Privacy policy

What we collect

We collect the minimum needed to run your journey, and nothing that exists only to make the product easier to sell.

• Account details: email address, preferred name, language, time zone.
• Journey details: the dates you enter, your selected care pathways and your stated preferences.
• Health entries you choose to record: readings, symptoms, mood check-ins, medications, appointments and notes.
• Technical data needed to keep the service secure: a salted hash of your IP address, your device type and session activity.

What we never do

These are commitments, not aspirations. They are enforced in code as well as policy.

• We never sell or rent reproductive-health data.
• We never build advertising profiles from your pregnancy, your conditions or your journal.
• We never send health data to advertising SDKs or third-party trackers.
• We never run session-replay tooling on screens containing health information.
• We never disclose your pregnancy status to an employer, even when your employer pays for your membership.

How your data is protected

Free-text health fields — journal notes, message bodies, medication names, appointment locations — are encrypted with AES-256-GCM before they are stored, using keys held outside the database.

Organisations are isolated at the database level by PostgreSQL row-level security, in addition to application authorization. Automated tests prove that a query scoped to one organisation cannot return another organisation’s rows.

Sharing is always your decision

Nothing is shared with your care team, your organisation or your support circle unless you choose to share it. Every share has a defined scope, an expiry date and an access log you can read. You can revoke any share instantly.

Your private journal is never shared by default and is never part of a bulk share. The only way another person can see it is a grant you make yourself, marked as sensitive and confirmed separately — and you can revoke it instantly.

Your rights

You can export a machine-readable copy of your data or request deletion from Settings → Privacy & data. Both run automatically, usually within minutes. To correct a record, edit it in the app; to ask us to restrict how your data is processed, write to us — we respond within 30 days.

When your account is deleted, your health record is destroyed and your account becomes an anonymous placeholder. Two kinds of record are kept: billing records (your plan and a PayPal reference, never health data), for as long as payment and tax rules require, and the append-only audit trail, in which you appear only as an identifier that names nobody. Any subscription is cancelled at PayPal as part of the deletion.

Your data is hosted in the United States (Oregon).

Contacting us

Write to privacy@nurturacare.gg. If you are in the EU or UK you may also complain to your supervisory authority; if you are in the US, to your state attorney general or the FTC.