LegalPrivacy Policy
Privacy Policy
1. Who We Are
Nativity Ltd (Optimal, we, us, our), trading as Optimal, Optimal Being, provides a pregnancy-nutrition consumer application and related websites.
| Item | Detail |
|---|---|
| Controller | Nativity Ltd |
| Company number | 17457413 |
| Registered address | 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF |
| Incorporation | England and Wales, United Kingdom |
| Privacy contact | [email protected] |
| DPO / privacy lead | [email protected] |
| EU representative | [email protected] |
| UK representative | Not required (Nativity Ltd is established in the UK) |
| APAC privacy contact | [email protected] |
| Website | https://beingoptimal.org |
2. Scope
This Privacy Policy applies to Personal Data we process when you:
- visit beingoptimal.org and related first-party sites;
- create an account and use the nutrition planner;
- use the AI assistant, Learning Center, quizzes, notifications, or sharing features;
- participate in the community forum;
- contact support or privacy channels;
- click partner or affiliate outbound links we instrument.
It does not govern third-party websites you visit after leaving our Services, except our disclosure of click measurement. Community software is operated with a Community Platform Provider. Additional forum privacy notices may apply on https://community.beingoptimal.org.
3. Special-Category Health Data
Optimal is a pregnancy-nutrition product. In ordinary use we process data that is special category under GDPR Article 9 and similar laws (Special Category Health Data), including:
| Data | Examples |
|---|---|
| Pregnancy timing | Last menstrual period (LMP), estimated due date (EDD), gestational context derived from those anchors |
| Demographics related to health targets | Date of birth; ethnicity, where you choose to provide it for target personalization |
| Body measures | Weight and related body stats you enter |
| Self-reported clinical-style fields | Blood-marker or lab values you type in; symptoms you journal |
| Nutrition behavior | Meal logs, combos, templates, custom ingredients used to infer nutrient intake |
Day Scores, nutrient flags, optimizer suggestions, and AI responses are generated from this data and may themselves reveal health-related information.
For Special Category Health Data you enter in the planner, we rely on your acceptance of the Terms and Privacy Policy when you create your account and on your voluntary provision of the data and your use of certain features. Where you choose to contribute analytics about your health details, weight, or ancestry, we rely on explicit consent (GDPR Art. 9(2)(a) / UK equivalent), which you give separately in the Privacy Center.
Other non-special Personal Data may rely on contract, legitimate interests, legal obligation, or consent as described in Section 6.
You choose what health fields to enter. Some features work poorly without timing or profile data. You may request deletion or restriction as described in Section 12, subject to Section 13.
4. Personal Data Collected
4.1 Data You Provide
| Category | Examples | Notes |
|---|---|---|
| Identity and contact | Name, email | Via Authentication Provider |
| Account profile | Display preferences, locale, theme | |
| Pregnancy / health profile | LMP, EDD, date of birth, ethnicity, weight | Special category |
| Labs and symptoms | User-entered blood markers, journal symptoms | Special category; not your clinic’s medical record |
| Nutrition logs | Meals, quantities, combos, templates, custom ingredients | Special category when used for intake inference |
| AI conversations | Messages you send; assistant replies | Persisted; may include health context |
| AI preferences | Settings for assistant behavior | |
| Quiz / Knowledge Score | Progress and answers | Educational |
| Community content | Posts, uploads, forum profile | |
| Tasks | Scheduled reminders and their completion status | |
| Wishlist | Items you list, and their sharing link | See §9.3 for data a purchaser may add |
| Support communications | Emails you send us | |
| Billing identity | Email, subscription status | Card data at Billing Provider |
| Billing region | The country you choose as your billing region | Kept with your account and recorded on each order. To correct it, contact support (see Section 12) |
4.2 Data Collected Automatically
| Category | Examples | Notes |
|---|---|---|
| Technical | IP address, user agent, device or browser type | Security, rate limits, approximate geo at the edge |
| Auth / session | Session tokens, device sessions | Authentication Provider |
| Product logs | API errors, entitlement checks, security events | Operational |
| Push subscription | Endpoint URL, keys | If you enable Web Push |
| Outbound clicks | Brand, URL, surface, partner flag | Pseudonymous: no user id; IP transient only |
| First-party catalog analytics | Catalog choice events (the food or dish picked, country or region, age band) | On by default; you can turn it off in the Privacy Center. Ancestry and pregnancy stage are added only with your explicit consent (Section 9.1) |
| Exploration-interest analytics | Which content topics you view in sequence, plus coarse buckets such as day-part, country/region and age-band; and, only if you give your explicit consent, gestational-phase and ethnicity-category | Collected under a pseudonym; only aggregate figures are published and no user id travels with them. The ordinary buckets are opt-out. The gestational-phase and ethnicity-category buckets need your explicit consent, which we ask for in the Privacy Center and you can change at any time in the Privacy Center. Nothing is published unless a minimum number of people stand behind the figure. We set that threshold and apply it at release. It may be raised, and is never lowered by agreement. One release mode substitutes calibrated statistical noise for that threshold; under it no figure is exact, and it is offered only by negotiated agreement, never by default. |
| Approximate location labels | Country / region, and a city for notifications on the device application | See Section 8 |
4.3 Data From Providers
| Source | Examples |
|---|---|
| Authentication Provider | Account id, email, profile fields, session lifecycle events |
| Billing Provider | Subscription state, invoice metadata |
| Community Platform Provider | Forum user id linkage, moderation signals |
| AI Model Providers | Model outputs returned to us (we do not receive advertising profiles from them) |
4.4 Data Not Intentionally Collected
- Full payment card numbers or CVVs (handled by the Billing Provider)
- Precise GPS storage (see Section 8)
- Third-party advertising profiles
- Background continuous device location tracking
4.5 Children’s Data
Services are not directed to children under 18. Age is self-attested. See Section 15.
5. How We Use Personal Data
| Purpose | Examples | Categories |
|---|---|---|
| Provide the Services | Auth, sync meals, compute scores and targets, environments | Identity, health, meals, technical |
| Personalize nutrition context | Gestational timing, targets, flags | Health profile |
| AI assistant | Generate replies; optional propose-only writes | Conversations, health context snippets |
| Safety | Red-flag redirects, abuse detection, rate limits | Messages, technical |
| Notifications | Transactional email; optional push | Contact, push keys, notification preferences |
| Community | SSO identity, host discussions | Identity, user-generated content |
| Improve product | Catalog analytics (on by default, opt-out); aggregated stats; exploration-interest analytics (on by default, opt-out; health-detail, weight, pregnancy-stage and ancestry signals only with your explicit consent) | Pseudonymous / aggregate / anonymous |
| Partner measurement | Outbound click events | Pseudonymous click rows |
| Security and fraud | Session integrity, anomaly detection | Technical, authentication |
| Legal compliance | Tax, accounting, lawful requests | As required |
| Communications | Terms updates, support | Contact |
We do not sell Personal Data for money. See the US annex regarding “share” for cross-context behavioral advertising. We do not engage in that practice with third-party ad networks.
6. Legal Bases
| Processing | Primary basis (EEA/UK-style) |
|---|---|
| Account and core planner | Art. 6(1)(b) contract |
| Special Category Health Data in the planner | Art. 6(1)(b) contract, on your acceptance of the Terms and your voluntary provision of the data |
| AI with health context | Explicit consent posture (Art. 9), plus contract or legitimate interests for non-special metadata |
| Security, fraud, rate limits | Art. 6(1)(f) legitimate interests |
| Transactional email | Art. 6(1)(b) or (f) |
| Optional push | Consent (browser and product) |
| Analytics signals about your health details (symptoms, blood results, stage of pregnancy), your weight, or your ancestry | Explicit consent (Art. 9(2)(a)), asked separately, in the Privacy Center, off until you tap. You can withdraw it at any time in the Privacy Center; that stops further collection and does not remove figures already published in aggregate. |
| Catalog analytics and exploration-interest analytics (ordinary buckets) | Legitimate interests (Art. 6(1)(f)). Collected under a pseudonym and published only as aggregate figures above a minimum group size. Opt-out is available. |
| Pseudonymous outbound clicks | Legitimate interests (measurement, abuse prevention) |
| Legal obligations | Art. 6(1)(c) |
| Aggregated / de-identified statistics | Legitimate interests; not Personal Data when truly anonymous |
Legitimate interests include securing the service, preventing abuse, understanding feature performance in aggregate, and measuring partner links without building advertising profiles. You may object where applicable (Section 12).
