Privacy policy

heymama baby - Baby Tracker

Effective date: August 1, 2026

Last updated: August 1, 2026

This Privacy Policy describes how Qubiri s.r.o., Business ID (IČO): 57708231, registered in the Commercial Register of the Municipal Court Bratislava III Slovakia, Section: Sro, Insert No.: 201070/B, having its registered office at Fialová 8A, 851 07 Bratislava, Slovakia ("Qubiri", "we", "us" or "our"), processes your personal data when you use the heymama baby mobile application, website and related services.

By creating an account or using heymama baby, you acknowledge that your personal data is processed as described in this Privacy Policy. Where your consent is required under applicable law, we will always request it separately before processing begins.

Your privacy is extremely important to us. When processing personal data, we follow the principle of data minimization, meaning we collect and process only the information necessary to provide the features of heymama baby, maintain the security of our services, and comply with our legal obligations.

1. Data Controller

The data controller responsible for the processing of personal data through heymama baby is:

Qubiri s.r.o.

Fialová 8A

851 07 Bratislava

Slovakia

Business ID (IČO): 57708231

Qubiri s.r.o. is registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No.: 201070/B.

We operate heymama baby, a mobile application designed to help parents, legal guardians, caregivers and other persons legally authorized to manage information relating to a child record and manage information relating to everyday childcare.

Depending on the features you choose to use, this may include information relating to:

  • sleep;
  • feeding;
  • diaper changes;
  • growth;
  • health-related records;
  • developmental milestones;
  • other information that you voluntarily choose to enter into the application.

Qubiri s.r.o. determines the purposes and means of processing personal data described in this Privacy Policy and therefore acts as the data controller under applicable data protection law.

If you have questions about this Privacy Policy, the processing of personal data or your privacy rights, you may contact us at:

hey@heymama.baby

You may also use this email address to submit a privacy request or withdraw explicit consent to the processing of health data.

2. Personal Data We Process

The personal data we process depend on the features you choose to use and the information you voluntarily enter into heymama baby.

We do not require you to use every available feature or provide every category of information described below.

2.1 Account and Authentication Data

When you create and use an account, we may process:

  • your email address;
  • your authentication and account identifiers;
  • your selected sign-in method, such as email and password or Google Sign-In;
  • information necessary to authenticate and secure your account;
  • information indicating whether biometric protection is enabled within the application.

These data are used to create and manage your account, authenticate you, protect access to your information and provide the application’s functionality.

Passwords are processed and secured through Firebase Authentication. We do not have access to your password in plain text.

Where biometric protection is enabled, we store only information indicating that the feature is enabled. We do not receive or store biometric templates or biometric verification data.

2.2 Subscription Data

Where you start a trial or purchase a subscription, we may process limited information relating to your subscription, including:

  • subscription type;
  • purchase platform, such as the Apple App Store or Google Play;
  • trial period information;
  • subscription status;
  • renewal and expiration status;
  • purchase, transaction or subscription identifiers;
  • information about access to paid features.

We do not receive or store your complete payment card details, bank details or payment credentials.

Payments are processed by Apple or Google. RevenueCat is used to verify and manage subscription status and access to paid features.

2.3 Child Profile Data

You may voluntarily create and manage a profile for a child within heymama baby.

Depending on the information you choose to provide, we may process:

  • the child’s name;
  • date of birth;
  • profile photo.

These data are used to personalize the application and provide the child-profile and tracking features requested by you.

The child profile is created and managed by a parent, legal guardian, caregiver or another person legally authorized to manage information relating to the child.

2.4 Care Records

heymama baby allows you to record information relating to the child’s everyday care.

Depending on the features you choose to use, we may process:

  • sleep records, including start time, end time and duration;
  • feeding records, including feeding type, time and amount;
  • diaper-change records;
  • developmental milestones;
  • notes and other childcare information that you voluntarily enter into the application;
  • the account identifier of the user who created or updated a record.

The account identifier associated with a record allows the application to identify which authorized user created or updated it and to operate shared child profiles.

Providing care records is voluntary. The scope of the information processed depends on the records and features you choose to use.

2.5 Health-Related Data

Some information that you choose to record may constitute health data or another special category of personal data under applicable data protection law.

This may include information relating to:

  • weight;
  • height or body length;
  • body temperature;
  • symptoms or illnesses;
  • medications, including the name of a medication and the time it was administered;
  • doctor visits and scheduled medical appointments;
  • vaccinations and scheduled vaccination appointments;
  • teething and tooth growth;
  • other health-related notes or information that you voluntarily enter into the application.

Health data are processed only where explicit consent has been provided, as described in Sections 3 and 8 of this Privacy Policy.

You are not required to enter health data and may use the remaining features of heymama baby without using the health-related features.

2.6 Profile Photos

Where you choose to select or take a child profile photo, the image is stored locally within the application’s private storage on your device.

We do not upload or store child profile photos in Firebase Cloud Storage or other cloud storage operated by us.

The application may store a local file path or technical reference necessary to display the selected photo on that device.

Because the photo is stored locally:

  • it may not synchronize across devices;
  • it may be lost if the application is deleted or its local data are removed;
  • it is not included in cloud-based child records.

You are responsible for ensuring that you are legally authorized to use the relevant image.

We do not use profile photos for advertising, facial recognition, biometric identification or training artificial intelligence or machine-learning models.

2.7 Sharing, Access and Invitation Data

Where you choose to share a child profile with another parent, legal guardian, caregiver or other authorized person, we process information necessary to provide and manage the sharing feature.

