Your privacy, in plain English
We built My Maternity Friend to support mums through pregnancy and to connect them with the health workers and clinicians who care for them — not to collect or profit from your data. This policy explains exactly what we collect, why, and what you can do about it. It applies to all user types: mums, health workers, and clinicians.
Contents
1. Who we are
My Maternity Friend is operated by Sallan Holdings Ltd, a company registered in England and Wales. When this policy says “we”, “us”, or “our”, we mean Sallan Holdings Ltd.
We are the data controller for the personal data you provide when using My Maternity Friend. That means we decide how and why your data is processed, and we are responsible for keeping it safe.
My Maternity Friend is available in multiple countries across Africa, Europe, Asia, the Americas, and Oceania. Wherever you are, this policy applies. Where your country has its own data protection law, we comply with that law in addition to UK GDPR — the relevant laws are listed in Section 3 and Section 8.
2. What we collect
We only collect data that is genuinely needed to provide the app and keep it running. Here is what that includes:
Account information
Your name and email address when you register. A phone number if you choose to add one (used for OTP sign-in and optional reminders).
Pregnancy and health information
Your pregnancy due date or last menstrual period (to calculate your gestational age), and your responses to health check-in questions within the app. This is special category health data and we treat it with the highest level of protection.
Location (country level only)
We detect your country from your IP address to apply the right legal protections, route your health data to the correct server, and show relevant emergency services information (for example, the correct emergency number for your country). We do not track your precise GPS location, and we do not store IP addresses after country detection has been completed.
Payment information
If you subscribe to a paid plan, payment is handled by Stripe (card payments, most countries) or PawaPay (mobile money, available in Zambia and Uganda). We never see or store your card number or mobile money credentials. We only receive a transaction reference to confirm your payment succeeded.
Health worker and clinician information
If you register as a health worker or clinician (for example, a midwife, nurse, or doctor), we collect your professional details in addition to your account information:
- Your name, role, and professional registration details (if provided)
- Your facility or clinic name and address
- Clinic contact details (phone and email)
- Opening hours and registered staff list for your facility
This business profile information is not health data — it is equivalent to a professional directory listing. It is shown to mums who accept your connection invite, so they know which clinic or professional is linked to their account.
As a health worker, you will have limited, role-appropriate visibility of health data belonging to mums who have explicitly accepted your connection. You act as a data processor for that mum's health data under the terms of our clinician agreement.
Technical information
Browser type, device type, and app version — collected automatically to keep the app working correctly and to investigate errors. We do not build profiles from this data or use it for advertising.
3. Why we collect it and our legal basis
Data protection law requires us to have a valid reason — a “legal basis” — for each type of data we process. The table below sets this out clearly.
| What we collect | Why | Legal basis |
|---|---|---|
| Name and email address | To create and manage your account, and to send transactional messages (e.g. sign-in codes, appointment reminders) | Contract / Consent |
| Phone number (optional) | For OTP sign-in and optional reminders if you choose to enable them | Consent |
| Pregnancy dates and due date | To personalise your weekly content, milestone tracking, and health check-in questions | Explicit consent (special category health data — UK GDPR Art 9(2)(a); EU GDPR Art 9(2)(a); Zambia DPA 2021; Uganda DPPA 2019; Kenya DPA 2019; POPIA; NDPR; and equivalent national laws) |
| Health check-in responses | To surface personalised wellbeing prompts, flag symptoms that may need attention, and give you a record of how you have felt throughout your pregnancy | Explicit consent (special category health data — as above) |
| Country / region (derived from IP address) | To apply the correct legal protections for your jurisdiction, route your data to the appropriate server, and show locally relevant emergency services information | Legitimate interests (legal compliance); Consent where required by local law |
| Device and session information (e.g. browser type, app version) | To keep the app running correctly, diagnose errors, and improve performance | Legitimate interests |
| Payment information | To process subscription payments. Card details are handled entirely by Stripe; mobile money details by PawaPay. We never see or store payment credentials — only a transaction reference | Contract |
| Health worker / clinician business profile (facility name, address, contact details, opening hours, staff list) | To build a verified clinic profile that is shown to mums when they accept a connection invite from that health worker | Contract / Legitimate interests |
| Health worker access to connected mum's health data | To enable clinicians to support mums in their care — for example, reviewing check-in responses, flagging concerns, or coordinating appointments. Access is limited to mums who have explicitly accepted the connection | Explicit consent of the mum (special category health data); Legitimate interests of the health worker as a professional carer |
A note on special category health data
Your pregnancy dates and health check-in responses are “special category” data because they relate to your health. We process this data only on the basis of your explicit consent. You give this consent when you create an account and agree to this policy. You can withdraw it at any time by deleting your account (see Your Rights below).
Applicable data protection laws by region
Health workers and clinicians — a note on access
When a mum accepts a connection request from a health worker or clinician in the app, she explicitly consents to that professional having role-appropriate access to her health data. This access is:
- Always initiated by the mum — she must accept the invite
- Limited in scope — clinicians see only data relevant to care, not a mum's full account
- Revocable at any time — mums can disconnect a health worker from their account settings
- Subject to the same data protection laws as all other processing listed above
Health workers and clinicians who access mum data through the app are acting as data processors for that mum's health data. They are bound by our clinician terms of service, which include data protection obligations consistent with applicable law.
