Effective from: 7 July 2026
Last updated: 7 July 2026
This Privacy Policy explains how Curaux s.r.o. processes the personal data of users of the Histeva application.
Histeva is a digital tool designed for personal record-keeping of meals, symptoms, notes and other related entries. The application is intended solely as an information and record-keeping tool for the user's own use. It is not a substitute for medical diagnosis, healthcare or professional nutritional advice.
The controller of personal data is:
Curaux s.r.o.
Company ID No.: 21425183
Registered office: Varšavská 715/36, Vinohrady, 120 00 Prague 2
Email: info@histeva.com
Hereinafter referred to as the "controller" or "we".
We process only the data necessary for the operation of the application, account management, service security and improvement of the user experience.
We process in particular:
We need this data to create and manage the account, enable login to the application and secure access.
The user may enter into the application, in particular:
This data may, on its own or in combination, reveal information about the user's health. We therefore treat it as special category data under the GDPR and protect it with increased care.
When you use the application, we may process technical data, in particular:
We use this data to secure the application, prevent misuse, fix errors and maintain stable operation of the service.
If the application includes paid features, payments may be processed through an external payment service provider, such as Stripe.
In such a case, we do not process full payment card details. We process only the information necessary to verify payments, manage subscriptions, keep accounting records and comply with legal obligations.
If a user contacts us, we process the data contained in the communication, in particular the email address, the content of the message and related data necessary to handle the request.
We process analytics data only where the user has given us consent to do so.
Analytics help us understand how the application is used and improve its functionality and clarity. We do not activate analytics tools without the user's consent.
We process personal data for the purposes set out below.
We process data to create an account, enable login and allow use of the application.
Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR.
We process data to store, display and organise entries that users enter into the application themselves.
Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR.
Where entries may reveal information about a user's health, we also process them on the basis of explicit consent pursuant to Article 9(2)(a) GDPR.
Histeva allows users to record symptoms, food reactions and other related notes. This data may constitute data concerning health.
We process this data only on the basis of the user's explicit consent.
Legal basis: Article 9(2)(a) GDPR.
Without this consent, it is not possible to use parts of the application that process symptoms, reactions or other health-related entries.
We process technical data to protect the application, user accounts and data.
Legal basis: legitimate interests pursuant to Article 6(1)(f) GDPR.
Our legitimate interest is to ensure the secure and stable operation of the application.
We may process technical data and error logs to correct errors, improve stability and maintain the application.
Legal basis: legitimate interests pursuant to Article 6(1)(f) GDPR.
We process analytics data only after the user has given consent.
Legal basis: consent pursuant to Article 6(1)(a) GDPR.
Consent may be withdrawn at any time in the cookie settings or similar privacy settings.
We process data to respond to enquiries, provide technical support and handle requests.
Legal basis: performance of a contract or legitimate interests, depending on the nature of the communication.
We may process certain data to comply with legal obligations, for example in relation to accounting or tax records.
Legal basis: compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.
During registration or when first using features that process health-related data, we ask the user for separate, explicit consent.
This consent is separate from acceptance of the application's Terms of Use.
The user may withdraw consent at any time through a feature in the application, where available, or by emailing info@histeva.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
After consent is withdrawn, we will delete or anonymise health-related data unless we have another legal basis for retaining it. Withdrawing consent may mean that some features of the application can no longer be used.
Personal data may be processed by our trusted technical and operational service providers.
We use in particular:
| Provider | Purpose |
|---|---|
| Supabase | authentication, database, storage of user data |
| Vercel | hosting and operation of the web application |
| Resend | sending transactional emails, such as login or system messages |
| Stripe | payment processing, where paid features are active in the application |
We do not disclose health-related data to third parties for advertising purposes.
We have or will have appropriate data processing agreements in place with processors.
Some service providers may be based outside the European Union or may process data outside the EU.
Where personal data is transferred outside the EU, we use appropriate legal mechanisms under the GDPR, in particular Standard Contractual Clauses or other appropriate safeguards.
The specific arrangements depend on the current contractual and technical conditions of the individual providers.
We retain personal data only for as long as necessary for the relevant purpose.
| Data category | Retention period |
|---|---|
| Account data | for the duration of the user account |
| User entries | for the duration of the account or until deleted by the user |
| Health-related data | for the duration of the account or until consent is withdrawn, unless there is another legal basis for retention |
| Technical logs | for as long as necessary to ensure security and troubleshoot errors, generally 30–90 days |
| Support communications | for as long as necessary to handle the request and protect legal claims |
| Payment and accounting data | for the period required by law |
| Backups | for a limited period until they are overwritten or deleted |
After an account is deleted, we will delete or anonymise personal data unless we have a legal basis for retaining it for longer.
We protect personal data through technical and organisational measures.
In particular, we use:
We protect data relating to symptoms, reactions and other health-related entries with increased care.
To improve the application, we may use aggregated or pseudonymised data where the technical configuration allows this.
Aggregated data does not allow a specific user to be directly identified.
We do not use health-related data for advertising targeting and do not share it with advertising partners.
Under the GDPR, users have, in particular, the right to:
To exercise your rights, contact us at info@histeva.com.
Histeva does not carry out automated decision-making that produces legal or similarly significant effects for users.
The application does not make diagnoses, assess health status or provide personalised treatment or dietary recommendations. The overviews displayed are only summaries of data that the user has entered into the application.
The application is intended for persons over the age of 16.
If we become aware that the application is being used by a person under the age of 16 without the appropriate authorisation, we may block or delete the account.
We may update this Privacy Policy.
The current version will always be available at histeva.com. We may inform users of material changes by email or directly in the application.
For questions about personal data protection, contact: info@histeva.com