Privacy Policy
Privacy Policy version 1.0 | Last updated 26 September 2026
Privacy Policy
1. Who we are
1.1 Cura Compliance UK Limited, trading as Cura Compliance Consulting, is responsible for the personal information described here. We help healthcare businesses get licensed in ten US states and Washington, DC.
1.2 This Privacy Policy covers curacomplianceconsulting.com and everything we do for clients. It does not cover other websites we link to.
1.3 For anything about privacy, email info@curacomplianceconsulting.com. Put "Privacy request" in the subject line and we will route it properly.
2. What we collect
2.1 What you give us. When you contact us, buy from us, or work with us:
- your name, email address and phone number;
- your business name, the state you plan to operate in, and the license type you want;
- whatever you write in a message, send by email, or tell us on a call;
- billing name and address when you buy a service;
- for a license application, the information the agency requires. That can include ownership and corporate records, professional history, and background check details for owners, officers, administrators and directors.
2.2 What we collect automatically. When you visit the website we record your IP address, rough location, browser and device type, the pages you look at, where you arrived from, and the time. Our contact form also records the IP address the submission came from, which we use to block spam.
2.3 Payments. Card payments are processed by Stripe. Your card details go straight to Stripe. We never see or store a full card number.
2.4 What we do not want. We do not ask for patient records and we ask you not to send them. Our HIPAA Compliance Notice explains this in full.
3. Why we use it
- to answer your inquiry and give you a quote;
- to do the work, including preparing and filing your application with the agency;
- to take payment and keep accounting records;
- to send you service messages about your project;
- to send updates and offers, if you asked for them, until you unsubscribe;
- to keep the site working, block spam and prevent fraud;
- to measure which pages and ads bring people to us;
- to meet our legal, tax and professional record-keeping obligations.
3.1 We do not make decisions about you by automated means, and we do not profile you beyond the basic advertising measurement described in Section 4.
4. Cookies and tracking
4.1 Necessary. Cookies that make the site work: your shopping cart and checkout, our security plugin, and our caching system. The site cannot run properly without these.
4.2 Analytics. We use Google Analytics through Google Tag Manager to count visits and see which pages are useful. Google receives your IP address.
4.3 Advertising. We use the Meta pixel, ID 2061939928016618. It tells Meta which pages you visited on our site so we can measure ads and show them to people who have visited before. Under California law this counts as sharing personal information for cross-context behavioral advertising, so we say so plainly rather than claiming we share nothing.
4.4 Fonts. Our pages load typefaces from Google Fonts, which means Google receives your IP address when a page loads.
4.5 Turning it off. You can block or delete cookies in your browser, install Google's opt-out add-on for Analytics, and adjust your Meta ad settings. We honor the Global Privacy Control signal where the law requires it. Blocking necessary cookies will break parts of the site.
5. Who we share it with
5.1 We share personal information only with the following, and only as far as each one needs it:
- State licensing agencies and accreditors, because submitting your application to them is the service you bought;
- Stripe, to take payment;
- Google, for analytics, tag management, fonts and our product listings;
- Meta, through the pixel described above;
- Hostinger, which hosts the website and delivers our email;
- subcontractors and professional advisers, under the same duty of confidentiality;
- law enforcement, courts or regulators, where we are legally required to;
- a buyer, if the business is ever sold, under the same commitments.
5.2 We do not sell your personal information for money. We have never done so.
6. Where your information is held
6.1 Our team is in the United Kingdom, so information you send us is stored and processed there under UK data protection law. Some of our suppliers, including Stripe and Google, hold data in the United States and elsewhere.
6.2 If your own policies require your records to stay in the United States, tell us before you engage us and we will tell you honestly whether we can meet that.
7. How long we keep it
- Inquiries that do not become work: 24 months, then deleted.
- Client project files, including application records: 7 years after the last work we did for you, which matches normal professional and tax record-keeping.
- Accounting and payment records: 7 years.
- Marketing list: until you unsubscribe, then we keep a suppression record so we do not email you again by mistake.
- Website analytics: 14 months.
8. How we protect it
8.1 The site runs over an encrypted connection. Our email is sent over authenticated SMTP. Access to client files is limited to the people doing your work. We run a security plugin that blocks malicious traffic, and staff and subcontractors are under written confidentiality obligations.
8.2 No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach ever affects your information, we will tell you and the relevant authorities within the timeframes the law sets.
