Privacy policy

What we collect

We collect the minimum needed to run your journey, and nothing that exists only to make the product easier to sell.

• Account details: email address, preferred name, language, time zone.
• Journey details: the dates you enter, your selected care pathways and your stated preferences.
• Health entries you choose to record: readings, symptoms, mood check-ins, medications, appointments and notes.
• Technical data needed to keep the service secure: a salted hash of your IP address, your device type and session activity.

What we never do

These are commitments, not aspirations. They are enforced in code as well as policy.

• We never sell or rent reproductive-health data.
• We never build advertising profiles from your pregnancy, your conditions or your journal.
• We never send health data to advertising SDKs or third-party trackers.
• We never run session-replay tooling on screens containing health information.
• We never disclose your pregnancy status to an employer, even when your employer pays for your membership.

How your data is protected

Free-text health fields — journal notes, message bodies, medication names, appointment locations — are encrypted with AES-256-GCM before they are stored, using keys held outside the database.

Organisations are isolated at the database level by PostgreSQL row-level security, in addition to application authorization. Automated tests prove that a query scoped to one organisation cannot return another organisation’s rows.

Sharing is always your decision

Nothing is shared with your care team, your organisation or your support circle unless you choose to share it. Every share has a defined scope, an expiry date and an access log you can read. You can revoke any share instantly.

Your private journal is never shareable. There is deliberately no permission in the system that grants another person access to it.

Your rights

You can export a machine-readable copy of your data, correct it, restrict processing, or request deletion, from Settings → Privacy & data. We respond within 30 days.

Where records must be retained for a legal or contractual period, we tell you which records and for how long, and we delete them at the end of that period.

Contacting us

Write to privacy@nurturacare.gg. If you are in the EU or UK you may also complain to your supervisory authority; if you are in the US, to your state attorney general or the FTC.