Privacy Policy (UK)

Introduction

Last modified: 3rd February 2026

This privacy notice describes how we will collect, use, share and otherwise process your personal data in connection with your use of:

• Infant Insight v1.0.1 (which was last updated on 3rd February 2026) ("App").
• Any of our services that are accessible through the App (Services), unless such Services state that a separate or additional privacy notice applies to a particular Service, in which case only that privacy notice applies.

This App is intended for use by parents and guardians to record information about their children's development. We will process special category personal data, including health-related information, about children in connection with your use of the App. We do not knowingly collect personal data directly from children under 13. If you are a parent or guardian using this App, you confirm that you have parental responsibility for any child whose data you provide to us and that you consent to our processing of such data in accordance with this privacy notice.

Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

Important information and who we are

Creatio Studio Ltd is the controller and is responsible for your personal data (Creatio Studio Ltd, we, us or our in this notice).

We have appointed a data privacy manager. If you have any questions about this privacy notice, please contact them using the details set out below.

Contact details

Our full details are:

• Full name of legal entity: Creatio Studio Ltd
• Name or title of data privacy manager: Rees Desai
• Email address: info@infantinsight.com

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues.

Changes to the privacy notice and your duty to inform us of changes

We keep our privacy notice under regular review.

This version was last updated on 3rd February 2026. It may change and, if it does, those changes will be posted on this page and notified to you by push notification. You may be required to read and acknowledge the changes to continue your use of the App or the Services.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

Third party links and sites

Our App or Services may contain links to third-party websites, plug-ins and applications. Please note that these websites (and any services accessible through them) are controlled by those third parties and are not covered by this privacy notice. You should review their own privacy notices to understand how they use your personal data before you submit any personal data to these websites or use these services.

Data we collect about you and data you upload about your child

We collect, use, store and transfer different kinds of personal data about you and your child. To make it easier for you to use this privacy notice, we group these into the following categories.

Data we collect about you

We collect the following categories of personal data about you:

• Identity Data
• Contact Data
• Profile Data
• Transaction Data
• Device Data
• Usage Data
• Security Data
• Marketing and Communications Data

Data you upload about your child

We allow you to upload the following categories of personal data about your child:

• Content Data (including health-related information about your child's development).

We collect special categories of personal data about you, specifically health-related information about your child's development that you upload to the App. We do not intentionally collect any other special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, and genetic and biometric data).

How is your personal data collected?

We collect your personal data in the following ways:

Registration

We collect your Identity Data and Contact Data when you register your account with us.

Communications

When you communicate with us via email, telephone, one of our online forms or chat we collect your Contact Data. If you contact us through the App using the chat function, we also collect Device Data to operate our chat function and respond to your messages. If the communication relates to an error or problem you are having with the App or one of our Services, we will also collect Usage Data for diagnosis and improvement.

Information you generate when using our App and Services

Each time you access and use our App and Services we collect Content, Device, and Usage Data. We collect Content Data where you upload it to the App, including but not limited to:

• Baby profile information (name, date of birth, photos)
• Sleep logs and patterns
• Feeding logs (breastfeeding, bottle feeding, pumping)
• Growth measurements (weight, height, head circumference)
• Diaper change records
• Medicine and medication logs
• Temperature readings
• Doctor visit records and notes
• Vaccination records
• Developmental milestone records with photos and videos
• Health-related symptoms and observations

We collect Device and Usage Data automatically through the App using Firebase Analytics and other analytics technologies. This includes your device's timezone and locale settings (which we use to display times correctly and determine appropriate pricing for subscriptions). We do not collect precise GPS location data. Please see our cookie notice for further details regarding our website.

Information we collect through monitoring the use of our App, Sites and Services

Each time you access and use our App and Services we collect information about that access and use, being Device, Content, and Usage Data. This includes:

• Screen views and navigation patterns
• Feature usage statistics
• Error logs and debugging information
• App performance metrics
• Time spent in the App
• Actions taken within the App (log creation, editing, deletion)

Direct Marketing

We collect and record Marketing and Communications Data when you request to change your direct marketing preferences or you interact with our direct marketing communications.

Information we receive from third parties

We will receive personal data about you from the third parties set out below:

• Device and Usage Data from analytics providers:
  • Google LLC (Firebase Analytics) based in the United States - provides analytics and performance tracking services
• Transaction Data from providers of technical and payment services:
  • RevenueCat, Inc. based in the United States - provides subscription management and payment processing services
• Identity and Contact Data from authentication providers:
  • Supabase Inc. based in the UK - provides authentication and database services

Cookies

We use Firebase Analytics in our mobile App to improve your experience and our development of the App and our Services. Firebase Analytics uses device identifiers (not cookies) to track usage patterns. For detailed information on cookies used on our website, see our cookie notice.

How we use your personal data

We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified below. Most commonly we will use your personal data in the following circumstances:

• Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by contacting us (see Your legal rights below).
• Performance of a contract. Where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter into a contract with you. Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
• Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.

Delivery and improvement of our App and purchases

Account management and profiling

Direct marketing

Troubleshooting, improvement and security

Rights and obligations

Analytics and personalisation

Other communications

Personal data sharing

Business contacts

Special categories of personal data

We process the following special categories of personal data about you.

Disclosures of your personal data

We may share your personal data with the following third parties:

External third parties

• Your Appstore Provider and mobile network operator to allow you to install the App.
• Service providers acting as processors who provide:
  • IT and system administration services, hosting services for our App and data storage (Supabase Inc. - UK)
  • Backend hosting and AI chat services (Microsoft Azure - UK)
  • Payment processing and subscription management (RevenueCat, Inc. - United States)
  • Analytics and performance tracking services (Google LLC - Firebase Analytics - United States)
  • Email delivery services (Resend, Inc. - United States)
• Your service providers that you have appointed and we need to contact to fulfil your requests, such as your banking or payment card provider to process your transactions.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
• HM Revenue and Customs, regulators, law enforcement, public authorities or other third parties acting as controllers based in the UK where necessary to exercise our rights or comply with a legal obligation.

International transfers

Most of our service providers are hosted within the UK, ensuring your personal data remains within the UK. However, we do transfer your personal data outside the UK to the following countries:

• United States - We transfer personal data to service providers based in the United States, including:
  • RevenueCat, Inc. (subscription management and payment processing)
  • Google LLC (Firebase Analytics - analytics and performance tracking services)
  • Resend, Inc. (email delivery services)

These transfers are made under appropriate safeguards, including:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office
• Adequate data protection measures implemented by our service providers
• Compliance with UK GDPR requirements for international data transfers

UK-hosted services: Our primary data processing services are hosted within the UK, including:

• Supabase Inc. (database, authentication, and storage services) - UK
• Microsoft Azure (backend hosting and AI chat services via Azure OpenAI) - UK

Data security

All information you provide to us is stored on secure servers. Any payment transactions carried out by us or our chosen third-party provider of payment processing services (RevenueCat, Inc.) will be encrypted using industry-standard encryption technology. Where we have given you (or where you have chosen) a password that enables you to access certain parts of our App or Services, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Once we have received your information, we will use strict procedures and security features to protect your personal data from loss, unauthorised use or access. This includes:

• Encryption of data in transit and at rest
• Regular security audits and assessments
• Access controls and authentication measures
• Secure backup and disaster recovery procedures

We have put in place procedures to detect and respond to personal data breaches and notify you and any applicable regulator when we are legally required to do so.

Data retention

Details of retention periods for different aspects of your personal data are available in our retention policy which you can request by contacting us.

In some circumstances you can ask us to delete your data: see Your legal rights below for further information.

Once we no longer have a legal right to hold your personal data, we will delete or, in some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

If you do not use the App for a period of 12 months then we will treat the account as expired and will delete your personal data.

Your legal rights

You have the following rights under data protection laws in relation to your personal data:

1. Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.

2. Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)

3. Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it. You also can ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with law. (In some cases, we may need to continue to retain some of your personal data where required by law. If these apply, we will notify you at the time of our response.)

4. Objection. Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.

5. Restriction. Request that we restrict or suspend our processing of your personal data:

   • if you want us to establish the data's accuracy;
   • where our use of the data is unlawful, but you do not want us to erase it;
   • where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or
   • you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

6. Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.

7. Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

8. Withdraw consent for processing your child's data. Withdraw your consent at any time for the processing of your child's special category personal data. Please note that this will affect our ability to provide the App's core functionality. We will advise you of the consequences at the time you withdraw your consent.

You can exercise any of these rights at any time by contacting us at info@infantinsight.com.

Description of categories of personal data

• Identity Data: first name, last name, title, date of birth and Profile Data.

• Contact Data: first name, last name, contact address, email address and telephone numbers, your communication preferences and copies of the communications between you and us.

• Profile Data: your email address, username and password, baby profile information (baby's name, date of birth, photos, adjusted birthdate if premature), caregiver access codes and permissions.

• Transaction Data: billing and delivery addresses, payment card details (processed securely through RevenueCat), history of your payments, purchases, subscription status, deliveries, returns and refunds and the applicable terms and conditions of your purchases.

• Device Data: the type of device you use, your unique device identifier, mobile network information, your mobile operating system, the type of mobile browser you use, IP address, time zone setting (used to display times correctly in your local timezone), device locale/country settings (used for subscription pricing and currency), device model and manufacturer, app version, and device language settings. We do not collect precise GPS location data.

• Content Data: information that you store or generate in the App, being photos, videos and associated metadata, developmental milestone records, health-related information about your child (including but not limited to sleep patterns, feeding records, growth measurements, diaper changes, medication logs, temperature readings, doctor visit notes, vaccination records, and health symptoms), check-ins, posts and messages sent through the AI chat function.

• Usage Data: logs and detail of your use of our Apps and Services, being the dates and times on which you download, access and update the App and our Services, any error or debugging information, the resources that you access, the actions we and you take in relation to them, screen views, feature usage, navigation patterns, and analytics data collected through Firebase Analytics.

• Security Data: information we collect about your use of the App, our Services and our Sites in order to ensure your and our other users' safety and security, being Usage Data, authentication logs, login attempts, and the information provided to us by our payment processing provider.

• Marketing and Communications Data: your direct marketing preferences, consents for receiving direct marketing from us and/or our third parties and the history of the direct marketing communications we have sent to you.