9. Your rights, wherever you live
9.1 You can ask us to:
- tell you what personal information we hold about you;
- give you a copy, in a portable format;
- correct anything that is wrong;
- delete it, where we are not required to keep it;
- stop sending you marketing, which you can also do from any email we send.
9.2 We will not treat you differently for exercising any of these rights.
10. If you live in California
10.1 Under the California Consumer Privacy Act as amended, you have the rights in Section 9 plus the right to know the categories of personal information we collect, the sources, the purpose, and the categories of third party we disclose to. Sections 2, 3 and 5 set all of that out.
10.2 We do not sell personal information. We do share it for cross-context behavioral advertising through the Meta pixel. To opt out, email us with "Do Not Sell or Share My Personal Information" in the subject line, or switch on Global Privacy Control in your browser, which we honor automatically.
10.3 We do not collect sensitive personal information for the purpose of inferring characteristics about you.
10.4 You may use an authorized agent. We will ask for proof of their authority and verify your identity before we act.
10.5 We confirm requests within 10 business days and answer within 45 days. If we need longer we will tell you why and take up to 45 more.
11. If you live in another state with a privacy law
11.1 Texas, Virginia, Colorado, Connecticut, Oregon, Montana and a growing number of other states give residents similar rights. If you live in one of them you have the rights in Section 9, plus the right to opt out of targeted advertising, and we honor recognized universal opt-out signals such as Global Privacy Control.
11.2 If we refuse a request, you may appeal by replying to our decision. We will answer the appeal within 60 days, and if we still refuse we will tell you how to complain to your state attorney general.
12. How to exercise your rights
12.1 Email info@curacomplianceconsulting.com. Tell us what you want and which state you live in. We will ask a couple of questions to confirm it is really you, because handing your records to the wrong person would be worse than the delay.
12.2 This is free. If a request is repetitive or excessive we may charge a reasonable fee, and we will tell you before we do.
13. Children
13.1 Our services are for businesses. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, tell us and we will delete it.
14. Changes to this Privacy Policy
14.1 If we change this policy we will update the date at the top and post the new version here. If a change materially affects your rights we will tell clients by email rather than leaving you to notice.
15. Contact us
15.1 Email info@curacomplianceconsulting.com or message +44 7470 390526 on WhatsApp. If you are not happy with how we handled a privacy request, you may complain to your state attorney general, or to the UK Information Commissioner's Office, which supervises us as an English company.
Terms of Service
Cura Compliance UK Limited, a company registered in England and Wales (company number 15946204), trading as Cura Compliance Consulting and referred to below as "we", "us" or "our".
Registered office: Flat 4, 10 St. Marys Road, Doncaster, England, DN1 2NP
US correspondence address: 5900 Balcones Drive, STE 100, Austin, TX 78731
info@curacomplianceconsulting.com | WhatsApp +44 7470 390526
Version 1.0. The version in force when you engage us governs your project.
Please read this before you hire us. This agreement explains what we do, what we need from you, what things cost, and what happens if something goes wrong. You accept it when you buy a service from us, as set out in Section 14. If anything here is unclear, ask us before you buy.
1. Who we are and what this covers
1.1 Cura Compliance Consulting helps healthcare businesses get licensed in ten US states and Washington, DC: California, Florida, Georgia, Louisiana, Michigan, Missouri, North Carolina, Ohio, Pennsylvania, Texas, and the District of Columbia.
1.2 These terms apply to every service we provide, in every state we serve. If a written quote or statement of work says something different, that document controls for that project only, and the rest of these terms still apply.
1.3 We work remotely and everything is handled online. You are contracting with Cura Compliance UK Limited, an English company whose team is based in the United Kingdom. Our Austin address is a correspondence address, not a staffed office. We tell you this up front so you know exactly who you are dealing with.
2. What we do, and what we do not do
2.1 Depending on what you buy, we may prepare and file your state license application, write your policies and procedures, get you ready for a state survey or accreditation, and handle the agency's follow-up questions with you.
2.2 We are not a law firm and we are not attorneys. Nothing we prepare or tell you is legal advice, and hiring us does not create an attorney-client relationship. If you need legal advice, hire an attorney licensed in your state.
2.3 We are not accountants or tax advisors, and we do not give clinical, medical or nursing advice. Decisions about patient care belong to you and your clinical staff.
2.4 We are independent. We are not affiliated with, endorsed by, or acting on behalf of any state agency, the Centers for Medicare and Medicaid Services, or any accrediting organization.
