This Consumer Health Data Privacy Policy is a standalone document, separate from our general Privacy Policy, as required by Washington's My Health My Data Act (RCW 19.373, “MHMD”). It describes, specifically and exclusively, how we collect, use, and share consumer health data — it does not replace or narrow the commitments in our general Privacy Policy, and where the two overlap, both apply. See in particular Privacy Policy §22 (US users), which points here.
01 Who we are & scope of this policy
Pebby is a shared-care baby tracking app and website (including our quiz funnel at quiz.pebby.app) developed and operated by CREATIVE VLU SOLUTIONS SRL, a company incorporated under Romanian law. For the purposes of Washington's My Health My Data Act, we act as a “regulated entity.” When this policy says “Pebby”, “we”, “us”, or “our”, it refers to CREATIVE VLU SOLUTIONS SRL.
This policy applies to consumer health data we collect about you through the Pebby app, our website, and our quiz funnel, regardless of where you live. We are publishing it as a Washington-law-driven document because MHMD requires a standalone policy, but we apply the substantive protections described here — no sale, no unauthorized sharing, and the rights below — to everyone, not only Washington residents.
02 What counts as “consumer health data”
MHMD defines “consumer health data” broadly as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. In Pebby's specific context, this includes:
- Baby feeding logs — type, timing, duration, and amount of feeds you record.
- Sleep logs — sleep and wake times, duration, and notes you enter about your baby's sleep.
- Diaper-change logs — timing and type of diaper changes you record.
- Growth and other tracking entries you choose to log about your baby's care and wellbeing.
- Quiz answers you give in our web funnel before you create an account or subscribe — many of these ask about your baby's feeding, sleep, or routines, and are health-adjacent in the same way.
This data is entered by you, an adult caregiver, about your baby — not by or about you personally, and not by your baby directly. MHMD's definition of consumer health data is not limited to information about the person entering it, so we treat this baby-care data with the same protections as if it directly concerned an identified adult consumer.
03 How we collect it & your consent
We collect consumer health data only when you choose to enter it — either as tracking-log entries inside the Pebby app, or as answers to our quiz funnel before you have an account. We do not collect consumer health data passively, and we do not infer it from other sources (such as browsing behaviour or purchases).
By entering this data, you consent to our collecting and using it as described in this policy. Where MHMD or another applicable law requires your affirmative, specific consent for a particular use (for example, a use beyond providing the service to you), we will ask for it separately, before that use begins. You may withdraw consent at any time — see Your rights below.
04 How we use consumer health data
We use consumer health data solely to:
- Provide the core tracking and shared-care features you and your invited caregivers use.
- Display your logs and history back to you inside the app.
- Personalise the quiz funnel's content and stat screens for the person completing it.
- Provide customer support when you contact us about your data or account.
- Comply with legal obligations, where applicable.
We do not use consumer health data for advertising, targeted advertising, profiling, or any purpose you have not directly requested. As stated in Privacy Policy §3, we do not send your or your baby's tracking logs or quiz answers to Meta, Google, or any advertising or analytics platform.
05 We do not sell consumer health data
We do not, and will not, sell your consumer health data. Under MHMD, “sale” is defined broadly — it covers any exchange of consumer health data for monetary or other valuable consideration, not just a cash transaction. None of our data practices meet that definition: we do not exchange consumer health data with data brokers, advertisers, or any other third party in return for money, services, discounts, or anything else of value.
06 No unauthorized third-party sharing
We share consumer health data only with the processors strictly necessary to operate the service — for example, the hosting/database provider that stores your tracking logs so the app can display them back to you (see the processor table in Privacy Policy §10 for the full, named list). We do not share consumer health data with advertising or analytics platforms — the Facebook SDK, Meta Pixel, Google Tag Manager, and Firebase Analytics/Crashlytics described in our Privacy Policy never receive your tracking logs or quiz answers.
