1. Data Controller and Scope
This Privacy Policy explains how personal data is processed in the HeyMom mobile application, the myheymom.com website and related services (together the "App") under the EU/UK General Data Protection Regulation ("GDPR"), Turkey's Law No. 6698 ("KVKK"), the California Consumer Privacy Act as amended by the CPRA ("CCPA"), Canada's PIPEDA and Quebec Law 25, Australia's Privacy Act 1988 and the Australian Privacy Principles ("APPs"), New Zealand's Privacy Act 2020 and other applicable laws. Where these differ, we apply the standard most protective of you.
- Data controller (and accountable organisation under PIPEDA and the APPs): Ersa Zirai Tarım Ltd. Şti. ("HeyMom", "we")
- Address: Yalı Mah. Hamit Nural Cad. No: 7A, Erdek/Balıkesir
- Trade registry (MERSIS) no: [MERSIS]
- Privacy contact: destek@heymomtr.com
- Web: myheymom.com
This is a notice. Processing of your health data, and its transfer abroad for AI features, is based separately on the explicit consent we request in the App (Section 3).
2. Personal Data We Process
We only process data you enter or that is generated while the service runs:
A) Account and Profile
- Email, name, age, city (optional), country and time zone (from device settings)
- Name and email shared by Apple or Google when you sign in with them
- Profile photo (optional; stored on our servers) or avatar, forum username, bio, follow list
- Role (mother / father / partner), mode (pregnancy, newborn, period tracking, pregnancy planning), multiple pregnancy info, onboarding answers
- If you use the App without an account, an anonymous user ID tied to the device; if you register, it is linked to your account
B) Health and Tracking Data (special category / sensitive)
- Pregnancy: last period / due date, pregnancy week, weight, blood pressure, water, vitamins/medication, appointments, cravings, kicks, contractions, birth plan, postpartum records
- Doctor Journal: report notes, attachments and photos
- Newborn: baby's name, birth date, sex, feeding, sleep, diapers, growth, fever, vaccinations, solid foods, "memorable firsts"
- Period and planning: cycle calendar, basal body temperature, ovulation/LH tests, breast self-exam records
- Breathing and Kegel sessions, mood logs and previously entered EPDS screening records
- Exercise program readiness answers and session logs (kept only on your device)
- Notes and the first letter to your baby
You enter your baby's data as their parent and confirm you are entitled to do so.
C) AI Data
- Questions you ask the AI assistant and chat history
- Images you upload for analysis (lab results, baby stool, ultrasound, baby/parent faces)
- On Premium, lasting health notes extracted from your chats (AI memory, e.g. allergies)
- AI credit and usage counters
D) Family and Partner
- Family link and invite code, in-family messages, reminders, notes, name votes, needs list and partner activity
- Tracking data shared with your partner according to your sharing preferences
E) Community (Forum)
- Posts, comments, images, likes, follows, blocks and reports
F) Entertainment, Raffles and Games
- Data and images entered in entertainment modules (horoscope, Chinese calendar, Rh prediction, celebrity match, baby face, ultrasound commentary)
- Guess pool: your name, your baby's name and due date in a pool you create; the names and guesses entered by people who join via the link, and their IP address to prevent abuse
- Raffles: entries, referral codes, completed tasks, draw results
- If you win a raffle, for delivery: full name, phone, city, district, street address, postal code and delivery note
- Daily wheel results, badges and points
G) Purchases and Campaigns
- Subscription status, trial and renewal info, purchase records (RevenueCat, App Store, Google Play); we never see your card details
- Promo and influencer referral code use, and whether you left checkout before completing it
H) Device, Usage and Advertising Data
- Platform, device model, language, app version, push token
- In-app events, screen views, search queries, error logs
- IP address (for abuse and rate-limit control)
- Advertising and attribution IDs: Android advertising ID, IDFA on iOS if you allow tracking, Meta and AppsFlyer device IDs, campaign information
I) Support and Feedback
- What you write in support, feedback and cancellation forms, your optional email and technical context
3. Purposes and Legal Bases
- Account creation, authentication, tracking tools and family sharing: performance of contract (GDPR Art. 6(1)(b))
- Processing of health and tracking data: your explicit consent (GDPR Art. 9(2)(a); APP 3; Quebec Law 25)
- Generating AI responses and transferring data abroad for that purpose: your explicit consent (GDPR Art. 9(2)(a) and Art. 49)
- Subscriptions, purchases, refunds and invoicing: performance of contract and legal obligation
- Raffle participation and prize delivery: performance of contract and legal obligation
- Security, fraud and abuse prevention, forum moderation, bug fixing, statistics: legitimate interests (Art. 6(1)(f))
- Campaign measurement and ad attribution: legitimate interests; your permission for iOS tracking and, in the EEA/UK, for personalised ads
- Offer and campaign notifications: your notification permission; you can turn them off in Settings
- Establishing and defending legal claims: legitimate interests
We ask for explicit consent at first setup with two separate checkboxes. You can withdraw it at any time in Profile > Privacy & Security. Withdrawal does not affect earlier processing, but health tracking and AI features cannot work without it.