This may include:

  • account or user identifiers of the persons who have access to the child profile;
  • the identifier of the shared child profile;
  • invitation codes;
  • the creation and expiration time of an invitation code;
  • invitation, sharing and access status;
  • information necessary to grant or remove access.

Invitation codes are temporary and are valid for 30 minutes.

Users connected to the same child profile generally have the same level of access. They may be able to:

  • view the shared child profile and its records;
  • add new records;
  • edit existing records;
  • delete records;
  • manage information associated with the shared profile.

An authorized user may remove another connected user’s access through the functionality available in the application. When access is removed, the relevant user identifiers and profile connection are updated accordingly.

2.8 Technical and Diagnostic Data

To operate, secure, diagnose and improve heymama baby, we may process limited technical and diagnostic information, including:

  • device type and model;
  • operating system and version;
  • application version;
  • application language;
  • selected measurement units;
  • Firebase Installation ID and other technical application-instance identifiers;
  • date and time of crashes or technical errors;
  • crash reports and stack traces;
  • limited automatic diagnostic information and breadcrumbs generated by the application or operating system;
  • limited information indicating whether the application was active or running in the background at the time of a crash;
  • other limited technical information necessary to identify and resolve application errors.

We use Firebase Crashlytics to collect and process crash-related technical and diagnostic information.

We do not intentionally send Firebase Authentication user IDs, child profile content, care records, health records or user-entered notes to Crashlytics.

We do not add custom diagnostic logs containing personal data. We take reasonable steps to avoid including personal data or user-entered content in crash reports and diagnostic information.

2.9 Local Notification Data

Where you enable notifications, the application may use information about your trial period or subscription expiration date to schedule reminders on your device.

These reminders are scheduled locally on your device and may include:

  • a reminder that a trial period is approaching its expiration date;
  • a reminder that a subscription is approaching its expiration date.

These notifications are not sent through Firebase Cloud Messaging.

The operating system of your device may process the information necessary to display and manage local notifications.

2.10 Customer Support and Privacy Requests

Where you contact us by email, we may process:

  • your email address;
  • the content of your message;
  • information you voluntarily provide in connection with your question or request;
  • limited account information necessary to respond to or handle the request;
  • records relating to the handling and resolution of the request.

You should not include unnecessary health information or other sensitive personal data in support emails.

2.11 Data We Do Not Intentionally Collect

We do not intentionally collect:

  • your precise or approximate location;
  • advertising identifiers for targeted advertising;
  • contacts stored on your device;
  • payment card details or banking credentials;
  • biometric templates or biometric verification data;
  • audio recordings or data from your device’s microphone.

The application may request access to your device’s camera or photo library only where you choose to take or select a child profile photo.

If you choose to use biometric authentication, such as Face ID or fingerprint authentication, verification takes place locally on your device through the security features provided by your operating system.

We do not receive, access, store or transmit your fingerprint, facial template or other biometric verification data.

2.12 Voluntary and Required Information

Most information relating to child profiles, care records, health records, photos and notes is provided voluntarily.

Certain information, such as an email address and authentication data, may be required to create and secure an account.

Subscription-related information is required only where you start a trial, purchase a subscription or use paid features.

Information necessary for sharing is processed only where you choose to connect another authorized user to a child profile.

If you do not provide information required for a particular feature, we may be unable to provide that feature, but you may continue to use other available parts of heymama baby where possible.

3. Legal Basis for Processing Personal Data

GDPR Articles 6 and 9

If you are located in the European Economic Area (EEA) or the United Kingdom, we process personal data only where we have a valid legal basis under applicable data protection law.

The applicable legal basis depends on the type of personal data, the person to whom the data relate and the purpose for which the data are processed.

Performance of a Contract

Article 6(1)(b) GDPR

We process personal data relating to the registered user where such processing is necessary to enter into or perform our contract with that user.

This includes processing necessary to:

  • create and manage your user account;
  • authenticate your identity;
  • provide access to heymama baby and its features;
  • synchronize your account and records across your devices;
  • manage your subscription, trial period and subscription status;
  • provide customer support relating to your account or subscription.

Without processing these data, we may be unable to create or maintain your account or provide the requested services.

Legitimate Interests

Article 6(1)(f) GDPR

We process certain personal data where this is necessary for our legitimate interests or the legitimate interests of our users, provided that those interests are not overridden by the rights and freedoms of the individuals whose personal data are involved.

This includes processing necessary to:

  • operate, maintain and secure heymama baby;
  • diagnose technical problems and improve application stability;
  • prevent fraud, abuse and unauthorized access;
  • enable a parent, legal guardian, caregiver or other legally authorized person to create and manage a child profile;
  • provide features for recording the child’s everyday care, excluding health data processed on the basis of explicit consent;
  • enable an authorized user to share information with another parent, legal guardian, caregiver or other authorized person;
  • establish, exercise or defend legal claims.

Because some personal data processed through heymama baby relate to children, we take particular care to consider the child’s interests, rights and reasonable expectations.

We process only data that are necessary and proportionate for these purposes.

You have the right to object to processing based on legitimate interests, as described in Section 9 – Your Rights.

Explicit Consent for Health Data

Articles 6(1)(a) and 9(2)(a) GDPR

Some information that you choose to record in heymama baby may constitute health data or another special category of personal data under Article 9 GDPR.

This may include information relating to:

  • weight;
  • height or body length;
  • body temperature;
  • symptoms and illnesses;
  • medications, including the name of a medication and the time it was administered;
  • doctor visits and scheduled medical appointments;
  • vaccinations and scheduled vaccination appointments;
  • teething and tooth growth;
  • other health-related information that you voluntarily enter into the application.

We process these health data solely for the purpose of providing the health-tracking features requested by you and only on the basis of your explicit consent.

Providing health data is voluntary. You are not required to use the health-related features, and you may use the remaining features of heymama baby without entering health data.

The person providing health data and consent must be the child’s parent, legal guardian, caregiver or another person legally authorized to provide and manage the child’s information.

Explicit consent is requested separately before health data are processed. Accepting this Privacy Policy or the Terms of Use does not by itself constitute consent to the processing of health data.

We record information necessary to demonstrate the consent you have provided, including the consent status, the date and time of consent and the applicable consent version.

You may withdraw your explicit consent at any time by contacting us at:

hey@heymama.baby

After receiving and confirming that the request relates to the relevant account, we will:

  • stop processing the relevant health data on the basis of consent;
  • delete the relevant health data, unless their continued retention is required by applicable law;
  • record that consent has been withdrawn;
  • disable the health-related features until explicit consent is provided again.

You may also delete individual health records directly within the application.

Alternatively, you may permanently delete your account, which deletes the personal data associated with the account as described in Section 7 – Data Retention and Deletion.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

The health-related features will remain unavailable unless you provide explicit consent again.

Compliance with Legal Obligations

Article 6(1)(c) GDPR

We may process personal data where this is necessary to comply with legal obligations applicable to us.

This may include processing necessary to:

  • comply with accounting, tax and record-keeping obligations;
  • respond to lawful requests from courts, supervisory authorities or other public authorities;
  • investigate, document or report personal data breaches where required by law;
  • demonstrate compliance with applicable data protection laws.

Automated Decision-Making

We do not use personal data for automated decision-making or profiling that produces legal effects or similarly significant effects within the meaning of Article 22 GDPR.

4. How We Use Your Personal Data

We process personal data only for specified, explicit and legitimate purposes connected with the operation and provision of heymama baby.

Depending on the features you choose to use, we may process personal data for the following purposes:

  • to create, authenticate and manage your user account;
  • to verify your email address during registration;
  • to provide the features and functionality of heymama baby;
  • to create and personalize a child profile;
  • to store and display the care records that you choose to enter;
  • to provide health-tracking features where you have given explicit consent to the processing of health data;
  • to synchronize your account, child profiles and records across your devices;
  • to store account information, child profiles and records in our cloud infrastructure;
  • to store and display a child profile photo locally on your device where you choose to add one;
  • to allow you to share a child profile and its records with another parent, legal guardian, caregiver or other authorized person when you choose to use the sharing feature;
  • to create and manage temporary invitation codes used to connect another authorized user to a child profile;
  • to manage your subscription, trial period, renewal status and access to paid features;
  • to schedule local notifications on your device concerning the upcoming expiration of a trial period or subscription;
  • to provide customer or technical support when you contact us;
  • to diagnose technical problems, resolve errors and maintain application stability;
  • to protect the application, its users and personal data against unauthorized access, fraud and abuse;
  • to comply with applicable legal obligations and lawful requests;
  • to establish, exercise or defend legal claims where necessary.

Trial and subscription reminders are scheduled locally on your device. They are not sent through Firebase Cloud Messaging.

We do not send marketing emails, newsletters or promotional communications.

We do not use health data for any purpose other than providing the health-related features requested by you.

We do not use personal data for:

  • targeted or behavioural advertising;
  • creating advertising or marketing profiles;
  • selling, renting or trading personal data;
  • training artificial intelligence or machine-learning models;
  • automated decision-making or profiling that produces legal or similarly significant effects.

We will not process personal data for a new purpose that is incompatible with the purposes described in this Privacy Policy unless we have another valid legal basis and provide any information or obtain any consent required by applicable law.

4.1 Data Minimization

We follow the principle of data minimization when designing and operating heymama baby.

We collect and process only personal data that are adequate, relevant and limited to what is necessary for the purposes described in this Privacy Policy.

Most child profile information, care records and health-related information are provided voluntarily. You decide which optional information you wish to enter and which features you wish to use.

Where certain information is required to create an account, authenticate you, manage your subscription or provide a requested feature, we will indicate that the information is required.

If you do not provide the required information, we may be unable to create your account, authenticate you or provide the relevant feature.

We periodically review the personal data we process and the applicable retention settings to reduce the risk of collecting or retaining information that is no longer necessary for the operation, security or legal compliance of heymama baby.

5. Data Sharing and International Transfers

We share personal data only where this is necessary to provide, operate, secure and maintain heymama baby, manage subscriptions or comply with applicable law.

We do not sell, rent or trade personal data. We do not share personal data with third parties for advertising, marketing or cross-context behavioural advertising.

5.1 Service Providers

We use selected third-party service providers to support the technical operation of heymama baby.

These providers process personal data only to the extent necessary to provide their services and subject to applicable contractual, confidentiality and data protection obligations.

Google Firebase

We use services provided by Google through the Firebase platform.

Firebase Authentication

We use Firebase Authentication to create, authenticate and manage user accounts.

Depending on the selected sign-in method, Firebase Authentication may process:

  • your email address;
  • authentication and account identifiers;
  • your sign-in method;
  • technical information necessary to authenticate and secure your account.

Passwords are processed and secured through Firebase Authentication. We do not have access to passwords in plain text.

Cloud Firestore

We use Cloud Firestore to store and synchronize information entered into heymama baby, including:

  • user account information;
  • child profiles;
  • care records;
  • health-related records where explicit consent has been provided;
  • identifiers of users who create or update records;
  • information connected with the sharing feature;
  • temporary invitation codes and their expiration information;
  • information relating to consent to the processing of health data.

