Withya Consumer Health Data Privacy Policy

Last updated: October 26, 2026 · Version 1.3

1. Scope and who we are

This policy applies to consumer health data, as defined by Washington’s My Health My Data Act, Nevada’s consumer health data law and Connecticut’s consumer health data provisions, that Withya collects from consumers those laws protect. It supplements our Privacy Policy, which describes our other practices. Withya is operated by STH Technologies, LLC, 9206 Sunshine Pl, Downey, CA 90240, United States. Contact: [email protected].

2. Consumer health data we collect and why

We may collect the following categories of consumer health data, entered by adults about a child or about themselves:

feeding, nursing, pumping, sleep, diaper and food records, including food introductions and reactions;
symptoms, temperatures, medicines, illness and related notes;
growth measurements and growth details, such as gestational age and the sex used for growth references;
health details in a child’s profile, such as notes written for the assistant (for example allergies) and a health provider’s contact details;
health-related appointments, plans, checklists, reminders and outcomes;
answers you give to set up features, such as estimates, and your feedback on them;
history imports: files exported from other apps, photos of paper records, and the suggested entries we produce from them, including by artificial-intelligence transcription;
photos, videos and captions that reveal a health condition;
questions to the assistant, the child details used to answer them, and the answers;
community posts and messages in which you include health information, and community stages that may reveal a pregnancy;
precise location, when you grant permission, used to find a city, state and country;
approximate location derived from your IP address, to the extent it reveals health information;
derived data, such as the child’s age, care summaries, totals and insights, routine-planning estimates such as sleep timing, and growth percentiles and charts; and
technical and usage data (such as identifiers, IP address, device information, diagnostic reports and how you use features, including health-related features) to the extent it reveals health information.

We collect this data to provide the features you request, such as records shared among the adults you choose, history imports, reminders, estimates, growth and care displays, assistant answers, exports, connected device features and support; to secure the Service, prevent abuse, fix problems and meet legal duties; where you have consented or the law permits, to understand how the app is used; and, as part of providing and maintaining the features you request, to check that estimates and other features work correctly, reporting aggregate results.

3. Sources

We collect consumer health data from you; from other adults linked to the same child; from files and photos you import; from your device and the device features and services you turn on, such as widgets, watches, voice assistants and, with your permission, your device’s location service; from your device’s network connection; and from our own processing of the records you provide, including by our artificial-intelligence features.

4. How we use it

We use consumer health data as reasonably necessary to provide the features described in section 2, to respond to your requests, to protect the Service and its users and to comply with law. Where you have consented or the law permits, we also use it to understand how the app is used. As part of providing and maintaining the features you request, we also use it to check that estimates and other features work correctly, reporting aggregate results; we do this within the Withya service, and it is not training an artificial-intelligence model. We do not use consumer health data for advertising. We do not use it to train artificial-intelligence models. Our providers are not permitted to use it to train their own models.

We share the categories in section 2 as needed for each recipient’s function:

care, journal and health-related records, history imports, estimates, plans and media: with the adults linked to the child;
questions, answers and the child details described in our Privacy Policy, and photos of paper records you import: with the cloud provider that runs the artificial-intelligence models we use, under contract and on our instructions;
all categories, for storage and processing: with hosting, storage and infrastructure providers;
content you include in posts or messages: with the members who can see them and with our moderation team;
information you include in a support request: with our email and support providers;
technical and diagnostic data, to the extent it reveals health information: with our crash reporting provider, if you turn crash reporting on;
information you choose to send to device features and services you turn on, such as calendars, widgets, watches, voice assistants and device backups: with those services; and
any category: with authorities, courts or advisers where the law requires or permits, and with a successor in a business transfer.

