Mama Bloom
Consumer Health Data Privacy Policy
1. Purpose and scope of this document
This is a separate, standalone Consumer Health Data Privacy Policy published under the Washington My Health My Data Act. It is hosted at its own dedicated address (https://mamabloom.app/consumer-health-data) and is not part of, and is not merged into, the general Mama Bloom Privacy Policy. It addresses only consumer health data as that term is defined by MHMDA (RCW 19.373.010).
Nevada’s consumer health data privacy law (SB 370, codified in NRS chapter 603A) imposes closely parallel obligations. We extend the protections, consent model, and rights described in this policy to Nevada consumers, and handle their requests under the same process and timeframes.
This document describes:
- the categories of consumer health data that Mama Bloom collects;
- the sources from which that data is collected;
- the purposes for which it is collected and used;
- the categories of consumer health data that are shared, and the categories of third parties and affiliates with which it is shared (here: service providers/processors only — there is no sale or sharing for advertising);
- how a Washington consumer exercises their rights, the response timeframe, and the appeal path if a request is denied;
- a statement that Mama Bloom does not use any geofence around health-care facilities; and
- the consent model, including the separate opt-in consent to collect and the distinct consent to share.
In this document, “we,” “us,” and “our” mean Mama Bloom UG (haftungsbeschränkt). “You” means a Washington consumer.
2. Who we are
Mama Bloom UG (haftungsbeschränkt)HRB 47918, Amtsgericht Dresden
Oskarstr. 14, 01219 Dresden, Germany
Consumer health data contact (for the rights described in Section 8): privacy@mamabloom.app
Telephone: +49 152 5826 2078
We are the entity that determines the purposes and means of processing the consumer health data described here.
3. What “consumer health data” means
Under MHMDA, “consumer health data” is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. For Mama Bloom, this can include reproductive, pregnancy, postpartum, and mental-wellbeing information that you choose to log.
Mama Bloom is a wellness app. It is not a medical device and does not diagnose, treat, or provide medical advice. The fact that information is treated as “consumer health data” for the purposes of this policy does not change that the app is a wellness product.
4. Categories of consumer health data we collect
We collect only the consumer health data you choose to enter or authorize. Depending on which features you use, this may include:
- Pregnancy and stage information — pregnancy stage, due-date or week information, and related milestones you record.
- Cycle, fertility, and ovulation data — menstrual cycle dates, fertility window, ovulation, and basal body temperature entries you log.
- Mood and mental-wellbeing inputs — mood entries, journal text, and any self-assessment responses you complete in the app.
- Baby measurements — measurements and growth information you record for a baby.
- Body measurements you choose to enter — weight, and blood pressure if you enter it.
- Apple Health data you authorize — the specific Apple Health metrics you grant Mama Bloom permission to read (for example sleep, steps, resting heart rate, menstrual flow, body weight, and blood pressure). With your permission, Mama Bloom can also write certain entries you record in the app back to Apple Health (for example mood check-ins, weight, blood pressure, and mindful-session minutes). Mama Bloom reads and writes only the categories you authorize, and you can control these in Apple Health at any time.
- AI companion conversation content — the text of what you type to, or have transcribed and send to, the AI companion, to the extent it reflects your health status.
- Support references — references to support requests you submit (the message body itself is not retained on the device beyond your last interactions; see the general Privacy Policy for detail).
We do not collect precise location data to infer health status, and we do not derive consumer health data from your location.
5. Sources of the consumer health data
- Directly from you — the entries, logs, journal text, and AI-companion messages you provide in the app. This is the primary and overwhelming source.
- From your device, with your permission — Apple Health data that you explicitly authorize Mama Bloom to read, and on-device speech transcription provided by Apple when you dictate to the AI companion.
We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks, or third-party trackers. Mama Bloom contains no advertising SDK, no third-party analytics SDK, no advertising identifier (IDFA), and no App Tracking Transparency prompt.
6. Purposes for which we collect and use consumer health data
We collect and use consumer health data only to provide and operate the wellness features you choose to use, namely:
- to provide the pregnancy, postpartum, cycle/fertility, mood/journaling, baby-tracking, and meditation features and to show you your own entries and trends over time;
- to provide the AI companion, by sending the text of your message (together with your first name and country, for personalization) to our AI provider so it can generate a response;
- to deliver the reminders and notifications you enable; and
- to respond to your support requests and exercise of rights.
We do not use consumer health data for targeted advertising, for any sale, or to build advertising or marketing profiles.
7. Categories of consumer health data shared, and the third parties and affiliates with whom we share it
The only category of consumer health data we share is the content of your AI-companion messages — the text you type or dictate, to the extent it reflects your health status — and only with Anthropic, so it can generate a reply. The other providers listed below receive operational data (for example rate-limit counters and email addresses) and do not receive your logged health entries.
