Consumer health data

Clear choices for sensitive care information.

Effective September 20, 2026

Baby Brief is operated by Ryan Youngdale, a sole proprietor doing business as Baby Brief. This Consumer Health Data Privacy Policy explains how Baby Brief collects, uses, discloses, and protects consumer health data through the iOS app and private caregiver handoff website. It supplements the general Privacy Policy.

We make the practices and request methods described here available to Baby Brief users in the United States, although particular legal rights depend on where a person lives or where information is collected. Users must be at least 18 and authorized to provide a child’s information and make the choices they select.

Consumer health data we collect

Care Cards, drafts, notes, photographs, messages, and care updates may contain:

• health conditions, allergies, sensitivities, symptoms, illnesses, rashes, injuries, incidents, and other health observations;
• medications, doses, schedules, instructions, and administration records;
• temperature and other health-related measurements or observations;
• feeding, diet, sleep, diapering, toileting, mood, behavior, development, accessibility, and other details that may reveal physical or mental health or bodily functions;
• pediatrician, health-care provider, emergency-contact, appointment, treatment, and related care information;
• free-form instructions, notes, messages, photographs, and caregiver updates that may reveal health information; and
• identifiers and context connected with the information above, including a child’s name, photograph, birth date or age range, relationships, and care-event dates and times.

Baby Brief does not buy consumer health data from data brokers, use it for advertising profiles, or intentionally infer new diagnoses or health conditions from information entered into the Service.

Sources of consumer health data

We receive consumer health data from parents, guardians, and account holders; other authorized household members; invited caregivers who view a handoff, exchange messages, or record care updates; and records created when those people use care features. Information about a child or another person may therefore be provided by someone other than that individual. A person who provides health data must have authority to provide it and direct the uses and sharing they select.

Why we collect and use it

We collect and use consumer health data only as reasonably necessary to provide the Service requested by a user or for purposes disclosed when a separate permission is requested, including to:

• create, save, organize, and synchronize care profiles and instructions;
• help authorized household members coordinate a child’s care;
• create caregiver handoffs and display the information selected for a handoff;
• allow authorized users to exchange care updates and messages;
• maintain care history selected by the household;
• provide requested support and investigate errors;
• prevent fraud, abuse, and unauthorized access and protect the Service; and
• comply with law and valid legal process.

We will not collect, use, or disclose additional categories of consumer health data, or use existing data for a materially different purpose, without providing any additional disclosure and obtaining any permission required by law.

Who receives consumer health data

• Authorized household members. Household members may access shared care profiles, history, messages, and related household information.
• Invited caregivers. Caregivers may access the information selected for an active handoff. Anyone receiving a forwarded valid private link may be able to use it, so users must protect links and share them only with intended recipients.
• Supabase. Authentication, hosted databases, file storage, real-time synchronization, and server functions.
• Cloudflare. Website delivery, network security, DNS, and automated-abuse prevention.
• Apple. iOS device services and optional push-notification delivery. Notification previews may be visible before the app is opened.
• Telnyx and mobile carriers. Optional caregiver text-message delivery, including private handoff links. The alert choice is separate from health-data permissions.
• Legal and safety recipients. A person, authority, or service provider when reasonably necessary to comply with law or valid process; protect a person from an imminent threat; investigate fraud, abuse, or unauthorized access; enforce agreements; or protect rights and security.
• A successor in a business transaction. Information may transfer as part of a merger, acquisition, financing, reorganization, bankruptcy, or sale, subject to applicable law and continuing protections.

Baby Brief has no affiliates with which it shares consumer health data. We do not send care content to Mixpanel. A service provider’s processing may not constitute statutory “sharing” when it acts under a qualifying processor contract, but we identify these disclosures for transparency.

No sale or targeted advertising

Baby Brief does not sell consumer health data, exchange it for money or other valuable consideration, use it for targeted advertising, or allow service providers to use it for their own advertising.