The primary storage location selected for our Cloud Firestore database is within the European Union.

Child profile photos are stored locally on the user’s device and are not uploaded to Cloud Firestore or Firebase Cloud Storage.

Firebase Crashlytics

We use Firebase Crashlytics to identify application crashes, diagnose technical problems and improve the stability and reliability of heymama baby.

Crashlytics may process limited diagnostic and technical information, including:

  • device type and model;
  • operating system and application version;
  • date and time of a crash;
  • crash reports and stack traces;
  • Firebase Installation ID and other technical application-instance identifiers;
  • limited automatic diagnostic information and breadcrumbs;
  • limited information indicating whether the application was active or running in the background at the time of a crash;
  • other technical information necessary to identify and resolve application errors.

We do not intentionally send Firebase Authentication user IDs, child profile content, care records, health records or user-entered notes to Crashlytics.

We do not add custom diagnostic logs containing personal data. We take reasonable steps to avoid including directly identifying information or user-entered content in crash reports and diagnostic information.

Google processes information collected through Firebase services in accordance with its applicable terms and data-processing conditions.

Apple App Store and Google Play

Subscriptions and payments are processed through:

  • Apple Inc., where a subscription is purchased through the Apple App Store;
  • Google, where a subscription is purchased through Google Play.

Apple and Google process payment and purchase information under their own terms and privacy policies and may act as independent data controllers for their respective payment and platform services.

We do not receive or store your complete payment card details, bank details or payment credentials.

We receive only limited information necessary to verify and manage your subscription, which may include:

  • the purchase platform;
  • subscription type;
  • subscription status;
  • renewal and expiration status;
  • trial period information;
  • purchase, transaction or subscription identifiers.

RevenueCat

We use RevenueCat, Inc. to verify and manage subscriptions across supported platforms.

RevenueCat may process limited information necessary to:

  • verify purchases and subscription status;
  • restore subscriptions;
  • synchronize subscription entitlements;
  • manage trial and renewal information;
  • determine access to paid application features.

This information may include:

  • technical or application user identifiers;
  • purchase and transaction identifiers;
  • subscription status;
  • subscription and trial information;
  • the platform through which the subscription was purchased.

RevenueCat does not receive complete payment card details from us.

5.2 Sharing with Other Users

Where you choose to use the sharing feature, personal data associated with a child profile may be made available to another parent, legal guardian, caregiver or other person whom you authorize.

You are responsible for inviting only persons who are legally authorized to access and manage the child’s information.

A temporary invitation code is used to connect another authorized user to the child profile. The invitation code is valid for 30 minutes.

Users connected to the same child profile generally have the same level of access. Each connected user may be able to:

  • view the child profile and its records;
  • add new records;
  • edit existing records;
  • delete records;
  • manage information associated with the shared child profile.

You may remove another connected user’s access through the functionality available in the application.

When access is removed, the relevant user is disconnected from the child profile and can no longer access the shared information through heymama baby.

Removing access cannot reverse any information that the person may previously have viewed, recorded, copied, exported or otherwise obtained outside the application.

If the user who originally created a shared child profile chooses to delete their account, they may choose either to:

  • delete only their own account while leaving the child profile and its associated records available to another connected parent, legal guardian, caregiver or authorized user; or
  • delete their account together with the child profile and all records associated with that profile.

Where the child profile is preserved, the remaining connected user will continue to have access to and manage the profile and its records.

Where the child profile is deleted, all connected users will lose access to the profile, and the associated records will be deleted in accordance with Section 7 – Data Retention and Deletion.

The consequences of each deletion option are displayed before the user confirms the deletion.

5.3 Legal Disclosures

We may disclose personal data where this is necessary to:

  • comply with a legal obligation;
  • respond to a valid and lawful request from a court, supervisory authority, law-enforcement authority or another public body;
  • protect the rights, safety and security of our users, the application or third parties;
  • investigate fraud, misuse, unauthorized access or a personal data breach;
  • establish, exercise or defend legal claims.

We disclose only the personal data reasonably necessary for the relevant purpose.

5.4 International Data Transfers

The primary storage location selected for our Cloud Firestore database is within the European Union.

However, certain Firebase services and other service providers, including authentication, crash diagnostics, subscription-management and payment infrastructure, may process personal data in countries outside the European Economic Area, including the United States.

Unless a particular Firebase service offers and applies a selected data location, Google may process information in countries where Google or its subprocessors operate infrastructure.

Where personal data are transferred outside the EEA, we take steps designed to ensure that the transfer complies with applicable data protection law.

Depending on the provider and the circumstances, transfers may be based on:

  • an adequacy decision adopted by the European Commission;
  • the recipient’s valid participation in the EU–U.S. Data Privacy Framework, where applicable;
  • Standard Contractual Clauses approved by the European Commission;
  • supplementary contractual, technical and organizational safeguards.

Google’s Firebase data-processing terms include mechanisms addressing restricted international transfers, including applicable Standard Contractual Clauses.

You may contact us at hey@heymama.baby to request further information about international transfers and the safeguards used or, where available, a copy of the relevant contractual safeguards.

6. Security of Personal Data

We take the security of personal data seriously and implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access or other unlawful processing.

The measures we use are selected taking into account the nature and sensitivity of the personal data processed, the risks associated with the processing, the available technology and the costs of implementation.

