Privacy Policy

Effective Date: August 11, 2024
Last Updated: August 2, 2026
Applies to: United States and Canada

1. About this policy

BirthBridge connects families with birth professionals. Doulas, midwives, lactation consultants, childbirth educators, and postpartum support. This policy explains what information we collect, why we collect it, who we share it with, and the choices you have.

We have tried to write this in plain language. Where a law gives you a specific right, we say so and we tell you how to use it.

This policy covers BirthBridge, LLC ("BirthBridge," "we," "our," "us") and the services we provide at mybirthbridge.com and through our apps and tools (the "Services").

Where we operate. BirthBridge is offered in the United States and Canada only. Wherever this policy says "the United States," that includes Puerto Rico and the other US territories. We do not offer or direct our services to the European Economic Area, the United Kingdom, or Switzerland, and this policy does not attempt to describe rights under the GDPR or UK GDPR.

Two schedules are part of this policy:

• Schedule A covers additional rights for residents of US states with comprehensive privacy laws.
• Schedule B covers Canada, including Quebec, and is the controlling section for Canadian users where it differs from the main body.

Health information gets separate treatment. See our Health Information Policy for how we handle information about health and care.

Contact for privacy questions:
Email: hello@mybirthbridge.com
Mail: BirthBridge, LLC, Texas, United States

Privacy requests sent to that address reach the people responsible for handling them. Quebec residents: see Schedule B5 for who is legally the person in charge of the protection of personal information.

2. Information we collect

2.1 Information you give us

If you are a family:

• Your name, email address, phone number, and location or mailing address.
• Your account settings and preferences.
• Information you choose to share when you search or make a request, which may include a due date, the type of support you are looking for, where you plan to give birth, and where you are in your pregnancy or postpartum period.
• Bookings you make, services you request, and your booking history.
• Messages you send to birth professionals through the platform.
• Reviews and other content you post.
• Payment details, which are collected and processed by our payment processor. We do not store full card numbers.
• If you join a referral or affiliate program, your referral code, who you introduced, and what has been earned or paid. See our Referral and Affiliate Program Terms.

If you are a birth professional:

• Your name, business name, contact details, and service area.
• Your credentials, including certifications, licences, registration numbers, and training.
• Your service descriptions, pricing, and availability.
• Your profile content, including photos, biography, and any articles you publish.
• Payout details, which are collected and held by our payment processor.
• Messages you exchange with families through the platform.

2.2 Information we collect automatically

• IP address, approximate location derived from IP, device type, browser, and operating system.
• Pages viewed, searches run, and features used.
• Cookies and similar technologies. See Section 7.

2.3 Information from others

• Google, through Firebase Authentication and Google Sign-In, when you sign in with a Google account. We receive your name, email address, and a Google account identifier. We do not receive your Google password.
• Our payment processor, for transaction status and payout status.
• Credential verification sources, where we verify a professional's registration with a regulatory body or certifying organization.
• Public sources, where a professional's registration status is published by a regulator.

2.4 Information about health

Some of what families tell us relates to health. A due date, a birth plan preference, a feeding question, or a request for postpartum mental health support are all information about health.

We treat this as sensitive information. We collect it only where it is needed to help you find and arrange care, we do not use it for advertising, and we do not sell it. Where the law requires your express consent before we handle it, we ask for that consent separately rather than relying on your general acceptance of this policy.

Our Health Information Policy explains this in more detail, including how it works when your birth professional is a regulated health professional.

If you live in Washington, Nevada, or Connecticut, your state has a specific law about this kind of information, called consumer health data. Our Consumer Health Data Policy is written for you, and it is a separate document because those laws require it to be.

3. How we use information

We use information to:

• Run the platform. Create and secure your account, show you search results, enable bookings, and deliver messages and notifications.
• Connect families with professionals. Match search criteria to providers, and share the details a professional needs to respond to your request.
• Process payments. Charge families, pay professionals, and handle refunds and disputes through our payment processor.
• Verify professionals. Review credentials and registration so families can rely on what a profile says.
• Communicate with you. Send service messages such as booking confirmations and message notifications, and, where you have agreed to it, send updates and marketing.
• Improve the platform. Understand which features are used and where people get stuck.
• Keep people safe. Investigate fraud, misuse, harassment, and violations of our Terms.
• Meet legal obligations. Tax, accounting, record-keeping, and responding to lawful requests.