We do not use your health data for ad targeting, we do not send it to ad networks and we do not sell it. Under the CCPA we do not sell your personal information and we do not use sensitive personal information to infer characteristics about you.
4. AI Processing
The AI assistant and image analyses run on Claude models provided by Anthropic (USA), accessed through Firebase Cloud Functions.
- Data sent: your question, uploaded image, mode and pregnancy/baby week, relevant tracking summaries (e.g. weight, blood pressure, sleep), mood context, and on Premium the notes in AI memory
- To personalise answers we may also send your first name, age, city if entered, and your baby's name and sex
- Email, phone, national ID, address and payment data are not sent
- Anthropic commits not to use API data for model training; under its own policy it may retain data for a limited time for safety review
- Your chat history is stored on our servers, linked to your account, for syncing across devices and weekly summaries, and is deleted with your account
- Weekly summaries may be shown to your partner according to your sharing preferences
- Diagnosis, prescription and medication dose requests are automatically limited and a medical disclaimer is added to answers
- Our team does not routinely read your chats. Limited access may occur only where security, abuse or a support request you start requires it
- To improve the product, feedback and cancellation texts, store reviews and in-app search queries may be summarised in aggregate with AI after removing email and user ID
5. Image Analysis and Content Moderation
- Images you upload for lab, stool, ultrasound, baby face and parent face analysis are sent to Anthropic over HTTPS and are not permanently stored in our database for the analysis
- Report and ultrasound photos you add to Doctor Journal are stored in Firebase Storage, linked to your account
- Profile photos and forum images are automatically scanned with Google Cloud Vision (SafeSearch) to filter inappropriate content
- Images containing faces are not used for biometric identification or verification; no face templates are extracted or stored
- If you upload someone else's face or document, you must have their permission
Image analysis results are not medical diagnoses; entertainment features have no scientific validity.
6. Family and Partner Sharing
- A family link is created when the other party accepts an invite code you generate
- Once linked, most of your tracking data is shared with your partner by default: appointments, kicks, weight, blood pressure, medication/vitamins, water, doctor reports, baby notes, contractions, cravings, the weekly AI summary, birth plan, postpartum and newborn records
- Basal body temperature, ovulation tests, breast self-exam, Kegel and breathing sessions are not shared by default
- You can turn each item on or off in "Sharing Preferences"; your partner may get notifications as you log data
- Shared data may appear on your partner's phone, widgets and Apple Watch
- If the mother's account is Premium, the partner also gets ad-free use and AI access
- Either party can remove the link at any time; shared family records are then deleted
You decide who to share with. Share the invite code only with someone you trust.
7. Community, Guess Pool and Public Content
- Forum posts, comments, images, username, profile photo and bio can be seen by other users
- Forum posts and comments may be published on myheymom.com under the name "HeyMom Annesi" with the author's name and photo removed, and may appear in search engines. Do not include anything that identifies you (name, phone, address, hospital, doctor's name)
- When you delete a post or your account, the content is removed at the site's next update; for faster removal email destek@heymomtr.com. Clearing search engine caches depends on the search engine
- When you create a guess pool, anyone with its link can see your name, your baby's name and the due date. Share the link only with people you choose. The pool is deleted with your account; to remove it earlier email destek@heymomtr.com
- Raffle winners are announced with a partially masked name
8. Recipients and International Transfers
We do not sell your data. We share it only as needed to run the service with:
- Google Firebase and Google Cloud (USA/EU): authentication, database, file storage, server functions, analytics, image moderation
- Anthropic (USA): AI responses and image analysis
- Apple and Google: distribution, in-app purchases, sign-in, Apple Search Ads attribution
- RevenueCat (USA): subscription management
- Google AdMob (USA): ads on the free tier
- Meta Platforms (USA/Ireland), TikTok and AppsFlyer (USA/Israel): campaign measurement of install, sign-up and purchase events, sent with a hashed user ID, device information and purchase value. No health or tracking data is sent, but these platforms can tell the event came from the HeyMom app. For the Meta pixel on myheymom.com see Section 11
- Expo (USA): app updates and push notification infrastructure
- Jotform (USA/EU): support, feedback and cancellation forms
- Telegram: only for our team's internal operational alerts; subscription events, feedback and cancellation texts and forum reports are sent with a pseudonymous user ID, never with your email
- Courier or prize supplier: only a raffle winner's delivery details, only for delivery
- Competent authorities and courts: only where legally required
International transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses under the GDPR, standard contracts and, where needed, your explicit consent under KVKK Art. 9, and equivalent safeguards elsewhere. Each provider is subject to its own privacy policy.
