Privacy, explained with care.

Scope and who we are

This Privacy Notice explains how CROW FINANCIAL HOLDINGS LLC DBA CURA COACH (“CuraCoach,” “we,” “us,” or “our”) handles personal information when you visit our public website, request information, register for an account, or use CuraCoach services.

This notice is not a medical practice’s Notice of Privacy Practices. When CuraCoach processes protected health information (“PHI”) for a healthcare provider or other covered entity, CuraCoach generally acts as that organization’s business associate and handles PHI under the applicable agreement, business associate agreement, and the customer’s instructions.

Information we may collect

Depending on how you interact with CuraCoach, we may collect:

• Business contact information: name, work email, telephone number, organization, professional role, and information submitted with a demo or support request.
• Account information: login identifier, organization membership, role, authentication events, security settings, and account activity.
• Service information: records provided by authorized healthcare customers, including patient, clinical, device, operational, billing-support, and communication data.
• Technical information: device and browser type, approximate network location, IP address, request time, security events, and limited diagnostic information.
• Communications: messages, feedback, support correspondence, and call or recording information when enabled, disclosed, and permitted.

Please do not submit patient information through public marketing or demo-request forms.

How we use information

We use personal information to provide and secure CuraCoach; authenticate users; administer accounts; respond to requests; support connected-care workflows; process authorized device, clinical, operational, and billing-support information; maintain audit history; detect misuse; improve reliability and accessibility; meet contractual obligations; and comply with applicable law.

CuraCoach does not use PHI for targeted advertising, and AI-assisted clinical content is designed to remain a draft until reviewed by an authorized human.

Healthcare information and HIPAA

HIPAA applies based on the parties, information, and activity involved. CuraCoach’s healthcare customers remain responsible for their own privacy notices, patient relationships, treatment decisions, and responses to individual-rights requests unless an agreement assigns a specific supporting function to CuraCoach.

When CuraCoach acts as a business associate, uses and disclosures of PHI are limited by the applicable business associate agreement, customer instructions, and law. Patients seeking access, amendment, restriction, or an accounting should generally contact their medical practice or health plan first. CuraCoach will support authorized customer requests as contractually required.

When information may be disclosed

We may disclose information to authorized customer users; vendors and subprocessors that help operate CuraCoach; professional advisers; billing, device, communication, hosting, security, and integration providers; and government or legal recipients when required or permitted by law. Access is intended to be limited to an appropriate purpose and the minimum information reasonably necessary.

Vendors that process PHI must be evaluated and contractually authorized before production use, including a business associate agreement when required. CuraCoach may also disclose information in connection with a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and legal protections.

Cookies and website technology

We may use essential cookies for security, authentication, session continuity, preferences, and core functionality. Authenticated clinical areas should not use advertising pixels or unapproved session-replay technology. If optional analytics are introduced, they must be configured to avoid patient information and sensitive form content and will be described through an appropriate notice or preference control.

Security and retention

CuraCoach uses layered safeguards designed for the sensitivity of the information involved, such as server-side authorization, tenant scoping, secure sessions, encryption, validation, audit events, private storage, backups, and monitoring. No system can guarantee absolute security, and the availability of these controls does not by itself establish legal compliance or certification.

We retain information for the period needed to provide services, satisfy contracts, preserve clinical and financial integrity, meet legal obligations, resolve disputes, and enforce agreements. Retention may vary by information type, customer instruction, jurisdiction, legal hold, and backup schedule.

Your choices and privacy rights

You may request correction of business contact information, update communication preferences, or ask a question about this notice through our contact page. Depending on where you live and the context, applicable law may provide rights to know, access, correct, delete, restrict, or obtain a copy of certain personal information, or to appeal a decision.

We may need to verify your identity and authority before acting. Some requests must be directed to the healthcare organization responsible for the record, and some information may be retained where law, safety, contracts, record integrity, or legitimate operational needs permit.

Children and public website use

The public CuraCoach website and business-contact forms are intended for healthcare and business professionals, not for children to use independently. CuraCoach may process information about minors only when supplied or authorized through an appropriate healthcare customer workflow and subject to the applicable agreement, permissions, and law.

Changes and contact

We may update this notice as CuraCoach, our vendors, or legal requirements change. A material revision will be identified by a new effective date and, when appropriate, additional notice.

To ask a privacy question, report a concern, or submit a request, use the CuraCoach contact form and label the message “Privacy.” Do not include medical details or other sensitive patient information in that public form.