Privacy Policy

1. Information we collect

Account information: When you create an account we collect your name, email address, and an encrypted version of your password. You may also provide an optional baby name and baby sex for each pregnancy you track.

Tracking data: When you use the app we store the data you enter, including: kick counts and timestamps, count-to-ten session results, diary entries, wellbeing check-ins (mood, energy, stress, sleep quality, symptoms), appointment records, questions and answers, advice notes, and pregnancy provider contact details. Each record is tied to your user account and to a specific pregnancy.

Uploaded files: If you use the scan gallery, we store the image and video files you upload, along with any labels you add (scan date, week number, caption). Files are stored securely in cloud storage provided by Cloudflare (Cloudflare R2).

Emails: If you opt in to weekly summary emails, we store your preference and use your email address to send those emails. We also send transactional emails such as password reset links when you request them.

2. Special category data (health information)

Pregnancy-related information — including kick patterns, wellbeing check-ins, symptoms, and scan images — is special category health data under UK GDPR and EU GDPR (Article 9). We process this data solely to provide you with the service you have explicitly signed up for. By creating an account and entering this information you give your explicit consent (Article 9(2)(a)) for us to store and process it for the purposes described in this policy.

You may withdraw consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

3. How we use your data and our lawful basis

Your data is used solely to provide the BabyNudge service to you. The table below sets out the lawful basis for each type of processing under UK GDPR Article 6:

• Providing the core service (dashboards, charts, insights, pregnancy data, file gallery, care team) — contractual necessity (Article 6(1)(b)).
• Weekly summary emails — consent (Article 6(1)(a)). You can withdraw consent at any time in Settings.
• Transactional emails (password resets, account notices) — legitimate interests (Article 6(1)(f)).
• Processing payments (where applicable) — contractual necessity (Article 6(1)(b)).
• Security and fraud prevention — legitimate interests (Article 6(1)(f)).

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use your data to train AI models or for any purpose beyond operating the service.

3. Data storage and security

Your account data and tracking records are stored in a password-protected database. Passwords are hashed using industry-standard algorithms and are never stored in plain text. Communication between your browser and our servers is encrypted via HTTPS.

Uploaded scan images and videos are stored in Cloudflare R2, a secure cloud storage service operated by Cloudflare. Files are not publicly accessible — access is controlled via short-lived signed URLs generated on request. Cloudflare acts as a data processor on our behalf and processes your files only as directed by us.

5. Third-party services

We use the following third-party services to operate BabyNudge. Each acts as a data processor on our behalf and processes your data only as directed by us:

• Cloudflare (R2) — secure cloud storage for uploaded scan images and videos.
• Stripe — payment processing. When you make a payment, Stripe receives your email address and payment details. Stripe processes this data under its own privacy policy as a separate data controller for fraud and compliance purposes. We do not store your card details. Stripe is certified to PCI DSS Level 1.
• Email service provider — used to send weekly summary emails and password reset links. We share only your email address and the content of the email with this provider.

We do not use third-party analytics, advertising networks, or social media tracking on BabyNudge.

6. Shared links

When you create a share link, a unique token is generated. Anyone with that link can view the shared data in a read-only format without needing an account.

• Activity share links — show kick counts, activity charts, and movement patterns for the pregnancy they belong to. Diary entries, wellbeing check-ins, care team contacts, and scan gallery files are never included.
• Appointment share links — show the questions and answers from that appointment, any advice notes, kick activity stats from the period, wellbeing averages and symptoms from the period, and diary entries from the period. Only the data visible in the appointment summary is included.

You can revoke any share link at any time, which immediately removes all access. We show you a clear summary of what will be shared before you create a link.

7. Multiple pregnancies

You can track more than one pregnancy from a single account. Each pregnancy has its own kick logs, diary entries, wellbeing check-ins, appointments, questions, scan gallery, care team contacts, and share links. When you switch pregnancies the app displays only the selected pregnancy's data. Data from one pregnancy is never visible in another pregnancy's views.

8. Cookies

We use a single session cookie to keep you signed in. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

9. Data retention

We retain your data for as long as your account is active. If you delete your account, all your personal data — including tracking records, diary entries, uploaded files, and care team contacts — is permanently deleted from our systems. Uploaded files are also removed from cloud storage. We do not retain backups of deleted accounts beyond our routine backup rotation period (typically 30 days).

10. Your rights

You have the following rights regarding your personal data:

• Access — you can view all the data you have entered at any time through the app.
• Correction — you can edit your data at any time through the app.
• Deletion — you can delete individual records through the app, or request full account deletion by contacting us.
• Portability — you may request a copy of your data in a portable format by contacting us.
• Objection — you may object to any processing of your data by contacting us. We will stop processing your data where we have no overriding legitimate reason to continue.

If you are located in the UK or EU you also have the right to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk).

11. Children's privacy

BabyNudge is intended for use by adults who are pregnant or who have been pregnant. We do not knowingly collect data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes we will make reasonable efforts to notify you by email. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact

If you have questions about this privacy policy, want to exercise your data rights, or would like to request account deletion, please email us at [email protected].