Draft — this document is not in force until it is published.
Privacy Policy
Effective from TODO (YYYY-MM-DD).
Lalu is a shared baby-care diary. What you record in it about your child is health data, the most sensitive kind of personal data. This policy explains what we collect, why, who sees it, how long we keep it and what your rights are.
In short
- We do not sell your data. Your child's diary is shared only with the people in your family, with a parent removed from it, and with the providers who run Lalu for us.
- Nothing from your child's diary reaches advertisers. The web app and Premium have no ads. The free phone apps show non-personalised ads from Google.
- You can take your data with you, free of charge, also after Premium ends.
- You can delete it for good from the app.
Who we are is in section 1; your rights are in section 8.
1. Who we are
The controller of your personal data is NORBA Norbert Pabisz, ul. Wołyńska 5/59, 35-119 Rzeszów, Poland, NIP 6852212196, REGON 364769603 ("we").
- Privacy questions and requests: privacy@babylalu.com
- Help with the app: support@babylalu.com
We have not appointed a data protection officer. If you live in the United Kingdom, see section 9. If you live in the United States, see section 10 and our Consumer Health Data Privacy Policy.
2. What we collect and where it comes from
This policy covers you, if you use the app as a parent or caregiver; your child; a person whose breast-milk pumping is recorded; and anyone who happens to appear in a photo or voice note. Lalu is for adults, not for children to use.
You do not have to give us anything: without an account, the diary works and stays on your device. An account needs an e-mail address and a name, and adding a child needs your consent (section 4).
- Your account: name, e-mail address, password (stored so that it cannot be read back), settings, when you last used the app and, if you sign in with Google or Apple, their identifier for you and what we need to disconnect them when you delete your account.
- Your family: its name, its members, their roles and access dates, and the consents given: by whom, when and to which version of the text.
- Your child and the diary, which are health data: the child's name, date of birth and, if you add them, due date, sex, birth weight and a photo; feeds, sleep, diapers, pumping, medicines and their schedules, temperatures, your own events, notes, photos and voice notes; and who added or changed each entry and when.
- Premium: the family's plan, subscriptions and purchases, and whether you have used the free trial; never card details.
- Devices and security: your signed-in devices and their notification addresses, IP addresses and sign-in events.
- Error reports (what went wrong, on what kind of device; never the content of entries) and messages you send us, with our answers.
Data about your child, the person who pumps and anyone in a photo or voice note comes from the family members who record it. Google or Apple confirm who you are if you sign in with them, and payment providers and app stores tell us the state of a subscription. We never ask for your home address, phone number, ID number or contacts. Photos lose their location data on your device before they are saved. Apart from Google's ad tools in the free phone apps (section 6), we use no analytics or tracking tools.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the app: your account, syncing the diary, telling the family when its members change, notifications and e-mails, Premium and the free trial | our contract with you, art. 6(1)(b) |
| Keeping your child's diary | your explicit consent as the child's parent or guardian, art. 9(2)(a) and 6(1)(a) |
| Sharing the diary with people you invite | your separate explicit consent, given when you invite, art. 9(2)(a) and 6(1)(a) |
| Pumping data and sharing it with the family | the explicit consents of the person who pumps, art. 9(2)(a) and 6(1)(a) |
| Copies of a child's diary for the family's other parents after a consent is withdrawn, and for a parent removed from the family (sections 4 and 5) | under legal review: the basis will be named here before publication |
| Ads in the free version of the phone apps | in the EEA, the United Kingdom and Switzerland your consent in Google's consent form, art. 6(1)(a); elsewhere under legal review: the basis will be named here before publication |
| Answering requests about your data and giving you copies of it; recording security incidents; tax and accounting records | a legal obligation, art. 6(1)(c) |
| Handling complaints and disputes, and establishing or defending legal claims | a legal obligation, art. 6(1)(c), and our legitimate interest in defending our rights, art. 6(1)(f); for any health data in them, art. 9(2)(f) |
| Keeping accounts and your child's data safe, preventing abuse, fixing errors | our legitimate interest in protecting your data and in a working app, art. 6(1)(f) |
| Warning the owners of unused accounts, then deleting those accounts | our legitimate interest in not keeping data longer than needed, art. 6(1)(f) |
| People who happen to appear in a photo or voice note | our legitimate interest in keeping the family's record, art. 6(1)(f) |
| Answering your messages about the app | our contract with you, art. 6(1)(b); without an account, our legitimate interest in helping you, art. 6(1)(f) |
A legitimate interest is a reason of our own that we have weighed against your rights. You can object to it (section 8).
We do not need health details to help you, so please leave them out of messages to us. If a message includes them, we use them only to answer it: for a question about your diary, under the consent you gave to keep it; for a complaint or dispute, as described above. We keep them no longer than the message (section 7).
We make no decisions about you or your child by automated means. We do not use your data to train artificial intelligence.
4. Your consents
Your child's diary. Before you add a child, the app asks for your consent to the processing of the child's health data to keep the diary, and for your statement that you are the child's parent or authorised caregiver. If we change the text, the app asks again. You can withdraw the consent at any time from the child's profile. This deletes the child's profile and whole diary for everyone in the family and cannot be undone. The app first offers you a copy, and the family's other parents receive a link to a copy by e-mail.