We do not use health-related information to target advertising. We do not sell personal information. See Section 6.

3.1 Automated processing

Search results and provider recommendations are generated automatically based on factors including location, service type, availability, profile completeness, and relevance to your search. This is a ranking of results, not a decision about you, and it does not determine your access to any service.

If we ever make a decision about you based only on automated processing that produces a legal or similarly significant effect, we will tell you, explain the main factors, and give you a way to ask a person to review it.

4. Legal bases for processing

Where the law requires us to identify a legal basis, we rely on the following:

In Canada, consent is the primary basis, applied as described in Schedule B.

5. How long we keep information

We keep information only as long as we need it. This is the schedule we apply:

These are the periods we work to. A record may occasionally be held a short time beyond its period while deletion is carried out. If you ask us to delete something, we act on your request directly rather than waiting for a scheduled removal — see Section 9.

Where a professional is a regulated health professional, their own record-retention obligations are set by their regulator and are usually longer. Those records are theirs, not ours. See the Health Information Policy.

6. Who we share information with

6.1 Between users

• When a family contacts or books a professional, we share the family's name, contact details, and the content of the request with that professional.
• A professional's profile, including credentials, service descriptions, pricing, availability, and reviews, is public.

6.2 Service providers

We share information with companies that help us run the platform. They may only use it to provide services to us.

We publish this list rather than describing our vendors in categories, so that a clinic or a professional's own privacy officer can assess us. If we add a provider that handles personal information, we update this table. Ask us at hello@mybirthbridge.com to be told when it changes.

6.3 Legal and safety

We may disclose information where we are legally required to, to enforce our Terms, or to protect the rights, property, or safety of BirthBridge, our users, or the public.

Our approach to legal requests. We review every request. We require valid legal process, we object to requests that are overbroad or that we believe lack legal authority, and where we are permitted to do so we notify the affected user before disclosing, so they have a chance to object.

Reproductive and pregnancy-related information. We apply heightened scrutiny to any request for information that would reveal a person's pregnancy status, pregnancy outcome, or the reproductive health care they sought or received. We will not disclose that information in response to a request unless we are compelled by legally valid and enforceable process, and we will challenge such process where we have a good faith basis to do so. Where the law permits us to require an attestation about the purpose of the request before disclosing, we require one.

Several states, including California, Washington, and New York, have enacted shield laws that restrict cooperation with out-of-state investigations into lawfully obtained reproductive health care. We will assert every protection those laws give us, and we will not voluntarily assist an investigation into a person for seeking, receiving, or helping someone receive reproductive health care that was lawful where it occurred.

6.4 Business transfers

If BirthBridge is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We will give notice before your information becomes subject to a different privacy policy. In Canada, we will meet the additional requirements that apply to disclosures for business transactions.

6.5 We do not sell your information

We do not sell personal information for money.

Under California and several other state privacy laws, "sell" and "share" also cover disclosing identifiers to advertising partners for cross-context behavioral advertising, even where no money changes hands. We do not do that. We run no advertising pixels and no advertising tags. We use Google Analytics to understand how the platform is used, it loads only after you accept analytics cookies, and it is not used to target advertising to you anywhere else.

You can withdraw analytics consent at any time using the Cookie settings link in our footer. We also honour the Global Privacy Control: if your browser sends that signal, Google Analytics and Tag Manager never load and you are not asked to consent.

Our own measurement. BirthBridge records how people move through our own site — pages opened, in what order, and where the visit came from — so that we can see where people get stuck. This is sent only to our own servers. No other company receives it, it is never used for advertising, and health information is not sent to it. Section 2 of our Cookie Policy sets out what it stores and how to be excluded from it.

We never sell or share health-related information, and we never use it for advertising.

7. Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the platform secure, and understand how it is used. Our Cookie Policy lists what we actually set and what each one does.

You can manage cookies through our cookie settings and through your browser. Blocking essential cookies will break sign-in and booking.

We honour the Global Privacy Control and similar opt-out preference signals as a valid opt-out request for the browser or device sending the signal. Where we receive one, Google Analytics and Tag Manager never load and you are not asked to consent.

In Quebec, technology that profiles, tracks, or locates you is off by default and only activated if you turn it on. See Schedule B.