5. Where your data is stored
We operate servers in multiple locations to comply with national data localisation laws and to reduce latency for users.
All users except Zambia — EU (Frankfurt, Germany)
Your health data is stored on Supabase infrastructure hosted in AWS eu-central-1 (Frankfurt). EU data protection standards apply. Your health data does not leave EU jurisdiction.
Zambian users — Zambia (on-premises)
In compliance with Zambia Data Protection Act 2021, Section 70 (data localisation requirement for health data), Zambian users' health data is stored on a self-hosted server physically located in Zambia. If the Zambia server is temporarily unavailable, data is held on EU servers until the Zambia server recovers, at which point it is synchronised back. A status notice will appear in the app if this fallback is active.
6. International data transfers
As a global app, data may pass through international infrastructure when you sign in or use the service (for example, through Stripe or Resend). Where data is transferred internationally, we ensure appropriate safeguards are in place:
- EU Standard Contractual Clauses (SCCs) are in place with all processors that receive data outside the EEA.
- Zambia DPA 2021 cross-border transfer provisions are complied with — health data is kept in Zambia except during the fallback scenario described in Section 5.
- Stripe is certified under the EU–US Data Privacy Framework and operates under SCCs for other international transfers.
- Resend and Infobip are GDPR-compliant processors operating under SCCs.
For users in countries with their own cross-border transfer rules (including Kenya, South Africa, Nigeria, and others listed in Section 3), we apply equivalent safeguards consistent with the applicable national law.
7. How long we keep your data
While your account is active
We retain your account data, pregnancy data, and health check-in history for as long as your account remains active. This lets you look back at your full pregnancy journey, export your data, or share records with a healthcare provider.
After you request deletion
When you request erasure of your account or your data, we will complete that deletion within 30 days — the standard deadline under UK GDPR, EU GDPR, Zambia DPA 2021, and most equivalent national laws. Some information (such as payment transaction records) may be retained for up to 7 years where required by UK tax or financial regulations — but this is limited to transaction records only, not health data.
Backups
Encrypted database backups are retained for up to 30 days as part of disaster recovery. After your deletion is processed, your data will also be purged from backups within this window.
8. Your rights
You have meaningful rights over your personal data under UK GDPR and the equivalent national data protection law that applies to you. We take these seriously and will always respond within the legally required timeframe (30 days for most requests).
Right to access
Ask us for a copy of all the personal data we hold about you. We will provide it in a readable format, free of charge, within 30 days.
Right to rectification
If any of your data is inaccurate or incomplete, ask us to correct it. You can also update most information yourself in your profile settings.
Right to erasure (right to be forgotten)
Ask us to delete your account and all associated data. We will complete this within 30 days. You can also do this yourself from the app settings.
Right to restrict processing
Ask us to pause how we use your data while a dispute is being resolved — for example, while you check whether data we hold is accurate.
Right to data portability
Request a machine-readable export of your personal data so you can take it elsewhere — for example, to share with your midwife or another health app.
Right to object
Object to processing based on legitimate interests. If you object, we will stop unless we can show a compelling legitimate reason that overrides your interests.
Right to withdraw consent
Because we rely on your consent for health data, you can withdraw that consent at any time by deleting your account. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
Right to lodge a complaint
You have the right to complain to your national data protection authority. We would always prefer you speak to us first — we will try to resolve it promptly.
Your national supervisory authority
10. Children
My Maternity Friend is designed for pregnant women and new mums, who are adults. The app is not intended for anyone under the age of 13, and we do not knowingly collect data from children.
If you believe a child under 13 has created an account, please contact us at privacy@mymaternityfriend.app and we will promptly delete the account and all associated data.
11. Changes to this policy
We may update this privacy policy from time to time — for example, if we launch in new countries, add new features, change our third-party providers, or need to reflect changes in data protection law.
When we make significant changes, we will notify you by email and show a notice in the app before the changes take effect. The date at the top of this policy will always reflect when it was last updated.
If you do not agree with the updated policy, you can delete your account at any time. Continuing to use the app after a change takes effect means you accept the updated policy.
12. Contact us
If you have any questions, concerns, or requests about your data, please get in touch. We aim to respond to all privacy enquiries within 5 working days and all formal Subject Access Requests within 30 days.
Privacy enquiries
privacy@mymaternityfriend.appData controller
Sallan Holdings Ltd
Registered in England and Wales
Supervisory authority (UK)
Information Commissioner's Office — ico.org.ukSupervisory authority (Zambia)
Data Protection Commissioner, Ministry of Transport and Communications
Supervisory authority (Uganda)
Personal Data Protection Office (PDPO)
Supervisory authority (Kenya)
Office of the Data Protection Commissioner (ODPC)
Supervisory authority (South Africa)
Information Regulator — inforegulator.org.za
All other countries
Contact your national data protection authority. We will cooperate fully.
This policy was last updated in April 2026. It applies to the My Maternity Friend PWA and any related services operated by Sallan Holdings Ltd. For questions about this policy, contact privacy@mymaternityfriend.app.