Withya Privacy Policy

Last updated: November 4, 2026 · Version 1.8

1. Who is responsible for your information

Withya is operated by STH Technologies, LLC, 9206 Sunshine Pl, Downey, CA 90240, United States (“Withya”, “we”, “us”). We are responsible for the personal information described in this policy and, where the law uses the term, we are its controller. For any privacy matter, write to [email protected] or to the postal address above. Our Privacy Officer, who is the person accountable for personal information under Canadian law and the person in charge of the protection of personal information under Quebec law, is reachable at that address, attention: Privacy Officer. We will publish the details of any appointed representative for the European Union or the United Kingdom here.

This policy covers the Withya app, the website at withya.app, our support channels and the community. The Terms and Conditions govern your use of the Service, and our Health, Safety and AI Notice explains what Withya’s features are for. If you live in a US state with a consumer health data law, our Consumer Health Data Privacy Policy also applies. The app shows this policy from the website, and the website version is the current one.

2. Information we collect

We may collect the categories of information below. The examples are illustrative, and what we hold depends on the features you use.

Category	Examples, such as	Sources	Main purposes
Identity and account	Name, email address, phone number, sign-in details (such as an email or text-message code, a passkey’s public key or a password), profile information from a sign-in provider you choose (such as Google, where available in the app), which may include your name, email address and an account identifier, account details, settings and preferences, records of the policies you accepted and when, and the choices you make in the app	You; sign-in providers you choose; our sign-in providers	Create, secure, recover and manage your account; keep records of your consents and choices
Child profile	The child’s name, birth date, gender, photo or avatar, growth details such as gestational age and the sex used for growth references, home area, a health provider’s contact details, and notes written for the assistant, such as allergies or routines	Adults on the child’s profile; your device’s location service, if you allow it	Organize the child’s records; calculate age; tailor guides, reminders, estimates and assistant answers to the child’s age and area
Care and health-related records	Feeding, nursing, pumping, sleep, diapers, temperatures, medicines, symptoms, food reactions, illness, growth measurements, appointments, plans, checklists, reminders and their outcomes, notes, answers you give to set up features such as estimates, your feedback on those features, and the history of changes to entries	Adults on the child’s profile; history imports; devices and features you connect	Store, sync, display and summarize the family’s records; provide the features you request
History imports	Files exported from other apps, photos of paper records such as handwritten logs, and the suggested entries we produce from them	You; our artificial-intelligence features	Turn earlier records into suggested entries for you to review (see section 5)
Journal and media	Photos, videos, captions, milestones, food introductions, dates and export requests	Adults on the child’s profile	Keep and present memories; produce exports you ask for
Assistant conversations	Your questions, the answers, sources, the details used to answer, usage, and reports you make about an answer	You; the child’s records; our systems	Generate answers; keep your history; apply limits; investigate problems and reports
Community	Display name (which may be your account name), chosen area and stages (which may include pregnancy), posts, replies, connections, messages, reports, blocks and moderation records	You; other members; our team	Show content to the intended audience; connect adults who opt in; deliver messages; review content; handle abuse
Purchases, offers and entitlements	Purchase and subscription records, status and dates, which child profiles are covered, storage add-ons, and offers or promotions you receive or redeem	App stores; our subscription provider	Verify purchases, restore access, manage billing and support
Messages and invitations we send	Sign-in and verification codes, invitations we send to the people you invite (which show your name, a link and when the invitation expires), offer codes, service and support emails, notifications, in-app inbox messages and records of their delivery	Our systems; our delivery providers	Deliver codes, invitations, notifications and messages; secure accounts; keep records
Device and network information	IP address, device, operating system, network and app details, app and device identifiers, notification tokens, language, time zone and accessibility settings, crash and diagnostic reports, and similar technical information	Your device; our subscription provider; our servers	Operate and secure the Service; deliver notifications; fix problems; analytics
Usage information	How you use the app and its features, including health-related features, such as screens viewed and options chosen, and app performance, linked to your account and, where relevant, the child profile in use, when you turn on optional usage sharing	Your device	Understand how the app is used; measure and improve features and performance
Approximate location	The general area, such as a country, region or city, that may be derived from your IP address	Our servers, from your device’s network connection	See the note on IP addresses below
Precise location	Your device’s location, when you grant permission, used to find a city, state and country	Your device, with your permission	Suggest the child’s home area for local guides and emergency numbers
Connected device features	Care details shown on widgets, watches and other device features you turn on, care you log through your device’s voice assistant or shortcuts, and appointments you copy to your device calendar	You; your device	Show and record care information where you choose
Age signals	An age category or age-range signal that an app store or your device’s operating system may provide to us	App stores; your device’s operating system	Meet legal duties (see section 13)
Support and legal records	Messages and attachments you send us, verification of requests, and records needed for disputes and compliance	You; our systems	Respond, verify authority, resolve problems, meet legal duties
Information about other people	Email addresses or phone numbers of adults you invite, a provider’s contact details, names of caregivers or others you mention, and information about other people in records you import	You	Extend access at your request; keep the records you choose
Inferences	Derived information such as the child’s age, care summaries, totals and insights, routine-planning estimates such as sleep timing, growth percentiles and charts, usage patterns and account status	Our systems, from the information you and other adults provide	Provide the features you request; measure and improve their accuracy, safety and performance

IP addresses. We may collect IP addresses when your device connects to our servers or website, and may derive an approximate location from them. We may use IP addresses and approximate location for security, fraud and abuse prevention, debugging, analytics, measuring and improving the Service, understanding the general region where the Service is used, and legal compliance. When optional usage sharing is on, your IP address is stored with the usage information we receive.

Photos and videos. We do not use facial recognition on your photos or videos.

Shared records can reveal information about adults as well as children, such as nursing records, a pregnancy stage or a caregiver’s identity. You are responsible for having the authority to enter information about a child or another person, and for getting another adult’s agreement before entering information about them.

3. How we use information and our lawful bases

We may use information to:

provide, maintain and personalize the features you and the other adults on a child’s profile choose, including tailoring guides, reminders, estimates and answers to a child’s age and area;
keep records in sync across the family’s devices, and import earlier records you choose to bring in;
provide our artificial-intelligence features, such as the assistant and history imports (see section 5);
verify paid access, and manage subscriptions;
send sign-in codes, invitations and the notifications you turn on, send service messages and, if you opt in, send news about features and offers;
respond to support requests;
secure the Service, prevent fraud and abuse, and find and fix problems;
understand how the app is used, and measure and improve the accuracy, safety and performance of our features;
develop new features and improve existing ones;
create de-identified and aggregated information;
meet legal duties, enforce our Terms, and establish, exercise or defend legal claims.

Measuring and improving our features. We may analyze information within the Withya service to check and improve our own features, for example how well history imports read paper records. Checking that a feature works, for example comparing sleep estimates with the sleep families later record, is part of providing and maintaining that feature. We do it within the Withya service, report aggregate results, and do not use it to train an artificial-intelligence model.

De-identified and aggregated information. We may create information that has been de-identified or aggregated so that it no longer identifies you or your child, and use it for purposes such as statistics, research, measuring and improving the Service and developing features. We keep it in de-identified form and do not attempt to re-identify it, except as the law allows to check that our methods work.

Where the law requires a lawful basis, we rely on: performance of our contract with you (providing the Service, billing, support and service messages); your consent (health-related information about you or your child, precise location, optional notifications, news and offers, community discovery, optional app usage sharing, optional crash reporting and website analytics), including explicit consent for health-related information where the law requires it; our legitimate interests (security, fraud and abuse prevention, reliability, measuring, improving and developing the Service, and defending claims), balanced against your interests and rights; and compliance with legal obligations. You may withdraw consent at any time by changing the relevant setting, deleting the information or contacting us. Withdrawal does not affect processing that took place before it. Removing a shared adult or hiding an entry does not by itself withdraw all health-data processing or erase the underlying records. To withdraw consent for family health records already held by Withya, contact support; we will confirm when a request is complete.

We do not sell personal information. We do not use personal information for targeted advertising, and we do not use information about a child for advertising. We do not use personal data to train large language models or other artificial-intelligence models. We do not make decisions about you by automated means that produce legal or similarly significant effects.

