Health Data Processing Notice

This Notice applies to health-related and reproductive-health information processed in Mom's Bloom, including where such information is linked or reasonably linkable to you.

The categories below are presented as cards so the page is readable on mobile without horizontal table scrolling.

We process health data to:

• Provide pregnancy-tracking, journaling, reminders, and support features you request.
• Personalize educational content, weekly experiences, AI-assisted responses, summaries, memories, and insights.
• Maintain continuity across weeks, visits, check-ins, photos, and prior interactions.
• Support optional partner/family sharing experiences where the product logic and your settings permit it.
• Present safety or escalation language when certain urgent or potentially harmful patterns appear.
• Administer subscriptions, account state, fraud prevention, service security, diagnostics, support, and privacy requests.
• Maintain records of health-data consent, withdrawal, deletion, and other compliance actions.

We may receive or create health data from:

• You, when you enter profile details, logs, symptoms, check-ins, photos, chat prompts, support requests, or sharing choices.
• The mobile app, when it calculates gestational age, creates reminders, stores metadata, or generates summaries.
• Your mobile device, when notifications, camera/photo features, diagnostics, or app-runtime events are used.
• A linked partner or authorized recipient, where optional sharing features are enabled.
• Processors acting on our behalf, such as cloud backend, storage, AI, messaging, analytics, diagnostics, subscription, support, and app-store providers.

Mom's Bloom separates account/legal acceptance from health-data consent and other mobile permissions. Consent records may include Terms and Privacy Policy versions, health-data consent choices, withdrawal events, platform, app version, and timestamps.

Current repo-backed product state supports:

• Separate legal consent records for Terms and Privacy Policy versions.
• Separate health-data consent records with explicit acceptance and withdrawal events.
• Consent audit metadata such as platform, app version, and timestamp.

You may ask to withdraw health-data consent. Withdrawal generally affects future processing that relies on consent. It does not automatically delete all existing data, undo prior processing, cancel a subscription, delete app-store records, or remove records retained under another lawful basis.

Where health-data consent is active and the feature requires health context, Mom's Bloom may use health-related inputs together with profile and historical context to generate AI-assisted responses, summaries, memories, reflections, or insights. This may include processing by backend systems and AI providers acting on our behalf.

We may disclose health data only as needed:

• Processors and infrastructure providers acting on our behalf, including cloud backend/storage, AI processing, app integrity, push messaging, crash diagnostics, first-party analytics, subscription management, app stores, support tooling, and legal-page hosting where applicable.
• Your linked partner or authorized recipient through feature-specific sharing flows you enable or use, subject to the product's sharing boundaries.
• Apple App Store, Google Play, and RevenueCat for subscription and entitlement operations, not full clinical records.
• Legal, regulator, app-store, safety, or claims-related recipients where needed to comply with law, respond to valid legal process, support legal claims, or protect users or the public from harm where law permits or requires it.

We retain health data for as long as reasonably necessary to provide the requested service, maintain continuity, comply with law, protect the service, and support legitimate operational needs. If you schedule account deletion, health data remains in a suspended state during the 30-day grace period so the account can be restored before final purge.

Depending on where you live, you may have rights to:

• Know what health data we process.
• Access or obtain a copy of health data.
• Correct inaccurate health data.
• Delete health data.
• Withdraw consent.
• Restrict or object to certain processing where local law provides that right.
• Ask for a list of categories of third parties or affiliates with whom health data is shared, where applicable.
• Appeal denials where required by law.
• Contact a regulator, supervisory authority, or consumer-protection agency.

Counsel-required applicability note: U.S. state consumer-health privacy laws, including Washington My Health My Data Act-style requirements, may apply depending on user residency, entity status, data categories, exemptions, and launch operations. Counsel must finalize statutory wording and applicability.

Consumer health data categories are listed in Section 2. Purposes are listed in Section 3. Sources are listed in Section 4. Processor/service-provider and third-party recipient categories are listed in Section 8.

We request and process consumer health data to provide requested pregnancy and wellness app features, personalize the mobile experience, provide AI support, send reminders, enable optional sharing, manage subscriptions, maintain security, improve reliability, provide support, comply with law, and process privacy requests.

Consumer-health rights may include access, confirmation, deletion, consent withdrawal, a list of third-party/affiliate categories, appeal, and other rights provided by applicable law. Requests may be submitted to momsbloom@jssailabs.com.

We do not sell consumer health data. We do not use geofence targeting around healthcare or reproductive-health facilities. Any future proposal to sell consumer health data, or to engage in a use treated as sale, sharing, targeted advertising, or tracking under applicable law, would require counsel-approved disclosure and any legally required consent or authorization before that change begins.

Counsel-required applicability note: GDPR/UK GDPR applicability, controller details, lawful bases, Article 9/UK GDPR special-category conditions, representative/DPO needs, supervisory-authority information, international transfers, and DPIA requirements must be finalized by counsel.

Health, reproductive-health, and mental-wellness data is likely special-category data under GDPR/UK GDPR when linked to an identified or identifiable person. Mom's Bloom expects to rely on explicit consent for many health-personalized features unless counsel confirms another valid condition for a specific purpose.

Withdrawal of consent affects future consent-based processing and may limit or stop features, but it does not affect processing already performed before withdrawal or processing that continues under another lawful basis.

Mom's Bloom does not intend to make decisions producing legal or similarly significant effects solely by automated processing. AI-generated support and safety/escalation prompts must remain informational and not clinical determinations.

Counsel-required applicability note: India's Digital Personal Data Protection Act, 2023 and implementing rules/effective provisions must be confirmed by counsel.

Where applicable, health-related personal data should be processed with clear notice, purpose limitation, consent where required, withdrawal methods, grievance redressal, and reasonable security safeguards. Contact for privacy and grievance handling: momsbloom@jssailabs.com.

Mom's Bloom is adult-only. Any suspected child/minor data, consent-manager requirement, significant data fiduciary analysis, cross-border transfer issue, processor issue, or breach/rights response must be escalated for counsel review.

Because Mom's Bloom handles pregnancy and reproductive-health information, we apply a higher-sensitivity standard in drafting and operations. This includes:

• Separate health-data notice and consent structure.
• Narrower sharing commitments.
• Explicit no-sale, no-targeted-advertising, no-cross-app-tracking, and no-healthcare-geofence posture, subject to final verification.
• Safety escalation language for urgent conditions.
• Additional caution around photos, AI-derived insights, partner/family sharing, deletion, export, and consent withdrawal.

Privacy and support contact for health-data questions, withdrawal requests, and related privacy requests: