Last updated: 8 August 2026 · Effective: 8 August 2026
Nurtu holds health information about a child. We treat that as the most sensitive category of personal information there is, and this policy is written to be read — not to be survived.
Nurtu is operated by INNOVURA PTY LTD (ABN 24 650 707 789, ACN 650 707 789), an Australian private company registered in Victoria, Australia ("we", "us", "our").
We are the data controller for the information described in this policy.
| Privacy enquiries | hello@nurtu.app |
|---|---|
| Registered office | Victoria, Australia. Our full registered office address is on the public ASIC register against ACN 650 707 789, and we will provide it in writing on request. |
Nurtu is designed and sold for use by a parent or carer. It is not directed to children, and a child does not have an account, a login, or any way to enter information into it.
Information about your child reaches us because you choose to record it. We do not knowingly collect personal information directly from a child. If you believe a child has provided us with information, contact us and we will delete it.
This is health information and we treat it as sensitive:
If you use the voice log, your speech is converted to text. Where your device supports on-device speech recognition, this happens on your phone and the audio never leaves it. The recording is written to temporary storage only so a failed transcription can be retried, and is deleted as soon as the note has been processed. We do not retain audio recordings.
The resulting text is sent to our servers for sorting into log entries (see §6).
We record which screens and features are used, so we can tell whether the app works. These events are tied to a random identifier generated on your device, which is not linked to your account, your name or your child.
Analytics never include your child's name, age, diagnosis, medications, log contents, notes, or any free text. This is enforced by an allow-list in our code, not merely by policy. You can turn analytics off entirely in More → Your data.
Our servers record IP address, request time and device platform for security and abuse prevention, retained for a short period.
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Store your child's logs and show them back to you | Explicit consent — Article 9(2)(a) |
| Find patterns and generate reports you request | Explicit consent — Article 9(2)(a) |
| Convert your voice notes into entries | Explicit consent — Article 9(2)(a) |
| Score foods against your child's profile | Explicit consent — Article 9(2)(a) |
| Manage your account and subscription | Performance of a contract — Article 6(1)(b) |
| Anonymous product analytics | Consent — Article 6(1)(a). In the UK and EEA nothing is collected until you switch it on; elsewhere it is on by default and you can switch it off. |
| Security, fraud and abuse prevention | Legitimate interests — Article 6(1)(f) |
Because the information about your child is health information, we rely on your explicit consent, which you give when you set up a profile. You can withdraw it at any time by deleting the profile or your account. Withdrawal does not affect processing carried out before you withdrew.
Under the Australian Privacy Act 1988 (Cth), health information is "sensitive information" and we collect it only with your consent, in accordance with Australian Privacy Principle 3.
We use a small number of service providers. Each acts on our instructions under a written agreement, and none is permitted to use your information for its own purposes.
| Provider | What it does | What it receives | Location |
|---|---|---|---|
| Supabase | Database and account sign-in | Your account email; your child's profile and logs | Sydney, Australia |
| Railway | Hosts our API server | Requests in transit; no logs stored | United States |
| OpenAI | Sorts voice-note text into entries; estimates food data | The text of your note and the food/medicine names in your child's profile. Not their name, age or diagnosis — our server strips those before the request leaves us, so an out-of-date app cannot send them either. OpenAI does not train on this data, and retains it for up to 30 days for its own abuse monitoring before deleting it. | United States |
| PostHog | Anonymous product analytics | Event names and counts only (see §3.4) | United States |
| Apple | App distribution and payments | Purchase and subscription data | Per Apple's policy |
Your child's profile and logs stay in Australia. Our database is hosted in Sydney, so the record itself is never sent overseas.
Two things do cross a border: the text of a voice note, and the food or medicine names sent for sorting, which are processed in the United States by OpenAI. Nothing identifying your child goes with them — no name, no age, no diagnosis (see §6). Our API server is also hosted in the United States, but it holds nothing; requests pass through it.