4. Cookies, local storage and your device choices

Where	Technology	What it does
Website	Google Analytics	Does not load until you choose Accept on the cookie notice. It then sets cookies to measure visits, and Google may collect information about your use of this site over time and across other sites that use its services. If you choose Decline, it does not load; if you later change your choice to Decline, we stop measurement and remove its cookies. Advertising features are turned off.
Website	Your cookie choice	Saved in your browser’s local storage until you clear it or change it through “Cookie choices” at the foot of each page. If your browser sends a Global Privacy Control signal, we treat it as Decline.
Website	Connection records	Our hosting and security provider records details such as IP address, browser type, pages requested and times to deliver and protect the site, and keeps them for a limited period under its own policies.
Website	Age tool	The date you type stays in the page address on your device. It is not sent to our servers, and we exclude it from what analytics receives.
App	Device storage	Sign-in state, settings and copies of your records are kept on your device so the app can work offline. Clearing app storage can lose changes that have not yet synced.
App	Identifiers	The app creates identifiers for your installation, for example to deliver notifications and connect devices.
App	Usage sharing	When optional usage sharing is on, usage information is kept on your device and sent to us from time to time, together with your IP address. Turning sharing off stops new optional collection.
App	Rating prompts	Kept on your device to limit how often the store’s rating prompt appears. We do not receive the rating you give.

We do not respond to browser Do Not Track signals, because there is no common standard for them. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Optional usage sharing is off by default. You may turn on “Help improve Withya” during signup or in Settings, and turn it off in Settings at any time without losing app features or paid access. The choice applies to the signed-in account on that device. Turning sharing off does not erase usage information we have already received; that follows section 8 and your rights in section 11. Records needed to operate and secure the Service, process purchases and carry out your requests are separate from optional usage sharing. We aim to keep notification text general, with the details shown when you open the app.

Optional crash reporting. Where available, you can turn on “Share crash reports” in Settings to help us fix app crashes. This is separate from usage sharing, is off until you choose it, and applies to your signed-in account on that device. It starts with future app sessions and stops when you sign out or turn it off. Our crash reporting provider receives technical details about the crash and your device, which may contain personal information. We do not add your account identity, child details, care entries, photos or videos to these reports. Reports may be saved on your device even while sharing is off. Turning sharing off requests that waiting reports be discarded; it cannot recall reports already sent.

Device features and services you turn on. If you turn them on, widgets, the lock screen, watch faces, watch tiles and other device features can show a child’s name and care details, such as recent feeds, sleep and totals. Some, such as watch faces, may show this whatever your phone’s lock settings. You can also copy upcoming appointments to a calendar on your device, which may sync to your calendar account; log care through your device’s voice assistant or shortcuts; and connect a watch, which uses your device maker’s services. Your device’s backups may include some app data, as your device settings decide. When you connect or turn on device features or services such as calendars, widgets, watches, voice assistants and device backups, the information you choose to send there is handled by those services under their own terms. You control location, camera, photos, calendar and notification permissions in your device settings. Uninstalling the app does not cancel a subscription or delete your account.

5. Artificial intelligence features

How we use artificial intelligence

We use artificial intelligence, including models developed by other companies, to provide and improve features such as the assistant, turning photos of paper records into suggested entries, and preparing some of our content. We access these models through our cloud account, and they run in our cloud provider’s data centers as part of the Withya service; a request may be processed in more than one data center in the United States, and section 7 describes where information is processed. Our cloud provider acts as our service provider, under contract and on our instructions. We do not give your family’s information to the companies that develop these models, and we do not use it to train artificial-intelligence models. Our providers are not permitted to use it to train their own models. Information used by our artificial-intelligence features stays within the Withya service and the service providers that run it for us, as described in this policy. Our cloud provider may keep a copy of a request for a limited period to check for misuse.

The assistant

The assistant is an artificial-intelligence system, not a person. Its answers are generated automatically and are not reviewed by a person before you see them. To answer a question, the model may receive your question, earlier messages in the same conversation, your country or region, relevant details from the child’s profile and records (such as age and birth date, home area, growth details, notes written for the assistant, recent care summaries and totals, temperatures, medicines, measurements and upcoming plans), excerpts from our guides, and anything else you type. Names and other identifying details can reach the model when they appear in questions, earlier messages, notes and other text that you or another adult entered. Some questions, such as possible emergencies, receive fixed safety text instead of a generated answer.

