Health Data Policy
This policy explains how Nestly handles health information about your child and your family ("consumer health data"), including the rights of residents of Washington (My Health My Data Act), Nevada, Connecticut and other states with health-privacy laws. It adds to our Privacy Policy, which applies too. Questions or requests: privacy@nestlyrhythm.com.
1. Who We Are
Nestly is operated by FutureEdge Technologies LLC, a Texas limited liability company. Our Privacy Officer can be reached at privacy@nestlyrhythm.com.
2. Health Data We Collect
Only what you, your family members or the caregivers you invite choose to enter:
• Sleep, feeds (milk, solids and liquids), diapers and activity logs.
• Medications and doses, temperatures, symptoms, health and doctor notes, appointments and vaccinations.
• Growth measurements (weight, height, head circumference) and developmental milestones.
• Profile details with health meaning: date of birth, blood group and allergies.
• Information inferred from these logs, such as targets, predictions, sleep patterns and "on track" status.
We do not collect precise location, biometric or genetic data, and we do not buy health data from anyone.
3. Where It Comes From
Directly from you, from family members and caregivers you add to your household, and from Nestly's own calculations on those logs.
4. Why We Collect and Use It
• To show your logs, daily progress, targets, predictions, reminders and Day Plan.
• To let the people you invite see and add to your household's logs.
• To create the AI summaries you open (Privacy Policy, Section 17).
• To keep Nestly secure, fix problems and meet legal obligations.
We collect and use it only with your consent, which you give separately at sign-up, and only for these purposes. We never use it for advertising.
5. Who Receives It
• People you choose: family members and caregivers you invite to your household.
• Our service providers, only to run Nestly for you and under contract: Supabase (database and storage), Cloudflare (hosting, AI features and photo storage), Expo, Google Firebase and Apple (phone notification text), browser push services from Apple, Google, Mozilla and Microsoft (reminder text, if you turn on browser reminders), Resend (email text) and Sentry (crash reports, with sign-in details removed).
• When the law requires it, such as a valid court order.
We do not sell consumer health data, and we do not share it with anyone else for their own purposes. If that ever changed, we would ask for your separate, explicit consent first.
6. Your Rights
You can:
• Confirm and access: ask whether we hold your consumer health data and get a copy, and see it at any time in the app or export it from Settings → Data & privacy.
• Know who received it: ask for a list of the third parties and affiliates that received it, with their contact details.
• Withdraw consent: at any time; because Nestly can't work without storing care logs, withdrawing means deleting your account.
• Delete: delete individual entries in the app, or your whole account from Settings → Delete account. We delete it from live systems within 30 days, tell our service providers to delete it, and backups are overwritten within 90 days.
Email privacy@nestlyrhythm.com from your account's email address to make a request. We respond within 45 days (extendable once by 45 days where the law allows, with notice), free of charge, and we never treat you differently for using your rights.
7. Appeals
If we decline a request, reply with "Appeal" in the subject line within a reasonable time. We will answer within 45 days with our reasons. If you are still not satisfied, you can contact your state Attorney General (for example, the Washington State Office of the Attorney General).
8. Security
Consumer health data is encrypted in transit and at rest, limited to your household by database rules, and available to our staff only when needed to support you or keep Nestly secure. If a breach affects it, we will notify you and regulators as the law requires (Privacy Policy, Section 11).
9. Changes
We will tell you at least 14 days before a material change, and ask for consent again before using health data in a new way.