3. What we need from you
3.1 Give us accurate, complete information, and tell us promptly when something changes. Most applications that fail do so because something was wrong or missing at the start.
3.2 Tell us up front about anything an agency will ask about. That includes previous license applications, denials, revocations, exclusions, enforcement actions, bankruptcies, and criminal history for any owner, officer, administrator or director.
3.3 Reply to us within five business days unless we agree otherwise. State agencies work to their own deadlines, and a slow reply can cost you your place in the queue.
3.4 Give us one main point of contact, and make your key people available when an agency needs them.
3.5 Check anything we prepare before it is filed or put into use. You remain responsible for your own compliance with the law.
3.6 Treat our staff with respect. We will end an engagement immediately, with no refund, for abusive, threatening or discriminatory behavior.
4. Fees and payment
4.1 We give you a written quote before we start. It sets out what is included, what is not, and when payment is due. All our prices are in US dollars.
4.2 Unless your quote says otherwise, payment is due in full before we begin work.
4.3 State and agency fees are separate from ours. Application fees, license fees, background checks, fingerprinting, accreditation fees and surety bonds are paid by you, directly to the agency or vendor. We never collect or hold those funds and we cannot refund them.
4.4 Our fees exclude sales or other applicable taxes. Where tax applies, we add it.
4.5 Invoices not paid by the due date accrue interest at 1.5% per month (18% per year), or the maximum your state permits if that is lower. We may pause work and hold deliverables until payment clears.
4.6 If you ask for work outside the agreed scope, we quote it separately and wait for your written approval before starting.
5. Refunds and cancellation
5.1 Within 14 days of payment, and before substantial work has started, you may cancel for a full refund. Ask in writing.
5.2 After that, or once substantial work has started, we refund what you paid less the value of the work already done at our standard rates.
5.3 Once your application has been submitted to the agency, the fee for that application is non-refundable.
5.4 Where we have delivered a finished document, such as a policy manual, the fee for that document is non-refundable once you have received it.
5.5 If we make a material error, we correct it and resubmit at no charge. That is our first remedy, and in most cases it is the right one.
5.6 We will not refund where the outcome was caused by any of the following:
- information you gave us that was wrong, incomplete or misleading;
- your failure to follow our written recommendations;
- anything you sent the agency that departed from our written advice;
- changes to your business, premises, staffing or ownership that you did not tell us about;
- your own performance at an agency interview, survey or inspection.
5.7 To request a refund, email info@curacomplianceconsulting.com within 30 days of the event behind the request. We acknowledge within 5 business days, decide within 14 days, and pay approved refunds within 30 days to the original payment method.
6. What we cannot guarantee
6.1 We cannot guarantee that any agency will approve you. That decision belongs to the state, to CMS, or to the accreditor, and it is theirs alone.
6.2 Any timeline we give is an estimate based on how fast the agency is moving at the time. Agencies change their speed, their forms and their rules without notice.
6.3 We are not responsible for delays or outcomes caused by agency backlogs or policy changes, by federal action such as a Medicare enrollment moratorium, by changes in law, by issues found during a survey, or by anything you did not disclose to us.
6.4 Getting licensed is the start, not the finish. Staying compliant afterwards is your responsibility.
7. Confidentiality and your information
7.1 We keep your business information confidential and use it only to do the work you hired us for. We do not sell it.
7.2 We may share it where the law requires, with the agency handling your application, or with a subcontractor bound by the same duty of confidentiality.
7.3 Protected health information. Our work does not require patient records. Please do not send us protected health information as defined by HIPAA. If a project genuinely needs it, we will sign a Business Associate Agreement with you first, and that agreement will govern how we handle it.
7.4 We handle personal information in line with applicable federal and state privacy laws. Our privacy policy explains what we collect and why.
7.5 Where your information is held. Because our team is in the United Kingdom, information you send us is stored and processed there and is subject to UK data protection law. By engaging us, you agree to your information being handled outside the United States.
7.6 Either of us may ask for a separate non-disclosure agreement. If we sign one, it takes priority over this section wherever the two differ.
8. Who owns what
8.1 The templates, frameworks, checklists and know-how we bring to your project remain ours, including anything we developed before we met you.
8.2 Once you have paid in full, you get a permanent, non-exclusive license to use the documents we produce for you: inside your business, with your staff, with your licensing agency, and with surveyors and accreditors.
