Consumer Health Data Privacy Policy

Our role

Curaterra provides founder-led, nonclinical guidance and journey support for people exploring dental care in Colombia. Curaterra is not a dental provider and does not diagnose, recommend treatment, determine candidacy, or provide clinical care.

This policy explains how Curaterra handles consumer health data that you choose to provide. It is separate from Curaterra's general website terms and from any later authorization involving a specific dental provider.

Consumer health data we may collect

Depending on what you choose to share, Curaterra may collect:

• identity and contact information, such as your name, email address, and optional WhatsApp number;
• the broad category of dental care you are exploring;
• general goals, journey stage, timing, travel origin, and support priorities;
• general context or questions you enter in an inquiry; and
• consent records, form type, submission time, submission identifier, and policy/version information.

Curaterra's public inquiry forms are not intended to collect diagnoses, medication lists, medical histories, X-rays, CBCT files, clinical photographs, laboratory results, or other clinical records. Please send clinical records directly to a dental provider when the provider requests them.

Sources of consumer health data

Curaterra collects consumer health data directly from you when you submit an inquiry, communicate with Brad, or ask Curaterra to help organize a next step.

Any later exchange of consumer health data involving a dental provider will be addressed through the applicable disclosure, authorization, or consent process before that workflow begins.

Why Curaterra collects and uses it

Curaterra may use consumer health data to:

• review and respond to your inquiry;
• understand what kind of nonclinical support you are seeking;
• determine whether Curaterra's support model may be a fit;
• organize and explain the next steps you request;
• maintain consent and inquiry records; and
• operate, secure, troubleshoot, and comply with legal obligations applicable to Curaterra's systems.

Curaterra does not use inquiry consent as permission for marketing.

Sharing and processors

Submitting a public inquiry does not authorize Curaterra to share your consumer health data with a dental clinic or other third party merely because you submitted the form.

At the public-inquiry stage, Curaterra does not automatically send your consumer health data to a dental clinic.

If you later ask Curaterra to involve a specific dental provider, any required sharing consent or authorization will identify the provider, the information to be shared, and the purpose of the sharing before that workflow begins.

Curaterra does not sell consumer health data.

Service providers that operate Curaterra's website hosting, form processing, email, communications, security, and data systems may process information on Curaterra's behalf. These service providers are used to operate Curaterra's systems and are not authorized by the public inquiry consent to independently use your consumer health data for unrelated purposes.

Current categories include website-hosting and form-processing services such as Netlify, email and communications services, and other technology services necessary to operate Curaterra.

Curaterra does not intentionally send names, contact information, treatment selections, free-text inquiry content, journey stage, or consent values to Google Ads in a successful-inquiry conversion event.

Your choices and requests

You may ask Curaterra to:

• confirm whether Curaterra is collecting, sharing, or selling consumer health data concerning you;
• access consumer health data Curaterra maintains concerning you;
• receive, when applicable, a list of third parties and affiliates with whom Curaterra has shared or sold your consumer health data, together with an available email address or other online contact mechanism for those entities;
• withdraw consent for future collection or sharing of consumer health data concerning you;
• request deletion of consumer health data concerning you; and
• appeal Curaterra's refusal to take action on a consumer health data request.

To make a request, email hello@curaterra.io with the subject Consumer Health Data Request.

Curaterra may request additional information reasonably necessary to authenticate you and your request.

Curaterra will respond to an authenticated request without undue delay and, where required by applicable law, within 45 days of receiving the request. When reasonably necessary because of the complexity or number of requests, that period may be extended once by an additional 45 days after Curaterra informs you of the extension and the reason for it within the initial response period.

If Curaterra refuses to take action on a request, you may appeal by replying to the decision and stating that you wish to appeal.

Curaterra will respond in writing to an appeal within 45 days of receipt. If an appeal is denied, Curaterra will provide a method for contacting the Washington State Attorney General to submit a complaint.

Changes to this policy

Curaterra will identify material policy revisions with a new version and effective date. Consent records are intended to retain the policy version associated with the inquiry.