Privacy Policy

Last updated: March 2026

1. Introduction

Welcome to NurseryApp ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data and the data of children managed through our platform. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web services.

NurseryApp, operated by NurseryApp Ltd., is the data controller responsible for the processing of personal data collected through our platform. We determine the purposes and means of processing your personal data in accordance with applicable data protection laws.

By using NurseryApp, you agree to the collection and use of information in accordance with this policy.

2. Data We Collect

We collect different types of information to provide and improve our services:

Personal Information (Required)

  • Account Information: Name, email address, phone number, profile photo
  • Child Information: Name, date of birth, classroom, health records, allergies, medical conditions
  • Contact Information: Emergency contacts, authorized pickup persons

Health & Medical Data (Required with Explicit Consent)

Health and medical data is classified as sensitive personal data. We collect and process this data only with your explicit consent, which you provide when entering health information into the platform. You may withdraw consent for health data processing at any time by contacting us, though this may affect our ability to manage your child's health and safety needs.

  • Medical conditions and allergies
  • Vaccination records
  • Medication information and administration logs
  • Doctor and hospital information
  • Emergency medical notes

Activity Data (Required)

  • Daily reports (meals, activities, naps, mood)
  • Attendance records (check-in/check-out times)
  • Photos and media shared in reports

Technical Data (Automatically Collected)

  • Device information (device type, operating system, device identifiers)
  • Push notification tokens
  • IP address and approximate location (for security purposes)
  • App usage analytics and interaction data

Optional Data

The following data is optional and only collected if you choose to provide or enable it:

  • Profile photos
  • Precise location data (requires explicit device permission)
  • Camera and photo library access (requires explicit device permission)

3. How We Use Your Data

We use the collected data for the following purposes:

  • Service Delivery: To provide daily reports and updates about your child
  • Communication: To send important notifications about attendance, activities, and emergencies
  • Health & Safety: To maintain health records for your child's safety and wellbeing
  • Attendance Tracking: To verify check-in, check-out, and authorized pickups
  • Service Improvement: To analyze usage patterns and improve our app
  • Security: To detect and prevent fraud or unauthorized access

We NEVER sell your personal data or your children's data to third parties. We do not use your data for advertising, marketing profiling, or any purpose unrelated to the nursery management services described in this policy.

Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract Performance: Processing necessary to provide our nursery management services as agreed upon in our terms of service.
  • Explicit Consent: Processing of sensitive data such as health and medical information, which is collected only with your explicit consent.
  • Legitimate Interest: Processing for app security, fraud prevention, and service improvement, where our interests do not override your fundamental rights.
  • Legal Obligation: Processing required to comply with applicable laws and regulations.

4. Data Sharing

We share limited data with third-party service providers solely for the purposes described below. We do not sell, rent, or trade your personal data to any third party.

  • Firebase Cloud Messaging (Google): Device identifiers, IP address, and notification tokens — shared for the purpose of delivering push notifications.
  • Analytics Providers: Device identifiers, IP address, device type, operating system version, and anonymized app usage data — shared for the purpose of monitoring app performance and diagnosing issues.
  • Cloud Storage Providers: Uploaded files such as photos and documents — shared for the purpose of secure file storage and retrieval.

No personal data, child data, or health data is shared with third parties for advertising, marketing, or any purpose beyond providing and maintaining our services. All third-party providers are contractually bound to process data only as instructed by us and in accordance with applicable data protection laws.

5. Data Visibility & Access Control

We implement strict role-based access controls:

  • Parents: Can only see their own children's information
  • Teachers: Can only see students in their assigned classrooms
  • Administrators: Have access to their organization's data only
  • Health Information: Restricted to authorized staff and parents
  • Daily Reports: Private between teachers and parents

6. Data Security

We implement industry-standard security measures:

  • Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
  • Multi-tenant Architecture: Complete data isolation between nurseries
  • Authentication: Secure JWT-based authentication with session management
  • Access Controls: Role-based permissions and authorization
  • Infrastructure: Data stored in certified, secure data centers
  • Monitoring: Regular security audits and vulnerability assessments

7. Data Retention & Deletion

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy.

  • Active account data is retained while your child is enrolled
  • Upon account deletion, personal data is permanently removed within 30 days
  • Some data may be retained for legal compliance purposes (e.g., regulatory record-keeping requirements)
  • Backups are automatically purged according to our retention schedule

How to Delete Your Account

You can request deletion of your account and associated data at any time through any of the following methods:

Upon receiving a deletion request, we will delete all personal data associated with your account within 30 days, except where retention is required by law. We will confirm the completion of your deletion request via email.

8. Your Rights

You have the following rights regarding your personal data:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate information
  • Deletion: Request deletion of your account and data
  • Portability: Export your data in a portable format
  • Opt-out: Opt-out of non-essential communications
  • Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at info@nursery-backend.com

9. Push Notifications

We send push notifications for:

  • Child check-in and check-out alerts
  • New daily report notifications
  • Health alerts and medication reminders
  • Important announcements from nursery staff

You can manage notification preferences in the app settings or disable them through your device settings.

10. Location Data

We may collect location data to:

  • Verify attendance and pickup at the nursery
  • Enhance security during check-in/check-out
  • Provide location-based features when enabled

Location access is optional and can be disabled in your device settings.

11. Camera & Photos

We request camera and photo library access to:

  • Take photos for student profiles
  • Capture activity photos for daily reports
  • Scan QR codes for pickup verification

Photos are only shared with authorized parents and staff. You can revoke camera access at any time through device settings.

12. Children's Privacy

NurseryApp is not intended for use by children. Our application is designed exclusively for use by adults, including parents, guardians, teachers, and nursery administrators. Children do not create accounts, access the application, or interact with it directly in any way.

While our platform processes information about children (such as attendance, daily reports, and health records) for the purpose of nursery management, this data is entered and managed solely by authorized adult users. We do not knowingly collect personal information directly from children.

We take extra care to protect children's data and comply with applicable children's privacy laws, including the Children's Online Privacy Protection Act (COPPA) and similar regulations. All children's data is encrypted both in transit and at rest, and access is strictly controlled through role-based permissions. If we become aware that personal data has been collected directly from a child without appropriate parental or guardian consent, we will take immediate steps to delete such information from our systems.

13. Third-Party Services

We use the following third-party services to operate and improve our platform:

  • Firebase Cloud Messaging (FCM): Used to deliver push notifications to your device. FCM may process limited device information, including device identifiers, IP address, and notification tokens, solely for the purpose of delivering notifications reliably. Google's privacy policy governs the processing of this data by Firebase.
  • Analytics Providers: We use analytics services to monitor app performance, diagnose technical issues, and improve user experience. These providers may process limited device information such as device identifiers, IP address, device type, operating system version, and app usage data. All analytics data is collected in an aggregated or anonymized form where possible.
  • Cloud Storage: For secure, encrypted file storage of uploaded media and documents.

These third-party services operate under their own privacy policies. We carefully select providers that meet our security and privacy standards and ensure that data shared with them is limited to what is strictly necessary for the services they provide. We do not permit third-party service providers to use your personal data for their own marketing or advertising purposes.

14. International Data Transfers

Your personal data may be processed in countries other than the country in which you reside. Our primary servers are located in secure data centers, and some of our third-party service providers (such as Firebase and cloud storage providers) may process data in the United States or other jurisdictions.

When we transfer personal data across borders, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws. These safeguards may include standard contractual clauses, data processing agreements, and ensuring that service providers maintain adequate levels of data protection.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

  • Posting the new Privacy Policy on this page
  • Updating the "Last updated" date
  • Sending a notification through the app for significant changes

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: