Privacy Policy for Cursio

Last updated: November 2, 2026

1. Controller

Cursio is developed and offered by a private individual, not for profit.

Chaloemwatthana Patchimma

Email: help@cursio-app.de

2. What data the app processes – and where

When you use the app, it stores on your device:

• Timeline entries: symptoms, medication doses, readings, notes, daily check-ins
• Medications, side effects, supply and reminder times
• Doctor's visits with questions, notes, to-dos and attached documents (photos, PDF files)
• Lab results and the plan for regular check-ups
• Your health profile (allergies, conditions, long-term medication, blood type, vaccinations, notes for helpers)
• An address book of your doctors (name, optionally phone and address)
• Photos you take or pick for symptoms or pain
• Your name and date of birth, only if you choose “remember” when exporting a PDF
• Settings (e.g. language, appearance, units, target ranges)

This data may be health data within the meaning of Art. 9 GDPR. It is stored only locally in the app's protected storage and is not transferred to me or any third party. I therefore do not process your health data.

Photos and documents are copied into the app's private storage and are not saved to your photo library.

3. When data leaves your device

Only when you actively trigger it:

• Sharing a PDF report: You choose who or where (e.g. email, messenger, Files app). You can optionally protect the PDF with a password (AES-256). The password is stored neither in the app nor in the PDF.
• Printing: The PDF goes through your device’s print dialog to the printer you choose there (e.g. via AirPrint or your device’s print service).
• Exporting a backup: The backup is encrypted with a password you choose (AES-256-GCM, key derivation PBKDF2-SHA256) and saved or sent via your device's share sheet. Without the password, nobody can read it – not even me. A forgotten password cannot be recovered.
• Exporting as a spreadsheet (CSV): All entries as an unencrypted spreadsheet that you pass to an app of your choice via the share sheet (e.g. Excel, Numbers, Files app). Anyone with the file can read it.
• Adding a visit to your calendar or sharing it as a file: The visit goes into your device's calendar or, as an .ics file, wherever you share it. Calendars are often synced via iCloud, Google or an employer. You see the entry first and choose the calendar yourself. Without the “Include doctor and reason” option it only contains “Doctor's appointment”, the time and the practice address; with it, also the doctor, the reason and the practice phone number. Cursio needs no access to your calendar for this.
• Medical ID: You copy or share the texts for your device's Medical ID yourself. Cursio does not fill in anything automatically.
• Maps and phone: When you tap “Route”, “Search in Maps” or “Call” for a visit, the corresponding app on your device opens (Apple Maps, Google Maps or Phone) with the address, search term or number. Cursio itself transmits nothing and never asks for your location.
• Website: When you tap “Website” in the settings, your browser opens cursio-app.de. Nothing from the app is transmitted. As with any website visit, the web host receives technically necessary data such as your IP address.
• Contact form on the website: If you write to me through the form, your email address, the chosen category, the subject and your message go through the web host IONOS by email to my Proton mailbox. I only use them to reply to you and delete them once the request is resolved. The form is separate from the app and transmits no data from it.

Further processing by the apps and services you choose is subject to their privacy policies.

Device backups: If you use iCloud Backup (Apple) or Google backup (Android), they may include the app's data. You control this in your device settings; Apple's or Google's terms apply.

4. Permissions

The app only asks for permissions when you use the related feature:

• Camera: Taking photos of symptoms or documents, scanning the PZN code on medication packs
• Photos / library: Picking existing images
• Files: Attaching PDF documents, restoring backups
• Notifications: Local reminders for medications, ongoing symptoms, the daily check-in, backups and due check-ups
• Face ID / Touch ID / fingerprint: Optional app lock
• Apple Health (iPhone only, only if you turn it on): Reading the values you choose

Reminders are scheduled and triggered by the device itself (local notifications). No push service and no server is used. Reminders about medications and symptoms show their names and, depending on your device settings, may be visible on the lock screen. You can change this in your device's notification settings (“Show Previews”).

Apple Health: If you turn it on, Cursio reads the values you choose on your iPhone (weight, blood pressure, resting heart rate, blood glucose, oxygen saturation, body temperature) and stores them like your own entries, only in the app. Cursio writes nothing to Apple Health, shares this data with no one and never uses it for advertising. You can revoke access at any time in the Health app under Sharing → Apps → Cursio.

Biometrics: Face ID, Touch ID or fingerprint checks are handled by the operating system. The app only learns “successful” or “not successful”, never any biometric data.

5. No analytics, no ads

The app contains no analytics, tracking or advertising software and no third-party crash reporting. It does not connect to any servers – neither mine nor anyone else's.

6. App Store and Google Play

When you download the app, Apple or Google process data under their own privacy policies (e.g. for the download and updates). If you agreed in your device settings to share analytics or crash data with app developers, Apple or Google provide me with aggregated, non-personal statistics. These contain no content from the app.

7. Deleting your data

You can delete all data at any time:

• in the app under Settings → Delete all data, or
• by uninstalling the app.

PDFs, spreadsheets, calendar entries or backups you have already shared remain wherever you shared them and must be deleted there.

8. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a data protection authority. As I do not store any personal data about you, I generally cannot provide information about content – it is only on your device. For questions, contact me at the email address above.

9. Children

The app is not specifically aimed at children under 16.

10. Medical notice

Cursio is for self-documentation. The app does not diagnose, does not give medical advice and does not replace consultation with a doctor.

11. Changes

If the app changes in a way that processes data differently (e.g. through optional cloud sync), I will update this policy and point it out in the app.