The app asks you to agree to the assistant before you can continue, and you cannot use the app until you accept. After that, you can turn the assistant off in Settings at any time; that choice applies to your account across devices and remains off until you change it. Turning it off stops the assistant. A request already sent for processing cannot be recalled. Turning it off does not erase earlier conversations or stop ordinary account and status requests. You can still delete conversations or contact support about erasure.

History imports

You can import earlier records from a file exported from another app, or from photos of paper records such as handwritten logs. Our systems read imported files to suggest entries. Photos of paper records are sent to an artificial-intelligence model, running as described above, to read the handwriting and suggest entries. A photo may include anything visible on the page, so photograph only the pages you mean to import. Suggested entries are shown for you to review, and you can correct or discard them before you add them to the child’s records. We keep imported files and photos for a limited period.

Who can see your conversations

Other adults on a child’s profile cannot see your assistant conversations. Authorized personnel may access conversations, reports and related records when needed to operate, support and secure the Service, investigate reports and problems, prevent abuse, measure and improve our features and comply with the law, as described in section 6. You can report an answer in the app, and we may review the report and the related conversation.

Keeping and deleting conversations

We store your questions and answers so you can revisit them. Deleting a conversation removes it from the app; copies may remain in our systems for a time, and are ordinarily erased when the child’s profile or your account is erased, subject to the retention and preservation exceptions in sections 8 and 9. You can contact support to request erasure separately.

Content prepared with artificial-intelligence tools

Some Withya content may be created or prepared with the help of artificial-intelligence tools. Our Health, Safety and AI Notice explains what our features and content are for and their limits.

6. Who receives information

Linked adults. Each adult linked to a child can view, add, change, delete and export that child’s shared records and can see who else is linked. The primary adult also manages billing, membership and profile deletion. Assistant conversations are not shared this way. Once another adult exports or copies information, removing their access does not recall it.

People you invite. When you invite an adult by email, we send them an invitation email that shows your name, a link and when the invitation expires. When you invite someone by phone, you send the invitation yourself through your device’s messaging or share options.

Community. Our team may review posts and replies, including before they appear. We may use automated tools to help detect or prioritize content for review, with people reviewing the decisions. If you turn discovery on, your display name, area and stages are shown to members who chose the same area and overlapping stages. Messages go to adults you have mutually connected with and are not screened before delivery. When content is reported, a copy is kept for review.

Our team. Authorized personnel, including employees and contractors working for us who are required to keep information confidential, may access information, including care records, journal content and assistant conversations, when needed to operate, support and secure the Service, investigate reports, prevent abuse, measure and improve our features and comply with the law. They may use internal reporting, analytics and administration tools to do so.

Service providers. We use providers that act on our instructions under contract, including hosting, storage and infrastructure providers; the cloud provider that runs the artificial-intelligence models we use; sign-in providers; email, text-message and notification delivery providers; our subscription provider, whose software runs in the app and receives account details, device and network information and purchase status; bot-protection and security providers; analytics providers (on the website, Google Analytics, after you accept); our crash reporting provider (our crash reporting provider, if you turn crash reporting on); the notification services of your device’s operating system; and our mailbox and support tools. When you use precise location, your device’s operating system may turn it into a place name under its provider’s terms. We will provide the identity of recipients on request where the law requires it.

Device features and services you turn on. Calendars, watches, voice assistants, device backups and similar services receive the information you choose to send them, under their own terms.

App stores. The Apple App Store and Google Play process your payment and subscription under their own terms and privacy policies and may pass age signals to us.

Recipients you choose. When you export a journal, share an invitation or send content through your device’s share sheet, the recipient holds it outside Withya and we cannot recall it.

Advisers, legal, safety and business transfers. We may disclose information to our lawyers, accountants and insurers; to comply with law, legal process or a lawful request from a public authority; to report suspected child sexual exploitation to the National Center for Missing & Exploited Children (NCMEC) or the authorities, as the law requires; to enforce our Terms; to protect the rights, safety or property of Withya, our users, a child or the public; and, in a merger, acquisition, financing or sale of assets, to the other party and its advisers under confidentiality, with notice to you where the law requires.