We do not share consumer health data with any third party for that third party's own independent use, for advertising, or for any purpose unrelated to providing you the Pebby service, except: (a) with your explicit consent; (b) where necessary to protect against fraud, security threats, or illegal activity; or (c) where required by a valid legal process such as a court order or subpoena.
07 Your rights
Under MHMD (and, in substance, the laws described in §10 below), you have the right to:
We do not discriminate against you (for example, by degrading service or charging a different price) for exercising any of these rights.
08 The right to a copy of your specific data
MHMD gives you a right that goes beyond typical US state privacy laws (which usually only require disclosing categories of data): the right to request an actual list of the specific consumer health data we have collected about you, together with a list of all third parties and affiliates that data has been shared with, and — where feasible — an active contact for those third parties.
In practice, because we do not sell or share consumer health data with advertising, data-broker, or other unauthorized third parties (see §6), this list will typically show only the operational processors named in Privacy Policy §10 (e.g. our hosting/ database provider) — not advertising or analytics platforms.
To request this, email privacy@pebby.app from the email address associated with your account (or, for quiz-only users, the email you provided in the funnel) with the subject line “Consumer health data request.” We will verify your identity before responding, consistent with our general approach to data-subject requests in Privacy Policy §15.
09 Geofencing — not applicable
MHMD prohibits implementing a geofence around a mental health facility, reproductive or sexual health facility, gender-affirming care facility, or similar in-person health-care location, in order to identify or track consumers, collect their consumer health data, or send them notifications, messages, or advertisements related to their health.
This restriction does not apply to Pebby: we operate only as an app and website, we have no physical health-care facilities or locations of any kind, and we do not use geofencing — around any location, health-related or otherwise — for any purpose. We are stating this explicitly, rather than omitting the topic, because MHMD expects regulated entities to address it.
10 Nevada & Connecticut residents
Nevada (SB 370, the Consumer Health Data Privacy Law) and Connecticut (the CTDPA's consumer health data provisions) have also enacted laws protecting consumer health data, similar in spirit to Washington's MHMD. We apply the same substantive protections described in this policy — no sale, no unauthorized third-party sharing, and the access/deletion/ consent-withdrawal rights in §7 — to the consumer health data of Nevada and Connecticut residents as well, not only Washington residents.
What remains an open question, not yet resolved by counsel, is whether Nevada's and Connecticut's laws independently require a standalone document the way MHMD does, or whether their (generally less prescriptive) requirements can be satisfied inline within our general Privacy Policy. Rather than guess, we have chosen — as a conservative first step — to extend this standalone policy's protections to Nevada and Connecticut residents too, so no one is worse off while that question is resolved.
11 Retention & security
We retain consumer health data for as long as your account is active, and delete it within 30 days of account deletion, consistent with Privacy Policy §12. Quiz answers from users who never create an account are retained only for the limited period needed to support the funnel (for example, to resume a session or send a follow-up email you requested), then deleted or anonymised.
Consumer health data is transmitted over encrypted connections (TLS/ HTTPS) and stored with access controls limiting who within our organisation can view it, consistent with Privacy Policy §20.
12 How to exercise your rights & appeals
To exercise any right described in §7 or §8, email privacy@pebby.app. We aim to respond within 45 days of a verifiable request (extendable by a further 45 days for complex requests, with notice to you).
If we decline to act on your request, you may appeal by replying to our response within a reasonable time, explaining why you disagree. We will respond to your appeal within 45 days. If we deny your appeal, you may contact the Washington State Attorney General's Office (atg.wa.gov) to submit a complaint.
13 Changes to this policy
We may update this Consumer Health Data Privacy Policy from time to time. For material changes, we will notify you at least 30 days in advance by email or via an in-app notice, consistent with Privacy Policy §23. The “Effective date” at the top of this page always reflects the most recent version.
14 Contact us
For any question, request, or complaint about consumer health data:
This policy supplements, and should be read alongside, our Privacy Policy (see especially §22, US users) and our Cookie Policy.
Effective date: to be set on publication · © 2026 CREATIVE VLU SOLUTIONS SRL