8.3 You may not resell our documents, license them to anyone else, or use them as the basis for providing similar services to third parties.
8.4 Your own records and anything you gave us remain yours.
9. Our liability
9.1 Our total liability for any claim connected to our services is limited to the fees you paid us for the service the claim relates to.
9.2 We are not liable for indirect or consequential losses, including lost profits, lost business, lost revenue, reputational harm, or civil monetary penalties and fines imposed on you by a regulator.
9.3 We are not liable for losses caused by information you gave us that was wrong, by changes you made to our documents, by your own decisions, or by an agency's decision.
9.4 Nothing here limits any liability that cannot lawfully be limited, including liability for fraud.
9.5 You agree to cover our reasonable costs, including attorneys' fees, if a third party brings a claim against us because you breached these terms, gave false information, or failed to comply with a law that applies to you.
9.6 Neither of us is liable for failures caused by events outside reasonable control, such as natural disasters, war, epidemics, government action, or loss of power or communications.
9.7 Any claim under this agreement must be brought within two years of the date you knew, or reasonably should have known, the facts behind it.
10. Ending the agreement
10.1 Either of us may end the engagement in writing at any time. If you end it, you pay for the work done up to that point, and Section 5 governs any refund.
10.2 We may end it immediately if you do not pay, if you give us false information, if you become insolvent, if you abuse our staff, or if continuing would expose us to legal or regulatory risk.
10.3 If we cannot reach you for 90 days despite at least three attempts by different methods, we may close your file. We will write to you first. Work already done remains payable.
10.4 The sections on confidentiality, ownership, liability, governing law and payment survive the end of this agreement.
11. If something goes wrong
11.1 Tell us first. Email info@curacomplianceconsulting.com with "Formal Complaint" in the subject line, and say what happened and what you would like done. We acknowledge within 3 business days and give you a full written answer within 14 business days.
11.2 If that does not settle it, we both agree to try good faith negotiation for 30 days, and then mediation before a mediator we both agree on, with the fee split equally.
11.3 If mediation does not resolve it, disputes go to the state or federal courts in Travis County, Texas, and we both submit to that jurisdiction. This agreement is governed by the laws of the State of Texas, without regard to conflict of law rules.
11.4 Either of us may still go straight to court for an injunction to protect confidential information or intellectual property.
11.5 The prevailing party in any legal action may recover reasonable attorneys' fees and costs.
12. Honest feedback
12.1 You are free to publish honest reviews of our services, good or bad. Nothing in this agreement prevents you from doing so, and we will never ask you to remove an honest review as a condition of anything.
12.2 You agree not to publish statements about us that you know to be false.
13. General
13.1 This agreement, together with your quote and any statement of work, is the entire agreement between us and replaces anything said or written beforehand.
13.2 If any part of it is found unenforceable, the rest continues to apply.
13.3 Changes must be in writing and agreed by both of us. We may update these terms for new engagements, but the version you accepted governs your current project.
13.4 You may not transfer this agreement without our written consent. We may transfer it to a successor business.
13.5 We act as an independent contractor. This agreement does not create employment, partnership or joint venture between us.
13.6 Notices go by email to the addresses given in your quote and count as received on the next business day.
13.7 Nobody outside this agreement may enforce it.
13.8 You agree that accepting these terms electronically, including by checking a box or clicking to confirm, is as binding as signing on paper, under the federal ESIGN Act and applicable state law.
14. How you accept these terms
14.1 You accept these terms when the first of these happens:
- you check the box confirming you agree when you buy a service from us;
- you pay an invoice or a deposit for a service;
- you tell us in writing, including by email, that you accept them;
- you ask us to start work after we have sent you these terms.
14.2 We record the date you accepted and the version you accepted. We keep a copy of the version in force when you engaged us, and we will send it to you whenever you ask.
14.3 If you do not agree with any part of this, please contact us before you buy. We would rather answer a question now than have you commit to something you are unsure about.
HIPAA Compliance Notice
1. Why this notice exists
1.1 HIPAA is the federal law that protects health information. Clients regularly ask where we stand under it, especially when they are about to send us documents. This notice answers that.
1.2 This is not a Notice of Privacy Practices. That is the document your agency must give its own patients. This notice does not replace it, and it does not replace the HIPAA policies, training or risk analysis your agency has to maintain.
2. Our status under HIPAA
2.1 We are not a covered entity. We do not treat patients, we do not run a health plan, and we do not bill payers. HIPAA's obligations on covered entities do not apply to us.