Our security measures include, where applicable:

  • encrypted communication between the application and Firebase services using HTTPS/TLS;
  • user authentication through Firebase Authentication;
  • password handling and protection through Firebase Authentication, meaning that we do not have access to users’ passwords in plain text;
  • Firebase Firestore Security Rules designed to restrict access to personal data to the relevant authenticated users and users who have been granted access to a shared child profile;
  • restricted access to Firebase production systems and personal data, limited to persons who require such access to operate, maintain, support or secure the application;
  • temporary invitation codes that expire after 30 minutes;
  • functionality that allows access to a shared child profile to be removed;
  • Firebase Crashlytics, used to identify application crashes and diagnose technical errors;
  • reasonable efforts to avoid including child profile information, care records, health data or other user-entered content in crash reports and diagnostic information;
  • periodic review of data retention, account access and selected security settings;
  • procedures for assessing and responding to suspected personal data breaches.

Child profile photos are stored locally within the application’s private storage on the user’s device and are not uploaded to our cloud infrastructure. The security of locally stored photos also depends on the security settings of the relevant device and operating system.

Biometric Authentication

If you choose to use biometric authentication, such as Face ID or fingerprint authentication, biometric verification is performed locally on your device using the security features provided by your operating system.

We do not receive, access, store or transmit your fingerprint, facial template or other biometric verification data.

We store only information indicating whether biometric protection has been enabled within the application.

Biometric authentication protects access to the application on the relevant device but does not replace the security of your user account or your responsibility to protect access to your device.

Shared Access

The sharing feature allows you to provide another parent, legal guardian, caregiver or other authorized person with access to information associated with a child profile.

Users connected to the same child profile generally have the same level of access and may be able to view, add, edit and delete records associated with that profile.

You are responsible for:

  • inviting only persons who are authorized to access and manage the child’s information;
  • reviewing who currently has access to shared information;
  • removing access when a person is no longer authorized;
  • protecting your account credentials and the security of your device.

We recommend that you use a strong, unique password and do not share your login credentials with other persons.

Security Incidents

If we become aware of a suspected personal data breach, we will assess the nature and potential consequences of the incident and take appropriate steps to contain, investigate and address it.

Where required by applicable data protection law, we will notify the competent supervisory authority and affected individuals within the applicable legal time limits.

Periodic Review

We conduct a periodic review of selected data-protection and security matters, including:

  • access to Firebase systems;
  • retention of support and privacy-related communications;
  • expired invitation codes;
  • potentially orphaned user records;
  • inactive user accounts.

The scope and frequency of these reviews may depend on the nature of the processing and the risks involved.

No Absolute Guarantee

Although we take reasonable measures designed to protect personal data, no electronic transmission, storage system or security measure can be guaranteed to be completely secure.

We therefore cannot guarantee absolute security, but we seek to maintain a level of security appropriate to the risks associated with the processing.

7. Data Retention and Deletion

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, to provide heymama baby, maintain the security and reliability of the service and comply with applicable legal obligations.

The applicable retention period depends on the type of personal data and the purpose for which the data are processed.

7.1 Active Accounts

While your account remains active, we generally retain:

  • your account and authentication information;
  • child profiles;
  • care records;
  • health-related records for which explicit consent has been provided;
  • sharing and access information;
  • consent records;
  • information necessary to manage your subscription;
  • temporary invitation information for the period necessary to provide the sharing feature.

Child profile photos are stored locally within the application’s private storage on your device and are not uploaded to our cloud infrastructure.

You may delete individual records or profile information directly within the application where this functionality is available.

7.2 Withdrawal of Consent for Health Data

You may withdraw your explicit consent to the processing of health data at any time by contacting us at:

hey@heymama.baby

After receiving and confirming that the request relates to the relevant account, we will:

  • stop processing the relevant health data on the basis of consent;
  • delete the relevant health data, unless their continued retention is required by applicable law;
  • record that consent has been withdrawn;
  • disable the health-related features until explicit consent is provided again.

Withdrawing consent to health-data processing does not require you to delete your entire account. You may continue using the features of heymama baby that do not require the processing of health data.

You may also delete individual health records directly within the application.

7.3 Account Deletion

You may permanently delete your account directly within the application by navigating to:

Profile → Settings → Delete Account

Where your account is not connected to a shared child profile, deleting your account results in the deletion of:

  • your Firebase Authentication account;
  • your email address and authentication connection;
  • your user profile;
  • child profiles associated solely with your account;
  • care and health-related records associated with those child profiles;
  • consent records;
  • sharing and access information;
  • temporary invitation codes associated with your account;
  • other personal data stored in Cloud Firestore and directly connected with your use of heymama baby.

Where a child profile is shared with another connected user, the application allows you to choose between the following options:

  • delete only your own account while leaving the child profile and its associated records available to another connected user; or
  • delete your account together with the child profile and all records associated with that profile.

Where you choose to leave the child profile available, your access and account connection are removed, while the remaining connected user may continue to access and manage the child profile and its records.

Where you choose to delete the child profile, all connected users lose access to it and the associated records are deleted.

The consequences of each deletion option are displayed before you confirm the deletion.

Information that another connected user previously copied, exported or otherwise stored outside heymama baby cannot be deleted from that person’s device or independent records through the account-deletion process.

Once deletion has been completed, the deleted information cannot be restored through the application.

Deleting your account also removes the application’s reference to a locally stored profile photo. Files stored within the application’s private local storage are generally removed when the application or its local data are deleted, subject to the behaviour of the device and operating system.

For security reasons, Firebase Authentication may require you to sign in again before account deletion can be completed if your authentication session is no longer recent.