7. AI Assistant
When you use the AI assistant:
- Your message and relevant health or context snippets from your environment may be assembled server-side.
- That prompt content is sent to one or more AI Model Providers to generate a response.
- Conversation content is persisted in our application database.
- Separate operational metadata about AI runs may be stored without full message bodies.
- Safety pre-checks may inspect content for red-flag patterns.
AI Model Providers process data primarily in the United States and potentially other regions they operate. Using the assistant means international transfer of conversation and health context to those providers under their data processing terms.
| Store | Retention posture |
|---|---|
| Our conversation records | While account active unless deleted; external Model Provider copies per provider DPA |
| AI run metadata | Operational retention while the account is active, or as needed for security and debugging |
| AI Model Provider copies | Per provider terms. We do not currently instruct those providers to delete their copies when you erase your account |
Statements that “your questions never leave your device” apply only to browser-based Help Center search. They do not apply to the AI assistant, cloud-synced planner data, or server-side analytics or geo lookup.
Scores, flags, optimizer suggestions, lab comparisons, Knowledge Scores, and AI text are informational outputs, not medical decisions. Details can be found at: Automated Decisions & AI Transparency.
8. Location
We do not store GPS coordinates as a location history.
When you use a feature that resolves approximate place (for example country or region for localization), your device may supply latitude and longitude briefly. Raw coordinates may be transmitted to our Reverse-Geocoding Provider to convert them into place labels. We may persist country or region or similar coarse labels. We do not store the raw coordinates in our application database.
Our CDN / Edge Network Provider and Hosting Provider may see IP-derived geo signals as part of normal HTTP delivery. That is separate from optional device GPS reverse-lookup.
In the application, once notifications have been allowed and enabled on your device, the application will register your device and record the approximate area's country and city with the registration. If location has been allowed in the device settings, the application reads the position when notifications are enabled, when the application opens, and when the device gives the application a new notification registration, and only while the application is on screen. This sends the position through our server to a reverse-geocoding provider to name the city. We do not store the coordinates. If it has no position, your IP address will be used instead. If notifications are not enabled in the application, it does not read your position. You can see and remove the area for each device in your notification settings.
9. Sharing & Sub-Processors
We use infrastructure and service providers under contract. Named vendors appear in the Sub-processor List.
| Role | Purpose | Typical data |
|---|---|---|
| Authentication Provider | Sign-in, sessions, identity | Email, name, session tokens |
| Webhook Transport | Deliver auth lifecycle events | Webhook payloads, user events |
| Database Provider | Primary app data with access controls | Health profile, meals, AI conversations, prefs |
| Hosting Provider | Web application hosting | HTTP requests, cookies |
| CDN / Edge Network Provider | DNS, CDN, edge security, visit counting on the public website | IP, headers, geo signals, page views and page-load timing |
| Cloud Infrastructure Provider | Privileged backend compute, object storage | Backend-processed data, forum uploads |
| Email Delivery Provider | Transactional email | Recipient email, message content |
| AI Model Providers | Generative assistant | Conversation content, health context snippets |
| Community Platform Provider | Forum and SSO | Identity, posts, uploads |
| Reverse-Geocoding Provider | Coordinates to place labels | Raw coordinates, transient |
| Billing Provider | Subscriptions & Purchases | Billing email, subscription status |
| Email Design Provider | Operator-side email templates | Template assets |
Forum single sign-on sends identity fields needed to create or link a community profile. Pregnancy timing fields are not shared via SSO under current product configuration.
We may also disclose Personal Data:
- to professional advisors under confidentiality;
- to an affiliate, successor, or acquirer of our business, technology, or intellectual property, including in connection with a restructuring, licensing arrangement, merger, acquisition, or asset sale, whether or not that party is the entity with which you originally contracted, with notice only where required by applicable law;
- to comply with law, lawful process, or mandatory government requests (see Law Enforcement Guidelines);
- to protect rights, safety, and security of users, the public, or Optimal;
- with your direction (for example share links you create).
We do not integrate third-party ad networks, sell personal information to data brokers, or run third-party session-replay or marketing analytics pixels on the consumer app. Our Hosting Provider may collect limited page-view or performance telemetry separate from first-party catalog analytics. See the Sub-processor List.
