Health Data Privacy Policy

Version 1.1 · Effective date: October 10, 2026 · Applies to: California, Washington, Nevada

This Health Data Privacy Policy supplements the To Be Parents Privacy Policy and describes how we handle consumer health data. It applies to users in California, Washington, Nevada, and Connecticut, and is provided under:

  • Washington's My Health My Data Act (RCW 19.373)
  • Nevada's Consumer Health Data Privacy Law (SB 370)
  • California's Confidentiality of Medical Information Act (CMIA), as amended by AB 254
  • Connecticut's Data Privacy Act as amended by SB 3 (consumer health data provisions)

Terms defined in our Privacy Policy or Terms of Use carry the same meaning here. Where the two documents cover the same subject, this one controls with respect to health data for users in those four states.

1. What is consumer health data

Consumer health data is personal information that relates to your reproductive health, your family-planning intentions, your physical attributes, or your lifestyle - anything that identifies, or could be used to infer something about, your health or reproductive status. On To Be Parents this is the information you enter when building your profile and the information you exchange with other users.

The full list of what we collect is set out in the Health Data Collection Authorization.

An honest note about scope. Not everything in that list is health information in any clinical sense, and we do not treat it that way. Fields such as your photos, your free-text description, your occupation, and your lifestyle answers appear here because the laws of these three states define consumer health data broadly - broadly enough to include information that could be used to infer something about reproductive status, even when it was collected for an entirely different reason. We do not draw health inferences from your photos, your writing, or your lifestyle answers; they exist so you can build a profile and so other people can recognise you as a person.

The fields that genuinely sit at the centre of these laws are your reproductive intent, your profile type, your role-specific answers, your medical details, and your location. Those we treat with the greatest care.

2. How we collect it

Only from you, and only in two ways: when you create and edit your account and profile, and when you use the Service - liking, matching, and messaging other users. We do not buy health data, and we do not obtain it from data brokers or from other platforms.

You are not required to answer every question. Some answers are necessary to use the Service at all; the rest are optional, and skipping them leaves the Service usable.

Location and geofencing

We never read your device's location. Neither the website nor the app asks for it, and we could not build a geofence if we wanted to.

The latitude and longitude stored on a profile are the coordinates of the city you chose yourself from the suggestions, not the place you happen to be standing. We use them for one thing: working out how far apart two people are.

We do not draw virtual boundaries around clinics, hospitals or any other health facility, we do not detect or record visits to them, and we do not send anyone notifications based on where they have been. The consumer health data laws of Washington, Nevada and Connecticut prohibit exactly this, and Connecticut names a radius of 1,750 feet. We do none of it anywhere in the world.

3. How we use it

As described in sections 3 and 4 of our Privacy Policy: to create your profile, to decide who to show you and who to show you to, to operate chat and calls, to keep the community safe, to verify identity when you ask, to support you, to improve the product, and to comply with the law.

We may publish aggregated, non-identifiable statistics about how the platform is used - general trends, never an individual. If you would rather not be counted even in aggregate, tell us through our contact form and we will exclude you.

We do not use identifiable health data for advertising or marketing, and we do not share identifiable user data with third parties for their own marketing.

4. How we share it

a. With other users

Exactly as set out in the Health Data Sharing Authorization, which lists field by field what every signed-in user can see, what only your matches can see, and what is shown to nobody at all. In summary:

  • Every signed-in user sees your profile, including your role answers, once your profile is active. We do not gate profile fields behind a like or a match.
  • Only your matches can read your messages. Calls are not recorded.
  • No other user sees your blood type or CMV status: the matching engine reads them and your profile never shows them. To Be Parents staff who hold the user-management section can see them, for support and safety. No other user sees your exact date of birth, email address, precise coordinates, or IP address.

b. With third parties

  • Processors. Vendors who host our servers, deliver email, moderate photos, verify identity, and measure product usage, each bound by a data-processing agreement to act only on our instructions and never for their own purposes.
  • A corporate successor in a merger, acquisition, financing, or transfer of assets.
  • Legal authorities where the law requires it.

c. With clinics and other To Be Parents partners

  • Clinics and other partners that we have reviewed and approved see your profile if you have written to the partner, the partner has replied to you, or you have shared a stage of your journey with the partner. A shared stage shows its tasks and dates, except tasks that only the other member of the journey does. The Health Data Sharing Authorization has the details.
  • Donors and surrogates who answered “yes” to the question about clinics appear in partner clinics’ catalog, and those clinics can write to them first.

We do not sell consumer health data.

5. Your rights

In addition to the rights in section 8 of our Privacy Policy, residents of California, Washington, and Nevada may:

  • Access - ask what health data we hold about you and receive a copy.
  • Correct - fix anything inaccurate, directly through the profile editor or by asking us.
  • Delete - ask us to erase your health data, or use «Delete account» to erase everything.
  • Withdraw consent - withdraw either authorization at any time. Neither is optional, so withdrawing one deletes your account, and so does declining one when you are first asked. If you have not finished building a profile yet, the account is erased immediately and the email frees up at once. If you have, deletion hides everything from other users straight away and erases it permanently within 30 days, and inside that window you can ask us to restore it.
  • Restrict - pause your profile so it disappears from search and browse while your account stays intact.

To exercise any of these, write to us through our contact form. We respond to verifiable requests within 45 days, and may extend by a further 45 days where reasonably necessary, telling you if we do.

Appeals. If we refuse a request, you may appeal through the same contact form. If the appeal fails: Washington residents may complain to the Washington State Attorney General at atg.wa.gov/file-complaint; Nevada residents to the Nevada Attorney General at ag.nv.gov/Complaints; California residents as described in our Privacy Policy.

6. How long we keep it

As described in section 7 of our Privacy Policy. While your account is active we keep your data; when you delete your account, your profile, photos, and messages are hidden from other users immediately and everything is permanently erased within 30 days. Backups are kept for up to 90 days.

7. Where it goes

Our primary servers are in the United States (New York). If you are outside the United States, using the Service involves transferring your information there. Where that transfer is from the European Economic Area, the United Kingdom, or Switzerland, it is protected by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent lawful mechanism, together with encryption in transit and access controls.

8. Changes

We may update this policy. If we make a material change we will tell you in the app or by email before it takes effect, and we will update the effective date above. A material change to either authorization requires your consent again.

9. Contact

For any question about this policy, or to exercise a right, reach us through our contact form. To Be Parents is operated by HYPERFOCUS TECH INC. (United States).