Separate permissions

Where Baby Brief relies on permission, the request identifies the information involved, the purpose, the recipient categories, and how permission may be withdrawn. Permission to collect, store, and use care information is separate from standing permission to share selected information with caregivers. Each handoff still requires the sharing adult to choose the caregivers and details included.

Acceptance of the Terms, acknowledgment of the general Privacy Policy, optional analytics permission, and optional text-message permission are not consent to unrelated uses of consumer health data.

Revoke access, withdraw permission, or delete?

• Revoke one caregiver. Open a handoff’s Caregivers list. That caregiver’s links, open sessions, and text alerts stop. Other caregivers keep access. This does not delete household records.
• Withdraw caregiver-sharing permission. Settings → Health Data & Consent shows the affected caregiver access before confirmation. Withdrawal stops future sharing from that account and revokes the access shown for review. Collection permission and saved household records remain. Another authorized member with active sharing permission may later create a new share; revoked links are not silently restored.
• Delete all household care information. The authenticated Settings request deletes every child’s Care Card, photographs, caregivers, current and historical handoffs, snapshots, updates, events, messages, links, and access grants. Every household member loses the shared data. Accounts and household membership remain.
• Withdraw care-information permission and delete. This authenticated action withdraws the requesting member’s permission across all children and performs the same household-wide deletion. Care features remain locked until a parent or guardian reviews the current notice and makes a fresh choice.

These actions cannot recall copies independently saved outside Baby Brief or immediately erase an offline device. Withdrawal does not affect processing that occurred before withdrawal.

Consumer health data rights

Subject to applicable law, a consumer or authorized representative may ask us to confirm whether we collect, share, or sell consumer health data concerning the consumer; provide access; provide a list of relevant third parties and affiliates with available contact information; withdraw consent; or delete applicable consumer health data.

Use Settings → Health Data & Consent for standard household actions. For a request limited to one child, a request by someone without account access, an appeal, or other assistance, email privacy@getbabybrief.com with the subject “Consumer Health Data Request.” Do not include health details, identity documents, or private handoff links in the first email. You do not need to create an account solely to submit an email request.

We take commercially reasonable steps to authenticate the requester and any authority to act for another person. We respond without undue delay and, where Washington law applies, ordinarily within 45 days. When reasonably necessary, we may extend once by an additional 45 days and explain the extension during the initial period. Information is ordinarily provided free up to twice per year, subject to applicable exceptions.

For a valid deletion request, we delete applicable active records and notify relevant processors, contractors, and other recipients as required by law. Deletion from archived or backup systems may be delayed until restoration or scheduled deletion, but not more than six months after authentication where Washington law applies. Copies independently made by another user may remain outside our control.

Appeals

If we decline to act on a consumer health data request, email privacy@getbabybrief.com with the subject “Consumer Health Data Appeal.” Identify the earlier request and explain why the decision should be reconsidered. Where Washington law applies, we will respond in writing within 45 days. If the appeal is denied, a Washington consumer may contact the Washington Attorney General.

Security and retention

We use administrative, technical, and physical safeguards designed to protect consumer health data, including authenticated household access, restricted caregiver grants, encrypted transport, and provider controls. No security measure can guarantee against every loss, misuse, or unauthorized access.

Care records remain while the household maintains them or as otherwise needed for the disclosed purpose. Ending a handoff does not automatically erase its history. Limited information may remain when reasonably necessary to comply with law, prevent fraud or abuse, resolve disputes, enforce agreements, or document and complete a valid privacy request. Provider, log, and backup cleanup may finish at different times, subject to the six-month Washington limit described above.

Changes and contact

We may update this Policy when our practices or applicable law change. We will post the revised Policy, update its effective date, and provide additional notice or request additional permission when required. We will not use previously collected consumer health data for a materially different undisclosed purpose without first providing the required disclosure and obtaining any required permission.

For questions, requests, or appeals, email privacy@getbabybrief.com.