7.4 Invitation Codes

Invitation codes used to connect another authorized user to a child profile are valid for 30 minutes.

Expired invitation codes are deleted through the configured Firestore Time-to-Live process and through an additional cleanup process performed when the application starts.

7.5 Technical and Diagnostic Data

Technical and diagnostic information generated through Firebase Crashlytics may be retained in accordance with Google’s applicable retention practices.

Such information may include:

  • crash reports and stack traces;
  • Firebase Installation IDs and other technical identifiers;
  • limited diagnostic information and automatic breadcrumbs;
  • information necessary to investigate application crashes and stability issues.

Firebase Crashlytics generally retains relevant crash-related data and associated identifiers for approximately 90 days before beginning the deletion process.

We do not intentionally include the content of child profiles, care records, health records or user-entered notes in technical and diagnostic information.

7.6 Subscription and Legal Records

Limited information relating to subscriptions, purchases, transactions, accounting or legal compliance may be retained after account deletion where this is necessary to:

  • comply with accounting, tax or other legal obligations;
  • resolve payment or subscription disputes;
  • prevent fraud or misuse;
  • establish, exercise or defend legal claims;
  • demonstrate compliance with applicable law.

Such information is retained only for the period required by the relevant legal obligation or legitimate purpose and is not used to provide the ordinary features of heymama baby after account deletion.

Payment card details and payment credentials are processed by Apple or Google and are not stored by us.

7.7 Customer Support and Privacy Communications

Where you contact us by email, we may retain the communication and limited account information necessary to respond to and document your request.

We generally retain:

  • ordinary customer-support communications for up to two years;
  • communications and records relating to privacy or data-protection requests for up to three years.

We retain these communications to:

  • respond to your request;
  • document how the request was handled;
  • resolve a complaint or dispute;
  • demonstrate compliance with applicable data-protection obligations;
  • establish, exercise or defend legal claims where necessary.

After the applicable retention period, the communications are deleted unless continued retention is required by law or is reasonably necessary in connection with an unresolved dispute or legal claim.

7.8 Periodic Retention Review

We conduct a retention review at least once each year.

As part of this review, we may:

  • delete customer-support communications older than two years;
  • delete privacy-request records older than three years, unless continued retention is necessary;
  • verify that expired invitation codes have been removed;
  • identify and review orphaned user records;
  • review user accounts that have been inactive for more than two years.

An inactive account is not automatically deleted solely because it has been inactive for more than two years. We assess whether deletion or another action is appropriate based on the circumstances, the purposes of processing and applicable legal requirements.

8. Health Data

Special Category of Personal Data

Some information that you choose to record in heymama baby may constitute health data or another special category of personal data under Article 9 GDPR.

This may include information relating to:

  • weight;
  • height or body length;
  • body temperature;
  • symptoms or illnesses;
  • medications, including the name of a medication and the time it was administered;
  • doctor visits and scheduled medical appointments;
  • vaccinations and scheduled vaccination appointments;
  • teething and tooth growth;
  • other health-related information that you voluntarily choose to enter into the application.

8.1 Purpose and Legal Basis

We process health data solely for the purpose of providing the health-tracking and childcare features requested by you.

Health data are processed only on the basis of explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR.

Explicit consent is requested separately before health data are processed. Acceptance of this Privacy Policy or the Terms of Use does not by itself constitute consent to the processing of health data.

We record information necessary to demonstrate the consent provided, including the consent status, the date and time of consent and the applicable consent version.

The person providing health data and consent must be the child’s parent, legal guardian, caregiver or another person legally authorized to provide and manage the child’s information.

8.2 Voluntary Use

Providing health data is voluntary.

You are not required to enter health data or use health-related features. You may use the remaining features of heymama baby without providing health data.

You decide which health-related information you wish to enter and may delete individual health records directly within the application.

8.3 Withdrawal of Consent

You may withdraw your explicit consent to the processing of health data at any time by contacting us at:

hey@heymama.baby

After receiving and confirming that the request relates to the relevant account, we will:

  • stop processing the relevant health data on the basis of consent;
  • delete the relevant health data, unless their continued retention is required by applicable law;
  • record that consent has been withdrawn;
  • disable the health-related features until explicit consent is provided again.

Withdrawing consent does not require you to delete your entire account. You may continue to use features of heymama baby that do not require the processing of health data.

You may also permanently delete your account directly within the application, as described in Section 7 – Data Retention and Deletion.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

8.4 How We Use Health Data

Health data are used only to:

  • store and display health-related records entered by you;
  • provide the relevant tracking and organizational features;
  • synchronize those records across your devices;
  • make the records available to another authorized user where you choose to use the sharing feature;
  • identify which authorized user created or updated a health-related record;
  • maintain the security and proper technical operation of the application.

We do not use health data for:

  • advertising or marketing;
  • creating advertising or behavioural profiles;
  • automated decision-making;
  • determining eligibility for insurance, employment, credit or other services;
  • training artificial intelligence or machine-learning models;
  • any purpose unrelated to providing heymama baby.

8.5 Sharing Health Data

Where you use the sharing feature, health data may be made available to another parent, legal guardian, caregiver or other person whom you authorize.

Users connected to the same child profile generally have the same level of access and may be able to view, add, edit and delete health-related records associated with that profile.

You are responsible for ensuring that the invited person is legally authorized to access and manage the child’s health information.

You may remove that person’s access through the functionality available in the application.

Removing access prevents the person from continuing to access the shared health information through heymama baby. It cannot reverse information that the person may already have viewed, copied, exported or otherwise stored outside the application.