7. International transfers

We process information in the United States, and our providers may process it in the United States and other countries where they operate. Within the United States, information may be processed in more than one data center. Those countries may not offer the same protection as your own, and their courts and authorities may have access to it under local law. Where the law of your country requires a transfer mechanism, we rely on adequacy decisions where available; on standard contractual clauses or, for the United Kingdom, the International Data Transfer Agreement or the UK Addendum; and, in limited cases, on exceptions such as your explicit consent or the performance of our contract with you. You can ask us for a copy of the safeguards we use.

8. Retention

We keep information while your account or the child’s profile exists, or as long as needed for the purposes in this policy, and then delete or de-identify it.

Information you delete. Entries, posts, messages and conversations you delete are removed from view and ordinarily erased when the child’s profile or your account is erased, subject to the preservation exceptions below. Photos and videos you remove are deleted from storage over time, unless preservation is required.
Records kept for limited periods. Some records, such as server and security records, imported files and photos, estimates, support requests, billing notices and exports, are kept for limited periods for operations, security, backup and support. Backups on your own device follow your device settings.
Backups. Our backups and recovery copies expire on a rolling basis, so information deleted from our active systems may remain in them until they expire.
Safety and legal records. Records about reports, safety concerns, disputes and legal requests, including content preserved for a report, may be kept as long as needed for those purposes, including after an account is erased. We may keep information under a hold when the law, a legal claim or a safety matter requires it, and we review holds periodically. A hold can delay erasure, and ordinary deletion resumes when no hold applies.
If a subscription ends. We keep the records while the account and the child’s profile exist, and access may become read-only, with some features unavailable.
After erasure. We may keep limited records that no longer identify you directly, such as membership and purchase records and proof of which policy versions were accepted, for accounting, security, integrity, dispute-resolution and legal purposes. We may also keep a coded marker that an account was deleted, so that we can recognize an earlier deletion. Separately, if we restrict an account, we may keep a record of the restriction so we can honor it and prevent its evasion. You can ask support to review a restriction, for example if you think it applies to you by mistake.
Statistics. We may keep de-identified statistics, including a de-identified record that an account was closed and general information about why and when people leave, and we do not attempt to re-identify them.

9. How account and child deletion works

You can delete your account in the app or through the account deletion page. When you do, access pauses and a short recovery period begins; signing in again during that period cancels the request. After it ends, erasure can begin and cannot be undone. A preservation hold may delay some or all of the erasure, as section 8 explains. Completing account erasure ordinarily deletes the child profiles you own and your photos, videos, notes, imports, conversations, community content and usage information linked to your account. It also removes you from profiles owned by others: those profiles remain, and records you added to them may stay on the child’s profile for the other adults, or be removed or de-identified. We ask our sign-in and subscription providers to delete their records about you. Information in our backups is deleted as the backups expire on a rolling basis. We may keep a de-identified record that the account was closed, and section 8 describes what else remains. Questions about deletion can go to [email protected].

A child’s primary adult can delete that child’s profile. The profile is hidden for a short recovery period and is restored if the primary adult restores it during that period. Erasing a child’s profile ordinarily erases the assistant conversations about that child, subject to the preservation exceptions in section 8.

Deleting an entry in the app removes it from view, but the entry and its history are ordinarily kept until the child’s profile or your account is erased, subject to section 8, and a full export of a profile can include deleted entries and earlier versions of entries.

Deleting your account does not cancel a subscription. Cancel it separately in the Apple App Store or Google Play; the app shows the link for your store.

10. Security and incidents

We use reasonable administrative, technical and physical safeguards suited to the sensitivity of family information, such as encryption in transit, encryption at rest with our providers, access controls and monitoring. Information the app stores on your device is protected by your device’s security features and, for many records, additional encryption. Information you choose to show on widgets, watches or the lock screen, or that is included in your device’s backups, is protected by your device and its settings. We restrict access to authorized personnel, who may access information as described in section 6. We do not offer end-to-end encryption. No system is completely secure, and we cannot promise that unauthorized access, disclosure or loss will not happen.

We treat care and health-related records as health information under the FTC Health Breach Notification Rule, and we do not share them with advertisers. Under that rule, a breach of security can include an unauthorized disclosure, not only an intrusion. If a breach of security affects your information, we will notify you and, where required, the Federal Trade Commission, other regulators and the media, as the applicable law requires and within the time it sets.