Sharing with people you invite. Each invitation needs your separate consent, because the invited person sees every child's whole diary, including earlier entries and children added later, and can download it; a parent can also invite others. You withdraw this consent by cancelling the invitation or, once the person has joined, by removing them from the family, which you can do yourself. Any parent can also remove a caregiver or a viewer.
Pumping. The person who pumps gives two consents herself: to the processing of data about her pumping and to sharing it with the family. Without both, nobody can record pumping for her. She can withdraw them in the app's settings, or by writing to us if she is no longer in the family; all her pumping entries are then deleted.
Ads. In the EEA, the United Kingdom and Switzerland, the free phone apps ask for your consent in Google's consent form. You can change your choice in the app's settings.
Withdrawing a consent does not make earlier processing unlawful.
5. Who can see your diary, and how it is protected
Your family. The diary belongs to the family, not to one person. Everyone in it sees the children's whole history and who added or changed each entry, though access can be read-only or end on a set date.
- Every member is told, also by e-mail, when someone joins, is removed or loses access. These e-mails cannot be turned off, because they protect your child's data.
- Leaving the family does not delete the diary. It stays with the family, and your devices remove their copy as the Terms of Service describe. You can download a copy before you leave.
- A parent removed from the family receives by e-mail a link to a copy of what they could see, without other people's pumping data. Other removed members receive no copy.
Your devices. The diary is kept on your phone or computer, so it works offline and without an account. Keep your device locked: the app relies on its protection. Files you save from the app, such as the diary backup or a CSV export, are not encrypted, so store them as carefully as medical records. The app stores on your device only what it needs to work (the diary, your sign-in, your settings and its own files), so it needs no consent for this, and it uses no advertising or analytics cookies. In the free phone apps, Google's advertising tools also store data on the phone, with your consent where the law requires it. Signing out removes the diary from the device.
Notifications can name a medicine from your diary and can appear on your lock screen. Choose which ones you get in the app's settings, and what the lock screen shows in your device's settings.
Security. We use encrypted connections and backups, store passwords so that they cannot be read back, keep each family's data apart from every other family's, limit who can reach it, and keep health data out of logs and error reports. You can see and sign out every device on your account. If a breach puts your rights at risk, we report it to the data protection authority as the law requires and tell you directly when the risk to you is high. With a child's data, we assume by default that it is.
6. Who receives your data
Besides your family, only the recipients below receive data. Our service providers are bound by contract to act only on our instructions and to protect your data at least as well as this policy describes. Independent controllers (below the table) are bound by data protection law and by their terms with us or with you. We do not sell data and do not give it to data brokers or advertisers.
| Recipient | What they receive | Where |
|---|---|---|
| Hosting, storage and backup providers | account and diary data; backups are encrypted | EU |
| E-mail providers, for the e-mails we send and the mailbox you write to | your e-mail address and name, our e-mails to you (never diary entries) and your messages to us | EU |
| Error monitoring provider | error reports, without health data or the content of entries | stored in the EU; its support staff in the USA may access them |
| Stripe, for payments on the website | the buyer's e-mail address and language, and our identifiers for the family and the buyer; you enter card details with Stripe, never with us | EU and USA |
| A subscription service, for App Store and Google Play purchases | a random customer identifier and the purchase details; no name, e-mail address or diary data | USA |
| Apple and Google, as app stores and, if you choose it, for sign-in | your purchase, made with your store account; at sign-in, nothing about your child | under their terms |
| Google AdMob, for ads in the free phone apps | the phone's technical data, such as its IP address (which shows roughly where it is), model, system and identifiers (on older Android phones, also its advertising identifier), which app shows the ad, and how ads are shown or tapped. Nothing from the diary. We request only non-personalised ads | EU and USA |
| The notification service of your phone or browser (such as Apple, Google, Mozilla or Microsoft) | your device's notification address and a signal with no diary content | may be outside the EEA |
| An accountant or lawyer, if we engage one | what they need for our tax records or to help us meet our legal duties | EU |
Apple and Google as app stores and for sign-in, Google AdMob, and Stripe for its own legal duties such as preventing fraud decide for themselves how they use what they receive, under their own privacy policies (the law calls them independent controllers).
Transfers outside the European Economic Area. The diary stays in the EU. Where a recipient may process data outside the EEA, it does so under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses; for the notification services of phones and browsers, the safeguard is under legal review and will be named here before publication. Write to us for the name of any provider or a copy of the safeguards.
We disclose data to authorities only when the law requires it, and only as far as it requires.
7. How long we keep it
| Data | How long |
|---|---|
| Your account | until you delete it, or until we delete it after long disuse (below). A device's record ends sooner: when you sign the device out, or some time after it stops being used |
| The diary, the family and its consents | as long as the family keeps them |
| Deleted entries and children | an entry: erased for good after 90 days; a child: can be restored for 7 days, then erased |
| After a consent is withdrawn | the child's profile and diary: erased within 24 hours; pumping data: erased at once |
| Copies | a CSV export you request: 24 hours; a copy we send by e-mail (after an account deletion, a parent's removal or a consent withdrawal): 30 days |
| Premium: the family's plan, subscriptions and purchases | as long as the family exists |
| Payment and invoice records | as long as tax law requires (in Poland, generally 5 years from the end of the year in which the tax fell due; 10 years for EU VAT one-stop-shop sales) |
| Technical records (logs, error reports, sync records, messages from payment providers) | up to 90 days; some service logs are capped by size instead and overwritten |
| Security records (sign-ins and sign-outs, with IP addresses) | 12 months |
| Your requests about your data, and our answers | 3 years after the matter is closed |
| Your messages about the app, and our answers | 12 months after the matter is closed |
| Complaints, withdrawals from the contract and disputes, with the messages about them | until the related claims expire |
| Backups | deleted data leaves them within 60 days |
Unused accounts. After 36 months without use, we e-mail the owner the date the account will be deleted, normally once 48 months have passed, and remind them shortly before. Signing in cancels the deletion; otherwise the account is deleted as if its owner had deleted it, but without the e-mailed copy. We keep an account that still pays for a subscription, or that owns a family others still use when nobody else can take it over.
Copies on your devices stay until you sign out, leave the family or remove the app. We cannot erase a device that never goes online again.
8. Your rights
You have the right to:
- see your data and get a copy, also in a portable form: use the CSV export in the app's settings, free, also after Premium ends. Photos and voice notes are in the diary backup you can save on your device; we send any that are missing on request;
- have it corrected: edit an entry, a child's profile or your account;
- have it erased: delete an entry, a child or your account;
- restrict how we use it;
- object to uses based on our legitimate interest (below);
- withdraw any consent at any time (section 4).
Your child, the person who pumps and anyone in a photo or voice note have the same rights; they can write to privacy@babylalu.com.
Right to object. Where we rely on our legitimate interest (section 3), you can object at any time on grounds relating to your particular situation. Write to privacy@babylalu.com, and we will stop processing your data for that purpose unless we have compelling legitimate grounds that override your interests.
Deleting your account erases a family only you use, with its whole diary. In a shared family, your name and e-mail address are removed, your entries stay without your name, your pumping data is erased, and another parent takes over a family you own (see the Terms of Service). We first e-mail you a link to a copy of the diaries you could see.
Writing to us. For anything the app does not do, write to privacy@babylalu.com. We answer within one month; for complex requests we may take up to two months more and will tell you why. We may ask you to confirm a request from your account's e-mail address. Using your rights is free.
Complaints. You can complain to a data protection authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or the authority of the country where you live or work. We would be glad to hear from you first.
When your child grows up, they can ask us to delete the data a parent recorded about them by writing to privacy@babylalu.com.
9. If you live in the United Kingdom
The UK GDPR and the Data Protection Act 2018 apply to you. This policy applies in the same way, with these additions:
- Our UK representative under article 27 of the UK GDPR is TODO - name and UK address of the representative under UK GDPR art. 27, before 1.0 (F8-16) - the web app serves UK users from the first day (D-84). You can contact them instead of us about anything in this policy.
- Your data is kept in the European Union, which the UK recognises as providing adequate protection. Where a recipient in section 6 processes your data elsewhere, the safeguards named there apply in their UK form, such as the UK Extension to the EU–US Data Privacy Framework or the UK Addendum to the standard contractual clauses.
- You can complain to us at privacy@babylalu.com (we acknowledge every complaint within 30 days) and to the Information Commission, the UK regulator that replaced the Information Commissioner's Office (ico.org.uk).
10. If you live in the United States
- Our Consumer Health Data Privacy Policy explains how we handle consumer health data under the laws of Washington, Nevada and Connecticut and how to use your rights there, including how to appeal a decision.
- We do not sell personal data, including consumer health data, and do not use it for targeted advertising or for automated decisions about you, so there is nothing to opt out of. You may still write to us.
- Depending on your state, you may have the right to know what we hold, to get a copy, to correct and delete it, and to withdraw consent. Use the app (section 8) or write to privacy@babylalu.com. We act within 30 days; the law allows up to 45. To appeal a refusal, reply to our answer or write to privacy@babylalu.com with "Appeal" in the subject. We decide within 45 days (60 days in Connecticut) and, if we still refuse, tell you how to contact your state's Attorney General.
- Apart from Google, which receives the technical data described in section 6 to show the ads in the free phone apps (we request only ads that are not tailored to you), no other party collects personal information about your use of Lalu over time and across other websites or apps. Because we do not track you, a browser's "Do Not Track" signal changes nothing.
- We do not knowingly collect personal information from children under 13. Information about your child comes from you, the parent or caregiver.
11. Changes to this policy
We update this policy when the app or the law changes, and show the date above. We tell you about important changes in the app or by e-mail before they take effect. If a change concerns what you consented to, we ask for your consent again; we never treat continued use as agreement. Earlier versions are available on request.
See also our Terms of Service, which explain, among other things, that Lalu is not a medical device. Polityka prywatności po polsku.