Data Policy: What Data We Save
An open, comprehensive disclosure of the data collected, stored, and managed on Curvia Care • Last updated: March 15, 2026
Curvia Care adheres strictly to the Ghana Data Protection Act (Act 843), the General Data Protection Regulation (EU GDPR), and HIPAA security standards. We only save information that is directly necessary to deliver clinical healthcare workflows, maintain patient medical safety, process subscriptions, and safeguard system security.
1. Healthcare Professional & Facility Account Information
Saved when healthcare facilities register administrators, physicians, nurses, pharmacists, and medical staff
To create secure user accounts, authenticate medical staff, and ensure appropriate clinical permissions across hospital wards and departments, we collect and store:
Personal & Contact Details
- Full Name: First name and last name, used to identify medical providers and sign clinical notes.
- Professional Email Address: Used for secure login, two-factor authentication, and critical service notifications.
- Phone Number: Used for emergency technical alerts, SMS verification, and account recovery.
- Profile Photo (Optional): Staff avatar image uploaded to help patients and colleagues visually recognize staff.
Facility Profile & Role Permissions
- Healthcare Facility Name: The official name of your hospital, clinic, pharmacy, or diagnostic centre.
- Facility Classification: Whether the organization operates as a Clinic, Full Hospital, Pharmacy, or Diagnostic Center.
- Physical Location: City and country (e.g. Accra, Ghana), used to localise currency formatting and tax rules.
- Assigned Operational Role: Role designation (Doctor, Registered Nurse, Pharmacist, Lab Scientist, Radiologist, Billing Officer, Facility Administrator) to strictly control clinical chart access.
- Security Timestamps: Account creation date and last login time to detect inactive or compromised accounts.
2. Clinical Health Records & Patient Health Information (PHI)
Saved strictly on behalf of the licensed medical facility (Curvia Care acts as a Data Processor)
When healthcare providers use our Electronic Health Record (EHR) modules to care for patients, the platform stores clinical data entered by medical professionals. Each facility's data is completely isolated using strict cryptographic boundaries:
A. Patient Identification & Demographics
Patient Master IndexPatient full legal name, date of birth, age, biological sex, residential address, telephone number, emergency contact person details, and national health insurance identification (such as Ghana NHIS card number).
B. Consultations, SOAP Notes & Vital Signs
Physician & NursingChief patient complaints, subjective symptoms, recorded vital signs (blood pressure, body temperature, pulse/heart rate, respiratory rate, blood oxygen saturation SpO2, height, weight, BMI), physician examination notes, diagnostic assessment codes (ICD-10 classifications), and emergency triage priority.
C. Prescriptions & Pharmacy Dispensary Logs
Pharmacy ModulePrescribed pharmaceutical drugs, dosage instructions, administration route, frequency, duration, identity of the prescribing doctor, dispensing pharmacist verification, dispensing timestamps, and inventory batch deductions.
D. Laboratory Investigations & Diagnostic Results
Laboratory ModuleLaboratory test requisitions, specimen type, test results, standard biological reference ranges, critical indicator alerts, and electronic sign-off by the licensed laboratory scientist.
E. Radiology, Medical Scans & Inpatient Records
Imaging & WardsDiagnostic imaging requests (X-Ray, Ultrasound, CT, MRI), scan reports, radiologist findings, DICOM metadata, hospital ward admissions, bed allocations, nursing progress charts, and discharge summaries.
3. Subscriptions, Invoicing & Payment Records
Saved to manage facility licensing, renewal dates, and commercial tax compliance
Subscription Details
- Plan Tier: Selected package (e.g., Free Trial, Curvia Standard, Enterprise, Custom Facility).
- Subscription Status: Current status (Active, Trialing, Past Due, Cancelled, Expired).
- Billing Cadence: Monthly or annual billing cycle.
- Lifecycle Dates: Plan start date, trial expiration date, and upcoming renewal billing date.
Transaction Records
- Payment Amount & Currency: Total invoiced sum and currency code (GHS, USD, EUR, GBP).
- Payment Channel: Method used (Mobile Money, Debit/Credit Card, Direct Bank Transfer).
- Transaction Reference: Alphanumeric payment reference and payment gateway reconciliation hash.
- Digital Receipt URL: Secure link to the downloadable, itemized tax invoice.
4. Institutional Proposals & Formal Quotation Requests
Saved when hospital boards, medical directors, and clinics request formal proforma invoices and tailored proposals
5. AI Chatbot Interactions & Live Demo Bookings
Saved when prospective customers interact with the Curvia AI widget or book a guided demonstration
Live Demo Requests
- Contact Name & Role: Name of the person booking the demonstration.
- Direct Contact Details: Email address and direct mobile telephone number.
- Institution Name & Type: Name and operational type of the medical facility.
- Preferred Demonstration Date: Desired appointment date and key operational challenges described.
AI Assistant Conversations
- Chat Session Identifier: A temporary session code to maintain conversation context between website pages.
- User Queries & AI Responses: The text questions you submit and the answers provided by our AI assistant.
- Detected Inquiry Topic: Categorization (e.g. pricing questions, technical feature inquiries, demo scheduling).
- Timestamp: Date and time of conversation for quality assurance.
6. Platform Diagnostics, Sandbox Testing & Browser Storage
Saved to ensure platform stability, prevent malicious attacks, and support desktop/mobile applications
7. Trusted Infrastructure & Technical Service Providers
To guarantee 99.9% uptime, rapid page loads, and compliant electronic payments, Curvia Care partners with industry-leading infrastructure providers bound by strict Data Processing Agreements (DPAs):
Enterprise cloud hosting with AES-256 encryption at rest, automated offsite backups, and SOC2 Type II security certification.
Processes Mobile Money, Visa, and Mastercard transactions under PCI-DSS Level 1 regulatory supervision.
Blocks distributed denial-of-service (DDoS) attacks, terminates TLS 1.3 certificates, and delivers high-speed asset caching.
Dispatches two-factor authentication security codes, appointment alerts, and password reset notifications.
8. Exercising Your Rights: Data Export & Permanent Deletion
In strict adherence to the Right to Data Portability and the Right to Erasure ("Right to be Forgotten") under Act 843 and the GDPR:
Healthcare facility administrators have the right to request a complete, machine-readable export of all facility accounts, clinical records, pharmacy logs, and invoicing files in standardized CSV or JSON format.
Fulfilled within 14 business days.
Upon verified written authorization from a healthcare facility director, all non-statutory records and uploaded files are cryptographically sanitized and purged according to international data disposal standards.
Permanent cryptographic erasure.