6. Third parties and affiliates

Categories of third parties with which we share consumer health data: adults you link to a child; members you address in the community; hosting, storage and infrastructure providers, including the cloud provider that runs the artificial-intelligence models we use; sign-in providers; email, text-message and notification delivery providers; our subscription provider (identifiers, device information and purchase status); our crash reporting provider, if you turn crash reporting on; app stores (purchase records); support and mailbox providers; device makers and other services you choose to connect; and legal, regulatory or professional recipients where required.

Our service providers are bound by contract to process the data on our instructions. Authorized personnel, including employees and contractors working for us who are required to keep it confidential, may access consumer health data when needed for the purposes in section 4. You can ask for a list of the specific third parties and affiliates with which we have shared your consumer health data, as section 9 describes.

7. No sale, no targeted advertising, no geofencing

We do not sell consumer health data and will not sell it without your valid authorization. We do not use it for targeted advertising. We do not use geofencing around any facility that provides in-person health care services. We do not allow third parties to collect consumer health data through our Service to track you over time and across different sites or apps, or for advertising. Analytics on our website loads only if you accept it, with advertising features turned off, as our Privacy Policy describes. Services you choose to connect or use on your own device, such as calendars, watches, voice assistants and device backups, handle the information you send them under their own terms.

We collect and share consumer health data as necessary to provide the features you request, such as keeping the records you enter, sharing them with the adults you link to a child, importing the files and photos you choose, answering the questions you ask the assistant, producing the estimates and displays the app shows, delivering the posts and messages you send, sending information to device features you turn on, and using the location permission you grant, and the app asks you to agree to this when you begin keeping a child’s records, including when joining a shared profile; you cannot use the app until you accept. The assistant has its own agreement, as our Privacy Policy explains. Optional usage sharing, which is off until you turn it on, is the consent we rely on to collect usage information about health-related features. You may withdraw consent at any time. Use the relevant control to turn off an optional feature or usage sharing. To withdraw consent for family health records already held by Withya, contact us. We will confirm when your request is complete and explain any effect on the features that need those records. Removing an adult stops their future access, and hiding an entry removes it from view, but neither action by itself withdraws all processing or erases the underlying records. Where the law requires your consent to collect or share consumer health data for any other purpose, we ask for it before doing so.

9. Your rights and how to exercise them

You may: confirm whether we collect, share or sell your consumer health data and access it; correct it (you can edit entries in the app); receive a list of all third parties and affiliates with which we have shared it, with an email address or other online contact for each; have it deleted; withdraw consent to collection or sharing; and appeal our decision. A parent or legal guardian may exercise these rights for a child.

Email [email protected] with the subject “Health data request”, or use the account and profile controls in the app. We verify requests through the account’s email address and respond within 45 days, extendable once by a further 45 days where reasonably necessary; we will tell you if we extend. To appeal, reply with the subject “Health data appeal”; we will decide within 45 days and explain the outcome. If we deny your appeal, you may complain to the Washington Attorney General, the Nevada Attorney General or the Connecticut Attorney General, as applicable.

When you ask for deletion, we delete your consumer health data from our active records and instruct our processors to delete it, subject to exceptions the applicable law permits. We may keep specified records under a hold when the law, a legal claim or a safety matter requires it, which may delay their erasure; we review holds periodically and resume ordinary deletion when no hold applies. These holds do not create an exception to a statutory deletion duty. Copies our cloud provider may keep to check for misuse expire after a limited period, imported files and photos are kept for a limited period, and data in backups is deleted as the backups expire on a rolling basis, and we delete your consumer health data from archived systems within the time the law allows. We may keep de-identified information, such as a de-identified record that an account was closed, that no longer identifies you. Other adults linked to a child keep their own access to that child’s shared records, and copies they have exported, or that are held in services you connected, are outside our control. For Nevada residents, we delete within 30 days of authenticating your request and notify the recipients the law requires us to notify, who must delete within 30 days of our notice.

10. Changes and contact

We will post any material change here with a new date and version and notify you in the app or by email. Questions: [email protected], or by post to the address in section 1.