2.2 In most engagements we are not a business associate either. A business associate is someone who creates, receives, maintains or transmits protected health information on a covered entity's behalf. Preparing a license application, writing policies and procedures, and getting you ready for a survey do not require us to touch patient information, so in the ordinary case we never become one.
2.3 We become a business associate only when a specific project genuinely requires protected health information. If that happens, we sign a Business Associate Agreement with you before any such information is shared, and that agreement governs how we handle it.
2.4 We say this precisely because the distinction matters. A blanket claim that we hold Business Associate Agreements with every client would be inaccurate, and it would suggest obligations that neither side is actually operating under.
3. What protected health information means
3.1 In plain terms, it is health information that identifies a particular person. Please do not send us any of the following:
- patient charts, clinical notes or medication records;
- care plans or assessments that name an individual;
- referral letters, discharge summaries or physician orders;
- billing or claims records containing patient identifiers;
- incident, complaint or safeguarding reports that name a patient;
- staff files that contain information about identifiable patients.
3.2 Information about your business is different, and we do need it. Corporate records, ownership details, policies, staffing structures, qualifications, background check results for owners and administrators, and financial information are not protected health information. Send those freely.
4. Please do not send us patient information
4.1 If you are unsure whether a document contains protected health information, ask us before you send it. We would rather answer the question than receive something we should not have.
4.2 If a document is useful to us but contains patient details, remove them first. Take out names, addresses, dates of birth, record numbers, dates of service and anything else that could identify a person. A redacted care plan is usually perfectly good evidence for a survey file.
5. If we receive patient information anyway
5.1 It happens, usually by accident in an email attachment. If it does:
- we tell you promptly, so you can assess it under your own breach procedures;
- we do not use it, and we do not pass it on;
- we secure it and limit who can see it;
- we return it or securely destroy it, whichever you instruct;
- we record what happened and what we did.
5.2 Whether an accidental disclosure is a reportable breach is a decision for you as the covered entity. We will give you whatever detail you need to make it.
6. When we sign a Business Associate Agreement
6.1 We sign one whenever a project actually requires protected health information, or whenever you reasonably ask for one because of your own policies. Ask us and we will put one in place.
6.2 A Business Associate Agreement between us will cover permitted uses, safeguards, subcontractors, breach notification timeframes, your right to audit, and what happens to the information when the work ends.
6.3 Where a Business Associate Agreement is in force and anything in it conflicts with this notice or with our Terms of Service, the Business Associate Agreement wins.
7. Safeguards we maintain
7.1 Administrative. Access to client files is limited to the people doing your work. Staff and subcontractors are under written confidentiality obligations, and they are instructed not to request patient information.
7.2 Technical. Our website runs over an encrypted connection, our email is sent over authenticated SMTP, devices are password protected and encrypted, and we run security monitoring that blocks malicious traffic.
7.3 Physical. We work remotely rather than from a public office, and we do not keep client paper files.
7.4 These are sensible commercial safeguards. Where a Business Associate Agreement applies, the specific HIPAA Security Rule requirements in that agreement apply on top of them.
8. Where information is held
8.1 Our team is in the United Kingdom, so information you send us is stored and processed there. HIPAA does not prohibit storing information outside the United States, but your own policies or your payer contracts might.
8.2 If you require your information to stay in the United States, tell us before you engage us. We will tell you honestly whether we can meet that, rather than agreeing and hoping.
9. Your own obligations
9.1 Nothing here reduces what HIPAA asks of you. If you are a covered entity you still need your own Notice of Privacy Practices, policies and procedures, workforce training, a security risk analysis, breach notification procedures, and Business Associate Agreements with your own vendors.
9.2 Getting licensed and being HIPAA compliant are two different projects. Passing a state licensing survey does not mean your HIPAA program is adequate.
10. How we help with HIPAA
10.1 Helping you build that program is something we do as a service: privacy and security policies written for your state and service type, workforce training materials, breach response procedures, and survey readiness.
10.2 We do this as consultants, not as attorneys. We are not a law firm, nothing we provide is legal advice, and we do not certify anyone as HIPAA compliant. No consultant can, because there is no official HIPAA certification.
11. Questions
11.1 Email info@curacomplianceconsulting.com with "HIPAA" in the subject line, or message +44 7470 390526 on WhatsApp. If you want a Business Associate Agreement in place before you send us anything, say so and we will sort it first.