We do not sell consumer health data, and we do not share it for advertising, marketing, or with data brokers. We share consumer health data only with the service providers (processors) that we rely on to operate the app, each bound by a contract that limits them to processing on our instructions. The categories, and the specific providers, are:
- AI provider — Anthropic. When you use the AI companion, the transcribed text of what you type or say, together with your first name and country, is sent to Anthropic to generate a response. Audio is never sent. Anthropic retains this data for up to 30 days.
- Platform and on-device services — Apple. App Store distribution, platform services, and on-device speech transcription.
- Hosting and proxy — Vercel. Hosts the service layer through which AI requests are relayed.
- Operational data store — Upstash. Redis used for rate-limit counters, idempotency keys, App Attest challenges, and consented analytics aggregates; rate-limit identifiers are purged after 24 hours.
- Transactional email — Resend. Sends service emails (for example, account-related messages).
We have no affiliates with which we share consumer health data. Where these providers process data outside the United States, that processing is governed by appropriate contractual safeguards (including Standard Contractual Clauses where applicable).
8. Your rights and how to exercise them
If you are a Washington consumer, MHMDA gives you the following rights with respect to your consumer health data:
- Right to access / confirm. You may ask us to confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data, including a list of all third parties and affiliates with whom your consumer health data has been shared or sold, together with an active email address or other online mechanism you may use to contact each such recipient. Because the recipients are limited to the service providers named in Section 7, our response will provide each provider’s contact or privacy address.
- Right to withdraw consent. You may withdraw the consent you gave to the collection and/or the sharing of your consumer health data. Withdrawing consent is a separate and distinct action from deletion: you may withdraw consent without deleting your data, and you may delete your data without first withdrawing consent. Withdrawing consent stops further collection and/or sharing on a going-forward basis.
- Right to delete. You may ask us to delete your consumer health data. On a valid deletion request, we will delete your consumer health data from our active and archived or backup records, and we will notify all affiliates, processors, contractors, and other third parties with whom we have shared your consumer health data of your deletion request and direct them to delete it from their records as well, consistent with RCW 19.373.040(1)(c).
How to make a request. You can withdraw your consent to collect and/or to share at any time directly in the app: open Profile → Consumer Health Data (shown to Washington and other US residents), where separate toggles control collection and sharing (each takes effect immediately, going forward). You may also delete your account and export your data from within the app. For access or confirmation, deletion, or any request you prefer to send to us, email privacy@mamabloom.app. Exercising these rights does not require you to create a new account; you may submit a request by email whether or not you have an in-app account. We may take steps to verify that the request comes from you or your authorized agent before acting.
Response timeframe. We will respond to your request within forty-five (45) days of receipt. When reasonably necessary, we may extend this period by an additional forty-five (45) days, and we will tell you within the first 45-day period if we need the extension and why.
No charge / no retaliation. You may exercise these rights free of charge up to twice per year; for additional, excessive, or manifestly repetitive requests we may charge a reasonable fee or decline, as MHMDA permits. We will not deny you goods or services, charge a different price, or provide a different quality of service because you exercised a right.
9. Appeal path if we deny a request
If we decline to act on your request, we will tell you in writing, with the reason. You may appeal that decision by replying to our decision message or by writing to privacy@mamabloom.app with the word “Appeal” in the subject line. We will review the appeal and respond in writing, with the reason for our decision, within forty-five (45) days of receipt.
If your appeal is denied, you may contact the Washington State Attorney General’s Office to submit a complaint: Washington State Office of the Attorney General — File a Complaint.
10. No geofencing around health-care facilities
Mama Bloom does not establish, use, or operate any geofence around any health-care facility or any other location. We do not use a geofence to identify or track consumers, to collect consumer health data, or to send notifications, messages, or advertising related to a consumer’s health data or health-care services. The app does not collect precise location data for these purposes.
11. Our consent model: separate consent to collect and a distinct consent to share
Consistent with MHMDA, we operate two separate consent mechanisms, distinct from any consent obtained under other laws. Both consents are OFF by default: until you affirmatively turn the relevant consent on, we do not collect consumer health data beyond what is strictly necessary to provide the specific feature you have requested, and we do not share it.
- Opt-in consent to collect. Before we collect consumer health data beyond what is strictly necessary to provide the specific feature you have requested, we ask for your clear, affirmative opt-in. Consent is requested separately from any other terms, is not bundled with our general terms of service, and is not a condition of using unrelated parts of the app.
- A separate, distinct consent to share. Sharing consumer health data with the service providers in Section 7 (for example, sending your AI-companion message to Anthropic) is governed by a second, distinct opt-in that we request separately from the consent to collect. You can use the rest of the app without enabling features that require sharing.
You may withdraw either consent at any time, as described in Section 8. Withdrawal does not affect processing that already took place while consent was in force.
12. Changes to this policy
If we make a material change to this Consumer Health Data Privacy Policy, we will update the effective date above and, where the change affects how we collect or share consumer health data, seek any further consent required by MHMDA before that change applies to data we have already collected.
13. Contact
Mama Bloom UG (haftungsbeschränkt)privacy@mamabloom.app
+49 152 5826 2078
Oskarstr. 14, 01219 Dresden, Germany