Public nutrient composition data (Nutrient Data Source) is a data source, not a Personal Data sub-processor.
9.1 Analytics Partners & Notification Firewall
Organizations that buy population analytics buy aggregate, anonymized figures only, released above a minimum group size and never containing a record about an identifiable person (Sections 4.2, 6, 11). Buying analytics never buys a message to you. Those are separate products, and there is no path between them. An organization that pays for population data cannot, by doing so, reach you with a notification, an email, a placement, or a request that we send one on its behalf. See the Advertising & Affiliate Disclosure.
Some exploration-interest signals are derived from health-adjacent entries, such as your trimester or that you are short on a given nutrient. Those signals never include your raw symptom text, lab values, or an identifiable record. Because they concern your health, we collect them only if you give a separate, explicit consent (Section 6), which we ask for in the Privacy Center and which you can change at any time in the Privacy Center. Signals that are not about your health follow the legitimate-interests, opt-out basis in Section 6. The underlying Journal, labs, and symptom entries you make for your own planner remain governed by the basis described in Section 3. Anonymous, aggregate signals derived from population-wide patterns do not carry your identity into it.
What you can choose to contribute ("Helping parents like you"). In the Privacy Center, one master switch (on unless you turn it off) controls whether your activity helps other parents at all, and tiles then control what. Some tiles are on unless you switch them off (Section 6): your food choices and eating patterns, and your mood as a band. Others start off and need you to tap them, because they concern your health or ancestry, and we ask for your explicit consent: Health details (which symptoms you record and how strong, blood results as banded values, and your stage: trimester and week, how long you have been trying to conceive, or the postnatal period, attached to what you share), Weight (a coarse band describing how your weight change compares with a published guideline range, never your weight itself), and Background (an ancestry category). Each is separate, none is bundled with another, and you can change any of them at any time in the Privacy Center. Turning one off stops further collection and does not remove figures already published in aggregate. Your own Journal, labs and symptom entries for your planner are not affected by these choices.
9.2 Personal API / MCP Access
You may generate a Personal API key, or connect via OAuth, to grant a third-party tool of your choosing read-only access to your own account data (for example journal, labs, plans, profile, Tasks, Wishlist). This is:
- opt-in and user-initiated. Nothing is shared this way unless you create the key or complete the connection yourself, from your account's Integrations settings, after acknowledging what the key grants;
- logged. Each read made with a key or connection is recorded;
- revocable. You may revoke a single key, a single connection, or all of them, at any time, from the same settings;
- your responsibility once retrieved. Once your data is read by a tool you connected, what that tool does with it is governed by your agreement with that tool's provider, not by this Policy. Treat a Personal API key like a password.
9.3 Data From Other People (Wishlist)
If you share a Wishlist link, a person who opens it, including someone without an Optimal account, may mark or note an item as purchased and optionally supply a name or short message. That information is stored so it can be shown to you on your Wishlist. A purchaser is never required to give a name or message to mark an item purchased. You control the Wishlist's sharing link and may disable sharing at any time.
10. International Transfers
Primary application processing and storage regions include Primarily United States; global edge delivery (primarily United States with global edge delivery).
Where we transfer Personal Data from the EEA, UK, Switzerland, or other regions requiring safeguards, we rely on appropriate mechanisms such as Standard Contractual Clauses or UK IDTA/Addendum, provider certifications or frameworks where valid, encryption in transit, encryption at rest as provided by vendors, and least-privilege access. See the Security Overview and the Sub-processor List.
If you enter another person’s health data, you must have a lawful basis and any required consents.