11. Your rights and how to exercise them

Depending on where you live, you may have the right to:

confirm whether we process your information, access the information we hold about you and your child, and receive a copy;
correct inaccurate or incomplete information;
delete information, subject to the exceptions the law allows;
restrict or object to processing, including processing based on our legitimate interests;
receive information you provided in a portable format;
withdraw consent at any time;
opt out of sale, sharing, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects;
where the law provides, learn whether we use your information for profiling, question the result of profiling, receive an explanation of it and have it reviewed;
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
learn the categories of recipients of your information or, where the law provides, the specific third parties to which we have disclosed it; and
appeal a decision we make on a request.

We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use profiling to make decisions that produce legal or similarly significant effects. You can still make any of these requests.

You can do many of these yourself in the app: edit or delete entries, export a child’s journal, manage notifications, device permissions, usage sharing, crash reporting and discovery, use the account-level assistant choice where available, remove assistant conversations from view, and delete a profile or your account.

Global Privacy Control. On the website, if your browser sends a Global Privacy Control signal, we treat it as a request to opt out, and we do not load analytics. We do not sell personal information or share it for advertising in the app either, so the signal has nothing further to opt you out of there.

For anything else, email [email protected] with the subject “Privacy request”. We will verify your identity in proportion to the request, usually by confirming control of the account’s email address, and may ask for more where a request concerns a child or another adult. An authorized agent may act for you with written authority and verification of your identity, and a parent or legal guardian may act for a child. We respond within the time the applicable law sets, tell you of any permitted extension and its reason, and explain any refusal. To appeal, reply with the subject “Privacy appeal”; where possible, someone not involved in the original decision will consider it, and we will explain the outcome in writing and, where the law provides, how to contact your state’s Attorney General or other regulator. We will not discriminate against you for exercising a right. You may also complain to your privacy regulator, listed by region in section 12.

12. Region-specific notices

United States. State privacy laws give residents of several states rights to access, correct, delete and port personal information, to opt out of sale, targeted advertising and certain profiling, to learn about and question profiling where the law provides, and to appeal. Rights, response times and appeal routes differ by state, and we apply the law of your state of residence, as section 11 describes. Section 2 lists the categories of personal information we collect, their sources and purposes; section 6 lists the categories of recipients; section 8 describes retention. We use sensitive information (health-related records, precise location with permission and account credentials) only for the purposes described in this policy, and we ask for your consent to process it where the law requires. We do not sell personal information, including sensitive information and information about anyone under 18, or share it for cross-context behavioral advertising, and we do not use it for targeted advertising. Connecticut law asks us to say whether we collect, use or sell personal data to train large language models: we do not. To the extent Maryland law applies, we collect and process sensitive data, including health-related information, only where strictly necessary to provide or maintain a specific feature you request, and we do not sell sensitive data. To the extent California’s Confidentiality of Medical Information Act applies to information in the Service, including information in care records or shared with the assistant, we handle it as that law requires: we do not use or disclose medical information for marketing without your authorization, we disclose it as that law permits or as you authorize, and we require the service providers that process it for us to keep it confidential. On the website we treat a Global Privacy Control signal as an opt-out, as section 11 describes. We treat care records as health information under the FTC Health Breach Notification Rule, as described in section 10. If you live in Washington, Nevada or Connecticut, or your information is collected there, please read our Consumer Health Data Privacy Policy.

Canada, including Quebec. Our Privacy Officer is accountable for our compliance with PIPEDA and is the person in charge of the protection of personal information under Quebec’s private-sector privacy law, reachable at [email protected], attention: Privacy Officer. Your information is stored and processed outside Canada, in the United States and where our providers operate, and is subject to the laws of those countries, including access by their courts and authorities. We rely on your express consent for sensitive information, including health-related information and precise location, which we ask for in the app when you begin keeping a child’s records, and you may withdraw it at any time. Some features use technology that can identify, locate or profile a person: precise location (to suggest a home area), community discovery (by area and stage), optional usage sharing and crash reporting, and estimates and summaries produced from a child’s records. Precise location runs when you allow it, community discovery is off until you turn it on, usage sharing and crash reporting are off until you choose them, and estimates are produced from the records you choose to enter. You can manage precise location, community discovery, usage sharing and crash reporting through the relevant app or device settings. Estimates and summaries are derived from recorded information; contact us to request withdrawal of health-data processing as described in section 3. We do not use technology to profile you for advertising. You may access and correct your information as described in section 11. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

India. Health-related records and medical history are sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We collect them for the purposes in this policy with your consent, which we ask for in the app when you begin keeping a child’s records and which you may withdraw in writing; withdrawal may mean we cannot provide the related feature. You may review and correct your information. Your information is processed in the United States. Grievances go to our Grievance Officer, Shrey Pithwa, at [email protected], attention: Grievance Officer, or by post to the address in section 1; we resolve them within 1 month, or sooner where the intermediary rules require.