8.6 Important Notice

heymama baby is intended as an organizational and tracking tool for parents, legal guardians and caregivers.

It does not provide medical advice, diagnosis, treatment or emergency services and is not a substitute for consultation with a qualified healthcare professional.

You should not rely on information stored or displayed in heymama baby when making urgent medical decisions.

9. Your Rights

Depending on where you live and the applicable data protection law, you may have certain rights regarding your personal data.

To exercise your rights, you may contact us at:

hey@heymama.baby

You may also access, edit, export or delete certain information directly within the application where the relevant functionality is available.

9.1 Users in the European Economic Area and the United Kingdom

GDPR and UK GDPR

If you are located in the European Economic Area or the United Kingdom, you may have the following rights:

Right of Access

You have the right to request confirmation as to whether we process personal data relating to you and, where applicable, to receive access to those data and information about the processing.

You may export available records for all child profiles associated with your account by navigating to:

Profile → Settings → Export

The exported records are provided in CSV format.

The in-app export may include available care, growth, milestone and health-related records associated with all child profiles linked to your account.

The in-app export does not necessarily include all personal data processed in connection with your account, such as:

  • your account and authentication information;
  • sharing and access information;
  • subscription information;
  • consent records;
  • technical and diagnostic information;
  • locally stored profile photos.

You may contact us at hey@heymama.baby to request access to personal data that are not included in the in-app export.

Right to Rectification

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.

Certain information may be corrected directly within the application.

You may contact us where information cannot be corrected through the available application functionality.

Right to Erasure

You have the right to request the deletion of personal data in the circumstances provided by applicable law.

You may delete individual records where this functionality is available or permanently delete your account directly within the application.

Where a child profile is shared, the account-deletion options and their consequences are described in Section 7 – Data Retention and Deletion.

The right to erasure is not absolute. We may retain limited information where continued processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Right to Restriction of Processing

You may request that we temporarily restrict the processing of personal data in circumstances provided by applicable law, including where:

  • you contest the accuracy of the data;
  • the processing is unlawful and you request restriction instead of deletion;
  • we no longer need the data, but you require them to establish, exercise or defend legal claims;
  • you have objected to processing and the assessment of that objection is pending.

Where processing is restricted, we will process the relevant data only as permitted by applicable law.

Right to Data Portability

Where processing is based on consent or a contract and is carried out by automated means, you may have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format.

Where technically feasible and legally required, you may also request that those data be transmitted directly to another data controller.

You may export available records for all child profiles associated with your account from heymama baby in CSV format.

The in-app CSV export is provided as a convenient application feature and does not limit your right to request other portable personal data where the legal requirements for data portability are met.

Right to Object

You have the right to object, on grounds relating to your particular situation, to processing based on our legitimate interests.

Where you object, we will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

To withdraw explicit consent to the processing of health data, contact us at:

hey@heymama.baby

After receiving and confirming that the request relates to the relevant account, we will:

  • stop processing the relevant health data on the basis of consent;
  • delete the relevant health data, unless their continued retention is required by applicable law;
  • record that consent has been withdrawn;
  • disable the health-related features until explicit consent is provided again.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights Relating to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly significantly affects you, except where permitted by applicable law.

We do not carry out automated decision-making or profiling of this kind.

Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority, particularly in the country where you live, work or believe that an infringement occurred.

If you are located in Slovakia, the competent supervisory authority is:

Office for Personal Data Protection of the Slovak Republic

Information about supervisory authorities within the European Union is also available through the European Data Protection Board.

9.2 How We Handle Privacy Requests

We will respond to valid privacy requests without undue delay and, in any event, within one month after receiving the request.

Where necessary, taking into account the complexity and number of requests, this period may be extended by up to two additional months.

If we extend the response period, we will inform you within one month after receiving the request and explain the reasons for the extension.

To help protect personal data, we may ask you to submit the request from the email address associated with your account or to confirm the request while signed in to heymama baby.

We will request additional information only where we have reasonable doubts about the identity of the person making the request. We will not request more information than is reasonably necessary to confirm the request.

Requests are generally handled free of charge.

Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse to act where permitted by applicable law.

If we decide not to act on your request, we will explain the reasons and inform you of your right to lodge a complaint with a supervisory authority and seek a judicial remedy.

9.3 Users in California

CCPA and CPRA

If you are a California resident and the California Consumer Privacy Act applies to our processing, you may have the right to:

  • know the categories and specific pieces of personal information we process;
  • know the categories of sources, purposes and recipients involved;
  • request deletion of personal information;
  • request correction of inaccurate personal information;
  • limit certain uses or disclosures of sensitive personal information where applicable;
  • receive information about any sale or sharing of personal information;
  • not be discriminated against for exercising your privacy rights.

We do not sell personal information or share personal information for cross-context behavioural advertising.

Requests may be sent to:

hey@heymama.baby

We will respond within the periods required by applicable California law.

9.4 Users in Canada

If you are located in Canada, applicable privacy laws may provide rights to:

  • access personal information held about you;
  • request correction of inaccurate or incomplete information;
  • withdraw consent, subject to applicable legal restrictions;
  • request information about how personal information is used or disclosed;
  • lodge a complaint with the appropriate privacy authority.

Requests may be sent to:

hey@heymama.baby

9.5 Users in Brazil

LGPD

If you are located in Brazil, applicable law may provide rights to:

  • confirm whether personal data are being processed;
  • access your personal data;
  • request correction of incomplete, inaccurate or outdated data;
  • request anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
  • request portability where applicable;
  • obtain information about recipients of your personal data;
  • withdraw consent;
  • request information about the consequences of refusing consent;
  • lodge a complaint with the competent authority.