9. Retention
- Account, health, AI chat and AI memory data: until you delete your account
- Inactive anonymous (no-account) users: anonymous accounts unused for more than 14 days and their data may be deleted. Create an account to keep your data
- Family records: deleted when the link is removed
- Raw app events and error logs: up to 95 days
- Daily aggregate statistics: up to 24 months
- Abuse-prevention records containing IP addresses: up to 30 days
- Raffle delivery details: as long as needed for delivery and possible disputes, at the latest until you delete your account
- Purchase and invoicing records: for the period required by tax and commercial law (up to 10 years), de-identified where possible
- Account deletion: your data, stored files and forum content are deleted immediately and purged from backups within 30 days (Data Deletion Request)
- On-device data (Memory Book, belly photos, keepsake photos, exercise logs, caches): on your device until you delete the App or sign out
Expired data is deleted, destroyed or anonymised.
10. Security and Breach Notification
- Data is encrypted in transit with TLS and stored encrypted on Google infrastructure
- Security rules separate each user's data; we cannot see your password
- Only team members who need it for support, security or legal obligations can access personal data
No system is perfectly secure. If a breach occurs we notify the competent supervisory authority within 72 hours where required and inform affected users as soon as reasonably possible by in-app notification or email.
11. On-Device Data, Website, Widgets and Apple Watch
The App does not use web cookies. Your preferences, consent status, caches, Memory Book, belly photo series, newborn keepsake photos and exercise logs are stored on your device, and some of them are never uploaded. If you delete the App this data is lost and cannot be recovered.
Website (myheymom.com): Unlike the App, our website uses the Meta (Facebook) pixel for advertising measurement. The pixel measures which ad led to a visit and to an app store redirect; to do so it writes a _fbp cookie in your browser and shares the ad click identifier (fbclid), where present, with Meta. No health data is processed on the website and none is sent to the pixel. The pixel is not loaded, and no connection to Meta is made, until you choose Accept in the banner shown on your first visit. If you choose Decline, your choice is stored in your browser. On pregnancy week, article and forum pages the pixel never runs, even with consent. If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, the pixel stays disabled.
Widgets and Apple Watch: Summaries you choose (pregnancy week, last feeding, cycle day, partner info) may appear on widgets and Apple Watch, including on the lock screen. Anyone who can see your screen can see them; you can manage widget content in settings.
12. Your Rights
Depending on where you live (GDPR, UK GDPR, KVKK, CCPA, PIPEDA and Law 25, APPs, NZ Privacy Act) you have the right to: access your data; learn how and why it is processed and who receives it; correct it; delete it; restrict or object to processing; data portability; object to decisions based solely on automated processing; withdraw consent at any time; opt out of sale or sharing and limit use of sensitive information (CCPA; we do neither); non-discrimination for exercising your rights; and compensation for unlawful processing.
In the App:
- Download My Data: Profile > Privacy & Security > Download My Data
- Delete Account: Profile > Privacy & Security > Delete Account (or Data Deletion Request)
- Consent management: Profile > Privacy & Security
- Correct data: Profile > Edit
- Offer notifications: Settings > Pro Offers
The export file may not cover every record; for a complete copy email destek@heymomtr.com. We answer verifiable requests free of charge within 30 days (45 days under the CCPA). You may authorise an agent where local law allows. If you are not satisfied you can complain to your regulator: your EU supervisory authority or the UK ICO; the California Privacy Protection Agency or your state Attorney General; the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information; the OAIC (Australia); the Office of the Privacy Commissioner (New Zealand); or Turkey's Personal Data Protection Authority.
13. Age Requirement
The App is for people aged 18 and over. We do not knowingly process data of anyone under 18. Data about your baby is entered by you as the parent and under your responsibility. If we learn that an account belongs to someone under 18, we delete it and its data. To report: destek@heymomtr.com
14. Advertising and Measurement
- Free users see banner and rewarded ads via Google AdMob; there are no ads on Premium or for partners covered by family premium
- On iOS, if you do not allow tracking (ATT), ads are not personalised and your IDFA is not shared. In the EEA/UK you give or refuse ad consent through Google's consent form and can change it in Settings
- On Android you can reset or delete your advertising ID in device settings
- Ad requests may include generic content keywords without identity; your health records are never included
- You can earn AI credits by watching rewarded ads
- Campaign measurement (Meta, TikTok, AppsFlyer, Apple Search Ads) is described in Section 8
15. Notifications, Offers and Raffles
- If you allow notifications you receive reminders and partner, forum, raffle and subscription notifications
- You can turn off offer notifications such as discounts, trial reminders, checkout reminders and win-back offers with the Settings > Pro Offers switch
- Influencer and promo code use is kept for commission verification and de-identified when you delete your account
- Raffles and the daily wheel are available only to users in Turkey; raffle data processing is further described in the Giveaway Terms
16. Changes
We update this policy as the product changes. We notify you in the App about significant changes and ask for your consent again if new processing requires it. The current version is always in the App and at myheymom.com. The date at the top shows the last update.
17. Contact
- Data controller: Ersa Zirai Tarım Ltd. Şti. (HeyMom)
- Address: Yalı Mah. Hamit Nural Cad. No: 7A, Erdek/Balıkesir
- Email: destek@heymomtr.com
- Web: myheymom.com