Consumer Health Data Privacy

Sheng Thanh, a sole trader established in France under the trading name KlaroBuild (SIRET: 100 904 606 00017), provides this separate consumer health data policy alongside our general privacy policy. It describes our handling of health data, including rights under Washington’s My Health My Data Act and Nevada’s consumer health data provisions where applicable.

Business address: 60 rue François 1er, 75008 Paris, France. Contact: contact@easymommy.fr. The app is intended for adults managing their own wellbeing and information about children they are authorized to care for.

Depending on features you use, we collect feeding, sleep, diaper, growth, medication and development records; food preferences and reactions; wellbeing and mood entries; related notes, tasks, photos, videos and voice text. Age, identifiers and household links connect these records to you or your child. Reminders, rhythm summaries and support signals may infer health or wellbeing information.

Any retained historical health records remain subject to access and deletion rights.

Sources include information you enter, authorized household members, your uploaded media, speech recognition on your device and calculations from those records. Usage analytics can reveal use of a health-related app. We do not collect precise location for health-related geofencing.

We use these records to provide the tracking, family coordination, reminders, optional AI features and wellbeing features you request. We process necessary security and support information to operate the service. We do not sell consumer health data or use it for targeted advertising.

The app records your explicit health-data choice. Online AI processing has a separate optional choice. Usage analytics and technical diagnostics have no separate activation prompt and are enabled after account preferences load, unless previously declined. You can request that they stop by contacting us. A sharing consent, where required, is separate from collection consent; the Safety Net and household invitation flows explain the sharing you initiate. A service exception applies only to processing necessary for a requested service. This notice does not itself provide consent or replace a separate sharing consent where required.

Authorized household members can access child records according to their role. Your personal mood journal is not available as a shared journal to household members; authorized service operations process it for requested features. If you enable the Safety Net, the selected trusted person can receive a support signal and see its type inside the app; this can reveal wellbeing information.

• Supabase hosts accounts, records, files and server processing.
• Anthropic processes text and relevant context, not audio, for optional online AI: baby dictation not understood locally, spoken tasks and meal plans. Request-specific aliases reduce known names and identifiers; free text may still identify someone.
• Apple or Google speech recognition uses your device permissions and may use their servers depending on the device and language. This is separate from Anthropic online AI processing. Google Calendar receives the task content you choose to synchronize when that integration is available.
• Expo, Apple and Google deliver device notifications. A Safety Net message can identify the sender, indicate a need for support, and include a child’s first name and consecutive short-night summary. Providers process that visible text, which may also appear on a lock screen. An opaque metadata reference does not anonymize the message.
• PostHog receives pseudonymous usage events with content and care-event types excluded. Sentry receives minimized technical errors for troubleshooting. Previously recorded refusals remain respected.
• Resend delivers account and invitation emails containing addresses, account links and, for invitations, inviter names and roles. Website hosting and support providers handle connection information and correspondence, which may include health information you send us.
• Apple, Google Play and RevenueCat process subscription information linked to your account; we do not send them your care records or personal journal.

Processing includes storage, synchronization, access control, automated summaries, optional remote AI and support handling. The provider list identifies the information disclosed for each purpose. KlaroBuild and easyMommy are the operator’s trading and product names, not separate recipients. We do not authorize independent advertising uses of your health records. Disclosures required by law are assessed separately and limited to the applicable requirement.

Open Profile → Privacy to review or withdraw optional choices. Withdrawing health consent stops new health entries and disables the Safety Net. It does not automatically erase existing records. You can delete your account in the app or request confirmation of processing, access, a copy, correction, withdrawal or deletion by emailing contact@easymommy.fr with “Consumer health data request”. You may request the recipient list and contact information available under applicable law. You can review and edit supported records in the app or email corrections. No new account is required to make a request.

We verify your identity proportionately and respond within applicable legal deadlines. Washington requests have a 45-day response period from receipt. Nevada requests generally have a 45-day response period after authentication. A permitted extension of up to 45 days is explained within the initial period. Nevada deletion requests have a separate 30-day deadline after authentication, with recipients required to delete within 30 days of notification. An authorized representative may contact us with evidence of authority. We do not unlawfully discriminate for exercising these rights.

If a request is denied, reply with “Privacy appeal” to request review. For Washington and Nevada, we respond to appeals within 45 days of receipt with reasons and the relevant regulator’s contact information if the denial stands. Washington residents may submit a complaint to the Washington Attorney General.

Active care records remain for your account history, subject to deletion rights and applicable legal duties. A free-plan viewing limit does not delete older records. Voice diagnostic logs exclude raw dictation and model output; their minimized metadata expires after 30 days. Account deletion removes private account records and initiates follow-up with relevant providers. Shared household records may remain for other authorized members, so an individual erasure request is reviewed separately. Sharing is not a blanket exemption from deletion rights.

We propagate valid health-data deletion requests to applicable recipients and processors. Where Washington law applies, health-data backup deletion must be completed within six months after authentication. Other provider retention periods and international processing are described in the general privacy policy; contact us for the settings applicable to your data. Isolated backups are not used for ordinary processing; deletion instructions must be reapplied before restored data returns to use. Any legal exception to deletion is assessed and explained in our response.

We do not install advertising trackers or authorize health-data collection across unrelated websites and services for advertising. PostHog links minimized actions within easyMommy over time to a pseudonymous account identifier. Sentry receives minimized technical errors. Neither receives journal or dictation content from those integrations. Providers can still receive network information. Your separately used Apple, Google or other provider services have their own privacy notices.

This version is dated September 16, 2026 and describes the updated app. We will notify affected users of material changes through the app or another appropriate channel before they take effect. Additional consent will be requested when required for new data categories, purposes or recipients; publishing a new policy alone is not consent.