11. Retention
| Data class | Retention |
|---|---|
| Account and planner data | Active account lifetime; deletion on account close subject to Privacy Policy caveats |
| AI conversations | While account active unless deleted; external Model Provider copies per provider DPA |
| First-party analytics | As needed for product improvement (first-party, pseudonymous) |
| Exploration-interest analytics | The individual-level record is short-lived. The anonymous aggregate is retained indefinitely and, once published, cannot be withdrawn as there is no individual record left to remove. |
| Outbound click rows | As needed for partner reporting and abuse prevention |
| Auth and security logs | Provider and operational defaults and security needs |
| Email provider logs | Per Email Delivery Provider retention |
| Billing records | at least seven (7) years from the end of the relevant accounting period, plus any longer period required by our Billing Provider or applicable law |
| Record of what an account agreed to | Pseudonymised records kept after the account is deleted until the end of the seventh calendar year after the year of agreement. |
| Payment records kept after account deletion | Pseudonymised records until the end of the seventh calendar year after the year of payment. |
| Tax record of each sale (amounts, tax, country, date) | Ten years from the end of the year of the sale. Pseudonymised. |
| Tax record of a gift sale (country of the purchaser, the tax areas and rates applied, amount, date) | Ten years from the end of the year of the sale |
| Legal holds | Legal hold suspends deletion where required by law |
| Backups | Rolling backup windows; residual copies expire with the backup cycle |
Deletion is not always instantaneous across every system. See Section 13.
12. Your Rights
Depending on your location, you may have rights to:
| Right | Description |
|---|---|
| Access | Confirm processing and obtain a copy |
| Correction | Fix inaccurate data |
| Deletion / erasure | Request deletion, subject to exceptions and Section 13 |
| Portability | Receive data in a structured format |
| Restriction | Limit processing in certain cases |
| Objection | Object to legitimate-interests processing |
| Withdraw consent | Where processing is consent-based, including special category |
| Appeal / complain | Lodge a complaint with a supervisory authority |
| US consumer rights | Know, delete, correct, opt-out of sale/share, limit sensitive use, as applicable |
How to exercise: Please email [email protected], or use in-product export where available. The procedure is described at: Data Subject Request Procedure. We may need to verify your identity.
You can close your account from account settings or by contacting us. That starts deletion of your account and the records held under it, as described in Section 13.
Self-serve export is typically scoped to the planning environment you select and may not include everything we hold (for example AI conversation bodies). For a fuller copy, we recommend contacting [email protected]. We will fulfill applicable legal rights even where self-serve export is incomplete.
13. How Deletion Works
We automate removal of your account and the records held under it when you close your account. The following limits apply.
Community. When an account is deleted, the forum profile will be anonymized. This removes your name and email address and any connection between the forum and your account. Any IP addresses the forum held in relation to your use are replaced, and your username is anonymized. Posts and uploads are not deleted. They remain visible and unmodified under that anonymous identifier. Account deletion is not complete until this operation has been successful. Backups and legal holds may retain copies for longer.
Processors and backups. Copies held by AI Model Providers, email logs, object storage, CDN or hosting logs, and rolling backups may remain for a limited time under those providers’ terms or our backup cycle. We do not currently instruct AI Model Providers to delete their copies on account erasure.
Payments. When an account is deleted we instruct billing providers to delete the customer profile, including saved payment methods. Providers may keep invoices and payment records that tax and accounting law require, which may retain the name, email address and card summary used for the payment.
Payment records. When an account is deleted we retain certain records for tax and accounting. This includes records of each credit-pack payment, including amount, currency, date and the payment provider's reference, and a record of the payment events that go with it. We delete these pseudonymised records at the end of the seventh calendar year after the year of the payment. Unused purchased credits will be forfeited when an account is deleted.
Gifts. When a gift plan is purchased, we keep your email address with the payment record for as long as we retain these records (Section 13). If you request that we email the gift, you provide us the recipient's email address, an optional note and your name. We will only use this information to send the gift. If you schedule the gift for a later date, we will need to keep this information until then. We will delete the recipient's address as soon as the email has been sent, and in any case within 25 hours of the time it was due to be sent if it could not be sent, or at once if the gift is cancelled. We will delete the note and your name when the gift is redeemed, expires or is cancelled. If you receive a gift, your email address was provided to us by the person who bought it, and we will not keep it after the email has gone. Redeeming a gift uses your account, which this policy covers as it covers any account. The gift link contains no personal data. When a gift is purchased, we retain information concerning the country of the purchaser alongside the tax record of the sale.
Custom ingredients. Custom ingredients may be deactivated and then removed with environment cleanup rather than instant isolated deletion.
Anonymous aggregates. Anonymous participations prevent identification and cannot be taken back. Anonymized or aggregated statistics that no longer identify you are retained and cannot be withdrawn, because no individual record remains to remove. That includes published exploration-interest analytics.
