpose | Data processed |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, storage and infrastructure | Customer Data, account and usage data |
| Sentry | Application error monitoring | Technical and diagnostic data |
The current list of subprocessors is maintained in our Trust Center at https://trust.curiflow.com.
8. Data Security
We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the data we handle. These include:
- encryption of data in transit (TLS) and at rest;
- role-based access controls and least-privilege access, limiting production data to authorized personnel;
- unique authentication for user accounts and production systems;
- continuous security and compliance monitoring;
- regular security assessments, including penetration testing; and
- documented business continuity, disaster recovery and incident response procedures.
Curiflow maintains a SOC 2 Type 2 report and a HIPAA compliance program. More detail is available at https://trust.curiflow.com.
9. Data Location
Curiflow stores and processes data in the United States.
10. Data Retention and Deletion
- Customer Data is retained according to our agreement with the customer and the customer's configuration of the Services. Customers can ask us to delete their Customer Data. When the agreement ends, we delete or return Customer Data as the agreement requires, unless the law requires us to keep it.
- Account information is kept while the account is active and afterwards only as long as needed to meet legal, accounting or security obligations.
- Usage and log data is kept for a limited period for security, troubleshooting and billing purposes.
11. Security Incidents and Breach Notification
If a security incident affects Customer Data, we will notify affected customers as required by our BAA, the HIPAA Breach Notification Rule and other applicable law.
12. Your Rights and Choices
Depending on where you live, you may have the right to:
- access and get a copy of your personal information;
- correct inaccurate or incomplete information;
- request deletion of your personal information, subject to our legal obligations; and
- opt out of non-essential communications.
To exercise these rights, contact help@curiflow.com. We will not discriminate against you for exercising your rights.
Requests about Customer Data. These rights apply only to the account, contact and usage information Curiflow holds about you. Curiflow processes Customer Data solely on behalf of our customers, and we do not accept or act on requests from individuals about Customer Data, including requests from patients about their health information. Please direct any such request to the healthcare organization or customer that submitted the data.
13. Cookies
We use cookies and similar technologies that are needed for the Site and console to work, including keeping you signed in and protecting against security threats. You can control cookies through your browser settings. Disabling essential cookies may stop the console from working correctly.
14. Children's Privacy
The Site and Services are built for businesses and are not directed to children. We do not knowingly collect personal information from children through the Site or account registration.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a new effective date. For material changes, we will also notify customers by email or through the Services.
16. Contact Us
For questions about this Privacy Policy or our data practices:
Curiflow Inc.
1111B S Governor's Ave STE
Dover, Delaware 19904
Privacy questions: help@curiflow.com
Security matters: security@curiflow.com
Trust Center: https://trust.curiflow.com