Requests may be sent to:

hey@heymama.baby

9.6 All Users

Regardless of where you live, you may:

  • access and update certain information directly within the application;
  • export available records for all child profiles associated with your account;
  • delete individual records where this functionality is available;
  • manage access to a shared child profile;
  • permanently delete your account;
  • contact us with questions or requests concerning your personal data.

These options do not limit any additional rights available under applicable law.

10. Children’s Privacy

heymama baby is intended for parents, legal guardians, caregivers and other persons who are legally authorized to provide and manage information relating to a child.

The application is not intended for children to use independently on their own behalf.

All information relating to a child, including the child’s name, date of birth, profile photo, care records, health information and developmental information, is entered and managed by a user who is legally authorized to do so.

By creating or managing a child profile, you confirm that you are:

  • the child’s parent or legal guardian; or
  • another person who has been authorized by the child’s parent or legal guardian to provide and manage the child’s information.

You are responsible for ensuring that:

  • the child’s information is provided and managed lawfully;
  • any person with whom you share the child’s profile is authorized to access and manage that information.

We do not knowingly offer heymama baby to children for their independent use or knowingly collect personal data directly from children acting on their own behalf.

Where health data relating to a child are entered into heymama baby, we process those data only after the authorized user has provided explicit consent, as described in Sections 3 and 8 of this Privacy Policy.

If we become aware that:

  • a child is using the application independently without appropriate authorization;
  • a child profile has been created by a person who is not authorized to manage the child’s information; or
  • personal data relating to a child have otherwise been provided unlawfully,

we may restrict access to the relevant account or child profile while we review the situation.

Where appropriate and permitted by applicable law, we may remove or delete the relevant personal data.

If you believe that personal data relating to a child have been provided or managed without appropriate authorization, please contact us at:

hey@heymama.baby

We will review the request and take appropriate action without undue delay.

Rights relating to a child’s personal data may be exercised by the child’s parent, legal guardian or another person legally authorized to act on the child’s behalf, subject to applicable law.

Depending on the child’s age, maturity and applicable law, the child may become entitled to exercise certain data-protection rights independently.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • changes to heymama baby or its features;
  • changes to the personal data we process or the purposes of processing;
  • changes to our service providers or technical infrastructure;
  • changes in applicable laws, regulatory guidance or legal requirements;
  • improvements to the clarity or accuracy of this Privacy Policy.

The effective date and date of the most recent update will be shown at the beginning of this Privacy Policy.

Where changes are minor, administrative or do not materially affect how personal data are processed, we may make the updated Privacy Policy available through the application, our website or another appropriate location.

Where we make material changes that may significantly affect your privacy or your rights, we will take reasonable steps to inform you before the changes take effect.

Depending on the nature of the change, this may include:

  • an in-app notice;
  • a notice displayed when you open the application;
  • an important notice sent to the email address associated with your account;
  • another appropriate communication method.

We do not use your email address to send regular marketing or promotional communications.

Where a change:

  • introduces a new processing purpose;
  • materially changes the legal basis for processing;
  • expands the categories of health data processed;
  • materially changes how health data are used; or
  • otherwise requires consent under applicable law,

we will provide the relevant information and request any required consent before the new processing begins.

Material changes affecting processing based on explicit consent will not be treated as accepted solely because you continue to use heymama baby.

Where a new explicit consent is required, we will request it separately and record the applicable consent version and the date and time when consent was provided.

If you do not agree with an updated Privacy Policy, you may stop using the relevant features or permanently delete your account through the application.

12. Contact

If you have any questions about this Privacy Policy, wish to exercise your privacy rights or contact us regarding the processing of personal data, you can reach us at:

Qubiri s.r.o.

Fialová 8A

851 07 Bratislava

Slovakia

Business ID (IČO): 57708231

Email: hey@heymama.baby

We aim to respond to privacy-related requests without undue delay and within the time limits required by applicable law.

13. Control Over Your Data

We believe that you should remain in control of your personal data.

Depending on the functionality available within heymama baby, you may:

  • view and update certain account and child-profile information;
  • add, edit or delete individual care and health-related records;
  • add or remove child-profile information;
  • select, replace or remove a child profile photo stored locally on your device;
  • manage access granted to another authorized user;
  • export available records for all child profiles associated with your account in CSV format;
  • permanently delete your account;
  • where a child profile is shared, choose whether to leave the child profile and its records available to another connected user or delete the shared profile and its associated records;
  • withdraw explicit consent to the processing of health data by contacting us at hey@heymama.baby.

Where you withdraw consent to the processing of health data, we will:

  • stop processing the relevant health data on the basis of consent;
  • delete the relevant health data, unless continued retention is required by applicable law;
  • record that consent has been withdrawn;
  • disable the health-related features until explicit consent is provided again.

Deleting your account results in the deletion or preservation of personal data according to the option you select and as described in Section 7 – Data Retention and Deletion.

The in-app CSV export contains available records for all child profiles associated with your account. It does not necessarily contain all personal data processed in connection with your account. You may contact us to request access to personal data that are not included in the in-app export.

Profile photos are stored locally on your device and are not included in the cloud-based export.

Certain limited information may be retained where this is necessary to comply with applicable legal obligations, resolve disputes, prevent fraud or establish, exercise or defend legal claims.

Our goal is to process personal data transparently, securely and only to the extent necessary to provide and operate heymama baby.

Nothing in this section limits any rights available to you under applicable data protection law.