For residents of Washington and Nevada · Last updated: 8 August 2026
This is a separate document on purpose. Washington's My Health My Data Act requires a consumer health data policy that stands on its own, with its own link — not a section buried inside a general privacy policy. Our main Privacy Policy still applies to everything else.
Nurtu is operated by INNOVURA PTY LTD (ABN 24 650 707 789, ACN 650 707 789), Victoria, Australia. For questions about this policy, email hello@nurtu.app.
"Consumer health data" is defined broadly under these laws. In Nurtu, it is the record you choose to keep about your child:
| Category | What it is |
|---|---|
| Health conditions and status | A neurodevelopmental profile you select, and whether it is diagnosed or suspected |
| Medications | Medicines and supplements, doses, schedule, and whether each dose was given or missed |
| Symptoms and daily observations | Sleep, mood, meals, difficult moments, sensory triggers, and any notes you write |
| Diet and nutrition | Foods recorded, food sensitivities, and the scores Nurtu calculates from what you told us to watch for |
| Bodily functions | Only where you record them yourself in a note |
We do not collect precise geolocation, biometric identifiers, genetic data, or health data purchased from anyone else.
One source only: you, typing or speaking it into the app. We do not buy consumer health data, we do not receive it from data brokers, advertising platforms, health providers or insurers, and we do not infer it from your browsing.
That is the complete list. We do not use it for advertising, profiling for advertising, or any purpose you did not ask for.
We do not sell consumer health data. Not to anyone, at any price, ever. Washington's law requires a signed authorization before any sale, and we will never ask you for one, because we will never sell it.
We share it with a small number of service providers ("processors") who act only on our instructions and may not use it for their own purposes:
| Who | What they receive | Why |
|---|---|---|
| Supabase (Sydney, Australia) | Your child's profile and logs, if you create an account to back up and sync | Database and sign-in |
| OpenAI | The text of a voice note, and the food and medicine names in your child's profile. Never their name, age or diagnosis — this is enforced by an allow-list on our server, not just by policy. | Sorting voice notes into entries; estimating nutrition data |
| Railway | Requests passing through; no health data is stored there | Hosts our API |
Your child's record is stored in Sydney, Australia. It is not held in the United States, and it is not moved to a US server. The only thing processed in the United States is the text of a voice note, stripped of your child's name, age and diagnosis before it is sent.
We do not share consumer health data with affiliates, advertisers, data brokers, social media platforms, insurers, employers or schools. We would disclose it if legally compelled — see §8 of the main Privacy Policy.
| Right | How to use it |
|---|---|
| Confirm and access what we hold | More → Your data → Export a backup, any time, no request needed |
| Know who we shared it with | The list in §5 is complete. Email us and we will confirm it in writing. |
| Withdraw consent | More → Your data for analytics; deleting a profile or your account withdraws consent for everything else |
| Delete | More → Your data → Delete account & data erases everything from your device and our servers. You do not need to ask us, and you do not need a subscription. |
| Appeal a refusal | Reply to our decision. We will reconsider and respond in writing. |
To make a request in writing, email hello@nurtu.app. We acknowledge within 5 business days and respond within 45 days, and we will tell you if we need a further 45 days. We will not ask you to create an account to make a request, and we will not charge you.
When you delete, we erase from our live systems within 30 days and from backups within a further 90 days. We also tell our processors to delete their copies.
Nurtu records which screens get opened, so we can tell whether the app works. These events carry a random identifier created on your device and are never linked to your account, your name or your child. They contain no health information — no diagnosis, no medications, no log contents, no free text. This is enforced by an allow-list in our code. You can turn it off in More → Your data, and in Washington and Nevada it is only collected if you agreed on the consent screen.
Nurtu is for parents and carers. A child has no account, no login and no way to enter anything. The information is about a child but is provided by an adult with authority to provide it.
Please contact us first at hello@nurtu.app. If you are not satisfied, you may complain to the Washington State Attorney General or the Nevada Attorney General.
If we materially change how we handle consumer health data, we will tell you in the app and by email before the change takes effect, and — as Washington requires — we will not apply the change to data already collected without asking you again.