Privacy policy
The short version
- Your child’s records belong to you. Nothing is sold, there is no advertising, and there are no data brokers.
- Only the people you invite can see anything, at the level you choose and for as long as you choose.
- Health data has its own consent, separate from everything else, and you can delete it on its own.
- Photos are private, their location data is removed, and each view uses a link that expires within minutes.
- You can export everything, or delete everything. Deleting really deletes.
This policy describes what the software does. It is not legal advice, and it does not claim any certification.
Who we are
LumiBaby is a newborn care app for iOS and Android. In this policy, “we” means the people who run LumiBaby, and “you” means the parent or guardian who holds the account.
What we collect
Your account
Your email address, display name, preferred language and timezone. You can sign in with a six-digit code sent to your email, with an email and password, with Sign in with Apple, or with Google.
Your child’s profile
The child profiles you create.
Care records
What you choose to log: feeding, diapers, sleep, bath, growth, health, milestones, doctor visits and activities.
Photos
The photographs you add, and the PDF albums made from them.
Your consent history
Every consent decision you make, with the IP address and the device’s user agent at the moment you made it. We keep these as evidence of how and when your consent was given.
The access audit
A record of attempts by anyone other than you to reach your child’s data. More about this below.
How it is used
To run the app for you: to show your records back to you, to keep them in sync between your devices, to share them with the people you invite, and to send the emails the app needs, such as sign-in codes and invitations. Marketing messages are sent only if you have said yes to them.
Your consent
LumiBaby asks for four kinds of consent. Each one is versioned and timestamped.
- Terms: required to use the app.
- Privacy: required to use the app.
- Health data: required only to use the health features. It is deliberately separate from the privacy consent. Health data needs its own clear permission, and folding it into a general “I accept” would not be clear.
- Marketing: never required, and never a condition of using the app. If it were a condition, it would not be freely given.
Nothing is pre-ticked.
Your consent history is never rewritten. When you withdraw consent, the original record is not edited. A new record is added. So the history can always answer “what did I agree to, and when?”
Consent does not carry over to a new version of a policy. If we make a material change to how your child’s health data is handled, the app asks you to decide again, rather than relying on what you agreed to before.
Health screens fail closed. If the app can’t tell whether you have given health consent, for example because it can’t reach our servers, health data is hidden rather than shown.
Your rights
These are built into the app. They are not promises for later.
Export everything
You can download one file (JSON format) with everything we hold about you: your account profile, every child profile, all care records, a list of your media, your full consent history, the access log and the retention schedule.
Two things are left out on purpose:
- Your password hash. It is a credential, not information about you.
- The photo files themselves. Packing them in would make a file of several gigabytes that nobody could open. Instead, the export lists every photo with its own download link.
Each export is itself recorded in the access log.
See and delete health data on its own
Before you decide anything, the app can show you exactly what health data it holds. You can then delete it and keep your account.
Withdrawing health consent does the same deletion automatically. It touches only health data. Feeds, diapers, sleep, milestones and your child’s profile all stay. Withdrawing health consent means “stop holding this for me”, not “delete my child’s record”.
Delete your account
Deleting your account is a real delete. Records are removed and photos are deleted from storage. Nothing is merely marked as deleted, and no anonymous placeholder is left behind.
To confirm, you type your own email address. That works the same whether you use a password or sign in with Apple or Google.
Photos are deleted first, and records second, so a photo can never be left stored with nothing pointing to it. If some photos can’t be deleted from storage, the app tells you how many were left behind rather than claiming everything is gone.
Photographs
- Private. Photos are never publicly readable. Each time one is viewed, it is served through a link that expires within minutes.
- Location removed. Phone photos carry GPS coordinates, and a baby photo with them would show where that child lives. So every upload is re-encoded, and all embedded metadata is thrown away.
- Nothing in the name. Storage paths are random. They reveal nothing about you or your child.
The access audit
The audit records attempts by somebody who is not the account owner to reach a child’s data: requests that were refused, and exports and deletions.
It does not record you reading your own child’s records. You do that dozens of times a day, and logging it would bury the one event that matters.
Audit records outlive the account they describe. When an account is deleted, they are pseudonymised: the identifiers are removed, but the event is kept. An audit trail that the person it describes could delete would not be an audit trail.
How long we keep things
| What | How long |
|---|---|
| Care records | For the life of the account. Deleted immediately when the account is deleted. |
| Photographs | For the life of the account. Deleted from storage when the account is deleted, not merely unlinked. |
| Consent records | For the life of the account, then deleted with it. |
| Access audit | 24 months. Kept after account deletion in pseudonymised form, and removed automatically when the 24 months are up. |
| Backups | 30 days. If a backup from within that window is ever restored, your deletion request is applied to it again. |
Children’s data
The data in LumiBaby is about a child, and it is entered by that child’s parent or guardian. You, the account holder, control it. Nothing about your child is shared with anyone you have not explicitly invited.
Sharing
- Nothing is sold. There is no advertising, and no data brokers.
- Data is shared only with the people you invite, at the level you choose, and only for as long as you choose.
- An invitation reveals nothing about your child until it is accepted by the person it was sent to.
This website
lumibabycare.com sets no cookies, runs no analytics, and loads no third-party trackers, advertising pixels or session recording. It uses no external fonts or scripts.
The invitation page reads the code from its link inside your browser only. The code is not sent anywhere by the page.
Honest limits
- This policy describes what the software does. It is not legal advice, and it claims no certification.
- Account deletion is carried out immediately rather than queued, so a very large photo library may take a little time to delete.
Changes to this policy
When this policy changes, the date at the top changes too. If a change is material, the app will ask for your consent again. It will not assume that your earlier answer still applies.
Contact
Privacy requests and requests to access your data: privacy@lumibabycare.com
Everything else: support@lumibabycare.com