Proof of what you agreed to. When an account is deleted, we keep a record of what was agreed to and when. This includes which version of the Terms and Privacy Policy and health-information consent. This is kept as evidence in case of a dispute or legal claim, and it is deleted at the end of the seventh calendar year after the year in which the agreement was made. The pseudonymised record no longer carries your account id, name or email address, and it holds no IP address or browser details. It carries a code generated with a key stored apart from our database. The rights in Section 12 apply to it.
Legal holds. We may retain data when required by law, dispute, security investigation, or Legal hold suspends deletion where required by law.
If something still looks linked to you after you close your account, contact [email protected].
14. Security
We implement administrative, technical, and organizational measures appropriate to risk, including encryption in transit (TLS), encryption at rest as provided by our Database Provider and cloud storage, authentication via the Authentication Provider, user-scoped application access controls, and least-privilege operational access. Privileged operations run on isolated backend infrastructure, not in the public web application.
No method of transmission or storage is completely secure. See the Security & Compliance Overview. Report vulnerabilities under the Vulnerability Disclosure Policy or to [email protected].
15. Children
The Services are for users 18+. They are not directed to children under 18. We do not knowingly collect Personal Data from children under 18. Age is self-attested. If you believe a child under 18 provided data, contact [email protected] and we will take appropriate steps.
16. Cookies & Similar Technologies
We use essential authentication cookies, functional storage, optional push, and pseudonymous outbound click beacons. We do not use non-essential third-party advertising cookies. Full detail: Cookie Policy.
Help Center browser search runs on-device. That is a search implementation only.
17. Automated Processing
We use automated processing to generate informational scores, flags, optimizer suggestions, lab comparisons, Knowledge Scores, and AI replies. These are not intended to produce legal or similarly significant medical decisions about you without human involvement. You and your clinician decide care. See Automated Decisions. You may contact [email protected] to contest or seek explanation of significant automated outputs where law provides that right.
18. Third-Party Links & Partners
Outbound partner links may record pseudonymous click events (Section 4.2). Partner sites have their own privacy policies. Advertising disclosures: Advertising & Affiliate Disclosure.
19. Changes
We may update this Privacy Policy. Material changes (especially new AI purposes, new special-category uses, or new tracking) will be noticed by reasonable means and may require re-acceptance. The Effective date and suite version will update.
20. Contact
| Topic | Contact |
|---|---|
| Privacy requests | [email protected] |
| DPO / privacy lead | [email protected] |
| Legal | [email protected] |
| Support | [email protected] |
| Security | [email protected] |
| EU rep | [email protected] |
| UK rep | Not required (Nativity Ltd is established in the UK) |
| APAC | [email protected] |
Postal: 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF
Regional Annexes
These annexes apply when you are in the relevant region. If they conflict with the main body on a region-specific mandatory point, the annex controls for that point.
Annex A — EEA / EU (GDPR)
Nativity Ltd is controller for Personal Data processed in connection with the Services. EU representative: [email protected] (if required and appointed).
Processing of the health data you enter relies on Art. 6(1)(b) contract, on your acceptance of the Terms and your voluntary provision of this data. Analytics about your health details, weight, or ancestry rely on Art. 9(2)(a) explicit consent, which you give separately in the Privacy Center and can withdraw at any time without affecting prior lawful processing.
Transfers outside the EEA use appropriate safeguards (Section 10), including SCCs with sub-processors where applicable.
You have GDPR rights of access, rectification, erasure, restriction, portability, objection, and consent withdrawal. You may lodge a complaint with your local supervisory authority. Identity verification may be required.
Informational scores and AI guidance are not intended as solely automated decisions producing legal or similarly significant effects. If you believe a particular output has such effect, contact [email protected].
Data Protection Officer: [email protected]
Annex B — United Kingdom
UK GDPR and Data Protection Act 2018 apply to UK users as applicable. A UK Article 27 representative is not required: Nativity Ltd is established in the UK.
Special-category data, transfers, and rights are substantively parallel to Annex A, with UK transfer tools (IDTA/Addendum) where used. Complaints may be directed to the UK Information Commissioner’s Office (ICO) and to [email protected].
Annex C — United States (CCPA/CPRA & State Laws)
We collect identifiers; customer records information; protected health-adjacent information you submit (Optimal is generally not a HIPAA covered entity or business associate for this consumer app); internet/technical data; coarse geolocation labels; inference-like scores generated from your logs; and media only if you upload it to community features.
