How Mom's Bloom Protects Your Pregnancy Data

Why Privacy Matters More in Maternal Health

Health data is classified as Your Money or Your Life (YMYL) content — the most sensitive category of personal information. But pregnancy data is in a league of its own. It's not just medical history; it's deeply intimate information about:

• Your reproductive health and fertility
• Pregnancy complications and medical conditions
• Your body's changes and intimate symptoms
• Your emotional state and mental health during pregnancy
• Your family planning and future intentions

This data, if mishandled, can be used for targeted advertising, sold to data brokers, leaked in breaches, or even weaponized for discrimination (e.g., employers learning about pregnancies before official disclosure).

At JSS AI Labs, we believe privacy is not a feature — it's a fundamental right. Mom's Bloom is built from the ground up with privacy-by-design architecture, ensuring your most sensitive health data stays protected, controlled, and yours.

Our Security Architecture

AES-256 Encryption at Rest and In Transit

Every piece of data you share with Mom's Bloom is encrypted using AES-256 encryption — the same standard used by governments and financial institutions for top-secret data:

• At Rest: All data stored in our databases is encrypted. Even if someone gained unauthorized access to our servers, your data would be unreadable without the encryption keys
• In Transit: All communications between your device and our servers use TLS 1.3, preventing interception or eavesdropping
• Key Management: Encryption keys are stored separately from data, rotated regularly, and managed through secure key management systems

Your pregnancy data is never stored in plaintext, making it resilient against both external attacks and internal misuse.

Role-Based Access Control (RBAC)

Not everyone at JSS AI Labs can access your data. We implement strict Role-Based Access Control:

• Minimal Access Principle: Engineers and employees only have access to data necessary for their specific role
• Audit Logs: Every access to patient data is logged and monitored for suspicious activity
• No Direct Access: Production data access requires multi-factor authentication and justification
• Automated Monitoring: Systems flag unusual access patterns for review

Your data is protected not just from external threats, but also from internal misuse.

PII Redaction Before Processing

When we use third-party AI models (like OpenAI or Anthropic) to generate responses, we first strip out personally identifiable information (PII):

• Real names are replaced with pseudonyms
• Specific locations are generalized
• Dates of birth are converted to age ranges
• Phone numbers and email addresses are removed

This ensures that even if third-party AI providers log requests (despite their policies against it), your specific identity remains protected.

Data Sovereignty — India-First

Your health data never leaves India. We use India-based servers and comply with local data residency requirements:

• All data is stored in Mumbai and Bangalore data centers
• No cross-border data transfers without explicit consent
• Compliance with India's Digital Personal Data Protection Act (DPDP)
• Subject to Indian jurisdiction and legal frameworks

This protects you from foreign surveillance laws and ensures your data is governed by Indian privacy standards.

What We Never Do

Here's our explicit commitment on what we never do with your data:

• Never Sell Data: We will never sell your personal health data to advertisers, data brokers, or any third party. Period.
• Never Train Public Models: Your conversations are not used to train shared AI models. Your data improves only YOUR experience.
• Never Share Without Consent: We don't share your data with partners, researchers, or other companies without your explicit, informed consent.
• Never Use for Advertising: We don't profile you for targeted ads or use your pregnancy data for marketing purposes.
• Never Provide to Employers/Insurers: We will never share your pregnancy data with employers, insurance companies, or background check services.

DPDP Compliance

India's Digital Personal Data Protection Act (DPDP) 2023 establishes strict requirements for handling personal data. Mom's Bloom is fully compliant:

• Purpose Limitation: We collect only the data necessary to provide you with personalized pregnancy support
• Consent-Based Processing: We process your data only with your explicit consent, which you can withdraw at any time
• Right to Access: You can request a copy of all data we have about you
• Right to Correction: You can update or correct any inaccurate information
• Right to Erasure: You can request complete deletion of your data (Right to be Forgotten)
• Data Portability: You can export your data in a machine-readable format to take it elsewhere
• Breach Notification: If a data breach occurs, we'll notify you and authorities within legally required timeframes

Compliance isn't just about following the law — it's about respecting your rights and building trust.

Your Rights and How to Exercise Them

You are in control of your data. Here's how to exercise your rights:

• Access Your Data: Email us at privacy@jssailabs.com with the subject "Data Access Request"
• Delete Your Data: You can request complete deletion of your account and all associated data from within the app settings or by emailing us
• Export Your Data: Request a machine-readable export of your pregnancy data to take to another service
• Withdraw Consent: You can withdraw consent for specific data processing activities at any time
• File a Complaint: If you believe your data rights have been violated, you can contact our Data Protection Officer or file a complaint with the Data Protection Board of India

We typically respond to privacy requests within 5 business days. For urgent security concerns, contact us immediately at security@jssailabs.com.

Transparency in Practice

Privacy policies are often long, dense documents that few people read. We're committed to transparency in plain language:

• Our full Privacy Policy is written in clear, accessible language
• Our Terms of Service explicitly state what we can and cannot do with your data
• We publish regular transparency reports about data requests, breaches, and compliance audits
• We maintain an open channel for privacy questions and concerns

If you have any questions about how we protect your data, we're here to answer them. Privacy is not a checkbox for us — it's a conversation.

Learn more about Mom's Bloom and our approach to building trustworthy AI at jssailabs.com/moms-bloom.