Under Australian Privacy Principle 8 we take reasonable steps to ensure any overseas recipient handles your information consistently with the Australian Privacy Principles, and our contracts with these providers require it.
| What | How long |
|---|---|
| Your child's profile and logs | Until you delete them, or 24 months after your account becomes inactive, whichever comes first |
| Voice recordings | Not retained — deleted once the note is processed |
| Voice-note text sent for sorting | Not stored by us at all; held by OpenAI for up to 30 days for abuse monitoring, then deleted |
| Analytics events | 14 months |
| Server security logs | 30 days |
| Records of purchases | 7 years, as required by Australian tax law |
When you delete your account we delete your data from our live systems within 30 days, and from backups within a further 90 days.
We may disclose information where we are required to by law — for example under a court order, a subpoena, or a lawful request from a regulator — or where we reasonably believe it is necessary to prevent serious harm to someone's life, health or safety. We will tell you when this happens unless we are legally prevented from doing so.
No system is perfectly secure. If a data breach occurs we will notify you and the relevant regulator:
| Where you are | Who we notify, and how fast |
|---|---|
| Australia | You and the Office of the Australian Information Commissioner, where the breach is likely to result in serious harm (Notifiable Data Breaches scheme) |
| UK / EEA | The relevant supervisory authority within 72 hours, and you without undue delay where there is a high risk to you |
| United States | You and the Federal Trade Commission within 60 days, under the FTC's Health Breach Notification Rule. That rule treats an unauthorised disclosure as a breach, not only a break-in — so it would apply if we ever sent your health information somewhere we said we wouldn't. |
Wherever you live, you can:
If you are in the UK or EEA you also have the right to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner's Office.
To exercise any right, email hello@nurtu.app. We respond within 30 days. We will not treat you differently for exercising a right — no reduced service, no different price.
State privacy laws differ, but our answer to nearly all of them is the same: we do not sell your personal information, we do not "share" it for cross-context behavioural advertising, and we do not use it for targeted advertising. There is no advertising in Nurtu and no advertising SDK in the app.
Because we do not sell or share, there is nothing for a universal opt-out signal such as Global Privacy Control to opt out of. We honour one regardless.
| Where you are | What you can do |
|---|---|
| Every US state | Access, correct, delete and take a copy of your information — all of it available in the app, without asking us |
| California | Know, delete, correct, and opt out of sale or sharing (CCPA/CPRA). You may use an authorised agent. |
| Colorado, Connecticut, Virginia, Texas, Oregon, Montana and other states with comprehensive laws | The same rights, plus the right to appeal if we refuse a request. To appeal, reply to our decision and we will reconsider and respond in writing. |
| Washington and Nevada | Additional rights over consumer health data, including withdrawal of consent. See our separate Consumer Health Data Privacy Policy. |
Your child's information is sensitive data under every US state law that defines the term, both because it concerns health and because it concerns a known child. We collect it only with your consent, given in the app before you record anything.
The information is about your child, and the rights above are ultimately theirs. As they grow older they may be able to exercise those rights themselves. If your child asks us to delete information about them, we will consider that request on its merits, taking their age and understanding into account.
Please contact us first at hello@nurtu.app — we will acknowledge within 5 business days and respond within 30 days.
If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC), or to your local supervisory authority if you are in the UK or EEA.
Nurtu is not currently offered in the United Kingdom, the European Economic Area or Switzerland. The app is not sold in those App Store territories, and we do not market it there.
Article 27 of the UK and EU GDPR requires a business outside those regions to appoint a local representative before offering goods or services to people inside them. We will appoint one, and name them here, before Nurtu becomes available in those markets. Until then there is nothing to list, and we would rather say so plainly than name a placeholder.
If you are in the UK or the EEA and have somehow ended up using Nurtu, the rights in §10 apply to you anyway — email hello@nurtu.app and we will honour them.
If we change this policy in a way that materially affects how we handle your information, we will tell you in the app and by email before the change takes effect. The date at the top always shows the current version.
Nurtu records what you observe. It does not diagnose, treat, cure or prevent any condition, it is not a medical device, and it is not a substitute for advice from a qualified health professional. Nothing in Nurtu should be used to make a clinical decision on its own.