As the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 come into force, we will give the notices and provide the rights they require. These include obtaining the verifiable consent of a parent or lawful guardian before processing a child’s personal data, in the way the rules require; the rights to access, correct, complete and erase your information, to withdraw consent as easily as you gave it and to nominate another person to exercise your rights; and the right to complain to the Data Protection Board of India after using our grievance process. We do not direct advertising at children.

Australia. The kinds of personal information we collect and hold, and how, are set out in sections 2 and 4. We hold it in the United States and disclose it to overseas recipients in the United States and other countries where our providers operate. We take reasonable steps to ensure those recipients handle it consistently with the Australian Privacy Principles. You may ask to access and correct your information under section 11. If you believe we have breached the Australian Privacy Principles, complain to us first; we will acknowledge your complaint promptly and respond within a reasonable period. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner. If an eligible data breach occurs, we will notify you and the Commissioner as the Notifiable Data Breaches scheme requires.

Automated decisions. We do not use computer programs to make decisions about you that could reasonably be expected to significantly affect your rights or interests. For transparency, our computer programs use the records you and other adults enter about a child, such as birth date, sleep, feeding and measurements, to produce estimates such as sleep timing, totals, summaries and growth percentiles, and the assistant uses the kinds of information described in section 5 to generate answers. These outputs are information for you to consider. They do not decide anything about you or your child, and you choose what to do with them.

Children’s Online Privacy Code. When the Children’s Online Privacy Code takes effect, and to the extent it applies to the Service, we will handle children’s personal information as it requires. A parent or guardian, and where the code provides, the child, may ask us to delete a child’s personal information, using the profile and account controls in the app or by contacting us, and we will act on the request as the Privacy Act and the code require.

United Kingdom and European Economic Area. The controller is identified in section 1. Our lawful bases are set out in section 3; for health-related information we rely on your explicit consent under Article 9(2)(a) of the GDPR and UK GDPR, which we ask for in the app when you begin keeping a child’s records and which you may withdraw at any time. You have the rights of access, rectification, erasure, restriction, data portability and objection, including objection to processing based on legitimate interests, and the right to withdraw consent. We do not make decisions based solely on automated processing that produce legal or similarly significant effects. Transfers to the United States and onward to our providers are described in section 7. We will publish the details of any appointed representative here.

Complaints. If you have a concern about how we use your personal information, please complain to us first by email to [email protected] with the subject “Privacy complaint”. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. You may also complain to the Information Commissioner’s Office in the United Kingdom or to the supervisory authority of your EU member state.

13. Children

Withya is intended for adults aged 18 and older and is not directed to children. We do not knowingly collect personal information directly from children, including children under 13. Child profiles are created and managed by parents, guardians and other adults with authority, and information about a child comes from those adults, from records they import or connect, and from our processing of what they provide.

We do not sell information about children, use it for advertising, or use it to profile children for marketing. We use information about a child to provide the features the adults on the child’s profile choose and for the other purposes in section 3.

Adults on a child’s profile can review, correct, export and delete the child’s information using the controls in the app, and the child’s primary adult can delete the child’s profile, as section 9 describes. A parent or guardian may also ask us at [email protected] to access, correct or delete a child’s information, or to stop further collection, as section 11 describes; we may need to verify their authority.

If an app store or your device’s operating system provides an age category or age-range signal to us, we use it to meet our legal duties and keep it only as long as needed for that purpose. If we learn that we have collected personal information directly from a child under 13, we will delete it as the law requires.

14. Changes and contact

We will post any change to this policy here with a new date and version, and give you notice in the app or by email, or ask for fresh consent, where the change is material or the law requires it. Questions and requests: [email protected], or by post to the address in section 1.