Purposes are described in Sections 4 and 5.
We do not sell Personal Information for monetary consideration. We do not share Personal Information for cross-context behavioral advertising with third-party ad networks. Pseudonymous outbound click logs are first-party measurement, not a third-party ad auction.
If you believe an opt-out still applies under a broad state definition, contact [email protected] or use any published preference-signal process we enable. We will honor Global Privacy Control where legally required for covered selling or sharing once such activity exists. Under current practices, there is no adtech sale or share to opt out of.
C.1 Sensitive Personal Information & Sponsored Personalization
Pregnancy and health information you provide is treated as sensitive. We use it to provide the Services you request, not for unexpected secondary advertising profiling. You may request limitation of sensitive PI use to what is necessary to perform the Services by contacting [email protected].
Sponsored personalization is first-party and on-device. Country, region and age are opt-out; trimester and nutrient shortfall are opt-in. Some items in the food picker are paid placements, always labeled (see the Advertising & Affiliate Disclosure). Unless you opt out, they may be chosen using your country or region and your age band, always as bands and never as exact values. Your trimester band, whether you are currently short on a given nutrient, and dietary or cuisine affinity are used only if you turn on a second, separate switch in the Privacy Center, which starts off. If you opt out, they are chosen from the food category you are viewing and nothing about you is used.
Matching happens on your own device: a brand describes an audience, your device decides privately whether you are in it, and no attribute about you is transmitted for that purpose. A brand receives only aggregate delivery figures, subject to a minimum group size. The pseudonymous record that a placement was shown or added can show that you matched an audience (see the Disclosure, Section 3.4); where that audience used your trimester band or nutrient shortfall, the record exists only because you turned the second switch on. A brand may discover that you are short on a nutrient, never a specific measurement or laboratory result.
Categories we will not use for advertising. We do not currently use ethnicity or ancestry, medical diagnoses or conditions, or blood and laboratory results to select a paid placement, and there is currently no option to enable it. Ancestry is collected in part so that blood-marker reference ranges can be read against the appropriate clinical cohort.
Opting out returns you to category-only placements. It does not remove past aggregate figures that have already been reported, which cannot be attributed to you individually.
A notification is a separate choice, and uses less than a placement can. Sponsor notifications are off until you turn them on in the Privacy Center, and you can change your answer at any time. Turning on placement personalization does not turn on notifications, and turning on notifications does not change which placements you see. A sponsor may not use your stage of pregnancy or whether you are currently short on a nutrient to select a notification: notifications can use only your country or region and your age band. A placement you have already opened the app to view can use them if you turned on the second switch. The categories this section currently refuses (ethnicity, ancestry, diagnoses, blood or laboratory results) are refused for both, without exception. See also Section 9.1.
C.2 Rights, HIPAA, Children
California and certain other states provide rights to know, delete, correct, portability, and non-discrimination for exercising rights. Submit requests to [email protected]. Authorized agents may submit with proof as required by law. We will respond within statutory timelines.
Unless we expressly enter a BAA for a future covered offering, this consumer app is not designed as a HIPAA electronic health record. Do not assume HIPAA applies.
We do not knowingly sell or share personal information of consumers under 16. Services are 18+.
Annex D — APAC (Singapore PDPA, Australia Privacy Act/APPs, Hong Kong PDPO)
Contact: [email protected].
We notify you of purposes via this Policy and product UI. Where local law requires consent for health data or cross-border transfer, your account acceptance and voluntary use of features constitute consent to the extent permitted. We may implement additional just-in-time consents.
Personal Data may be transferred to and processed in the United States and other countries where our sub-processors operate. We take reasonable steps to ensure recipients protect Personal Data consistently with this Policy and applicable law.
You may request access and correction via [email protected]. We respond within timeframes required by local law.
We handle personal information in accordance with the Australian Privacy Principles as applicable to our activities. Overseas disclosures are described in this Policy. Complaints: contact us first; you may also contact the OAIC.
In Singapore, deemed consent and contractual necessity may apply to account processing. Health data is collected to provide nutrition planning features you request. Withdrawal of consent may mean we cannot continue those features.
In Hong Kong, data is used for purposes stated herein. You may request access or correction under PDPO via [email protected].