8. Security

We protect information using measures appropriate to its sensitivity, including:

• Encryption in transit. Traffic between your device and our servers is protected with TLS.
• Encryption of messages. Messages sent through the platform are encrypted at rest with per-user key pairs, so message content is not readable in plain form in our database.
• Access controls. Access to production systems and personal information is limited to staff who need it for their role, and is logged.
• Monitoring and logging. We log access and system activity and review it for signs of unauthorized use.
• Vendor review. We assess the security practices of the service providers we rely on and put contractual protections in place.
• Ongoing review. We review and update our safeguards as the platform and the threat landscape change.

What we do not claim. No system is completely secure. We do not offer end-to-end encryption where only you hold the keys. BirthBridge holds the technical means to access message content and does so in limited circumstances, including to generate notifications, to investigate reports of abuse or fraud, to respond to a support request, and where legally required.

Our commitment on breaches. If a security incident affects your personal information, we will investigate promptly, notify you and the relevant regulators where required, tell you what happened and what information was involved, explain what we are doing about it, and tell you what you can do. We aim to notify affected users without undue delay and within 72 hours of confirming a reportable breach, and we will meet any shorter deadline the law imposes.

Breach notification law is not one rule. We will comply with each regime that applies to a given incident, including:

• US state breach notification statutes, which apply in all fifty states and set their own deadlines and content requirements.
• The FTC Health Breach Notification Rule, where it applies to us. That rule treats an unauthorized disclosure of identifiable health information as a breach, not only an intrusion, and requires notice to affected individuals and to the FTC without unreasonable delay and no later than 60 calendar days, with additional media notice where 500 or more people are affected.
• HIPAA breach notification, where we act as a business associate, reporting to the covered entity without unreasonable delay and no later than 60 days after discovery.
• PIPEDA and provincial law in Canada, reporting to the Office of the Privacy Commissioner of Canada, and to the Commission d'acces a l'information for Quebec residents, where there is a real risk of significant harm. In Canada we keep a record of every breach for at least 24 months, whether or not it was reportable.

9. Your choices and rights

Wherever you live, you can:

• Access the information we hold about you.
• Correct information that is wrong or out of date.
• Delete your account and your information, subject to records we must keep for legal reasons.
• Export a copy of your information in a portable format.
• Withdraw consent at any time, including consent to marketing or to our handling of sensitive information. Withdrawing consent to essential processing may mean we can no longer provide the Services.
• Opt out of marketing using the unsubscribe link in any marketing email, or in your account settings. We will still send service messages such as booking confirmations.
• Complain to us, and to your privacy regulator.

To make a request: email hello@mybirthbridge.com or use the privacy controls in your account settings. We will verify your identity before acting, respond within 30 days, and tell you if we need more time and why. We do not charge for this and we will not treat you differently for asking.

Schedules A and B add rights depending on where you live.

10. Children and young people

You must be at least 18, or the age of majority where you live, to create a BirthBridge account and enter into a contract.

Expectant and new parents under that age exist, and they need support more than most. The age requirement is about who can enter a contract, not about who deserves care. A parent, guardian, or other trusted adult can hold the account and arrange care alongside you.

If we learn that someone under the contracting age has created their own account, here is what we do:

• We contact them before we do anything to the account.
• We look for a way to keep them supported, including helping an adult they trust take over the account.
• If there is no workable path, we restrict the account and delete the information rather than leaving a minor's pregnancy information sitting in a system they cannot consent to.
• We do not use their information for marketing, we do not use it for analytics, and we do not sell or share it. That is true of everyone's health-related information, and it is not negotiable for a minor's.

We do not direct the Services to children, and we do not knowingly collect information from a child under 13.

If you are under the contracting age and you need help, write to hello@mybirthbridge.com. You will not get a lecture.

11. Where your information is processed

BirthBridge processes and stores personal information in the United States.

If you are in Canada, this means your information is transferred to and stored in the United States, and while it is there it is subject to United States law, including lawful access by United States courts, law enforcement, and government authorities. This applies regardless of where you live. Schedule B explains what we do about this and what your options are.

We protect information we transfer through contractual commitments with our service providers and the safeguards described in Section 8.

12. Changes to this policy

We may update this policy. When we do, we will change the "Last Updated" date and post the new version here.

If a change is significant, meaning it materially affects how we use your information or reduces your rights, we will tell you directly by email or through the platform before it takes effect, and where the law requires your consent for the change, we will ask for it rather than assume it.

13. Contact and complaints

Privacy contact
BirthBridge, LLC
Texas, United States
hello@mybirthbridge.com

Security issues. If you believe you have found a security vulnerability, please contact hello@mybirthbridge.com. We will not pursue legal action against researchers who report in good faith and give us a reasonable chance to fix the issue.

If you are not satisfied with our response, you can complain to your regulator. Contact details for the regulators in your region are in the Schedules.

Schedule A. United States state privacy rights

This Schedule applies if you live in a US state with a comprehensive privacy law. As of the Last Updated date this includes California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, and others as they come into force. Rather than list every state and let the list go stale, we extend the following rights to residents of any state whose law provides them.

A1. Your rights

• Know and access. Learn what categories of personal information we collect, why, who we disclose it to, and get a copy of the specific information we hold.
• Correct inaccurate information.
• Delete personal information we hold about you, subject to legal exceptions.
• Portability. Receive your information in a portable, machine-readable format.
• Opt out of the sale or sharing of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects.
• Limit the use of sensitive personal information to what is necessary to provide the Services.
• Non-discrimination. We will not deny service, charge a different price, or provide a different quality of service because you exercised a privacy right.
• Appeal. If we refuse a request, you may appeal by replying to our decision. We will respond to the appeal within 45 days with a written explanation. If we deny the appeal, we will tell you how to complain to your Attorney General.

Authorized agents. You may use an authorized agent to make a request. We will ask for proof of authorization and may ask you to verify your identity directly.

A2. Categories collected in the last 12 months

We retain each category according to the schedule in Section 5.

A3. Sensitive information

We use sensitive personal information, including information relating to health, pregnancy, and the care you seek, only to provide the Services you asked for, to keep the platform secure, and where legally required. We do not use it to infer characteristics about you, we do not use it for targeted advertising, and we do not sell or share it. Your right to limit its use is therefore already reflected in how we operate.

Consent. Several state laws require your consent before sensitive personal information is processed at all. Where you type a due date, a birth preference, or the kind of support you are looking for into BirthBridge, you are giving us that information deliberately so that we can do the thing you asked for with it, and we use it for nothing else.

You can withdraw at any time — by deleting the information in your account settings, by asking us at hello@mybirthbridge.com, or by closing your account. We will act on it without asking you to justify it.

Notices we are not required to give. The Texas Data Privacy and Security Act requires a business that sells sensitive personal data to display the notice "NOTICE: We may sell your sensitive personal data," and a parallel notice for biometric data. We do not sell sensitive personal data, we do not collect biometric data, and we do not sell personal data at all, so neither notice is required. We state the conclusion here so that it is a documented position rather than an unexplained absence.

A4. Texas residents

BirthBridge is a Texas company, and the Texas Data Privacy and Security Act applies to businesses that operate in Texas without the revenue or volume threshold most other state privacy laws use. If you are a Texas resident:

• Every right in A1 is available to you, including access, correction, deletion, portability, and appeal.
• We respond to requests within 45 days, and to appeals within 60 days of the appeal. If we deny an appeal we will give you a way to complain to the Texas Attorney General.
• We recognise universal opt-out preference signals, including the Global Privacy Control, as required since January 1, 2025. See Section 7.
• Texas also has a separate health privacy law, the Texas Medical Records Privacy Act. Section 5.4 of our Health Information Policy explains how we treat it.

A5. Notice of Financial Incentive

We do not offer financial incentives in exchange for personal information.

A6. Shine the Light

California residents may request information about personal information disclosed to third parties for their direct marketing purposes. We do not make such disclosures.

Schedule B. Canada

This Schedule applies if you are in Canada. Where it differs from the main body of this policy, this Schedule controls.

BirthBridge is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and, depending on where you live, to provincial privacy legislation including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, Alberta's Personal Information Protection Act, and British Columbia's Personal Information Protection Act.

B1. Consent

We collect, use, and disclose your personal information with your knowledge and consent, except where the law allows or requires otherwise.

• Express consent is what we rely on for sensitive information, including information about health, pregnancy, and the care you are seeking. We ask for it separately and clearly, not by burying it in a general acceptance.
• Implied consent covers information you give us for an obvious purpose, such as giving us your email so we can send you a booking confirmation.
• You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. We will tell you what withdrawing consent means before you do it. If withdrawal means we cannot provide part of the Services, we will say so plainly rather than simply refusing.

We will not require you to consent to collection, use, or disclosure beyond what is necessary to provide the Services as a condition of using them.

B2. Cross-border transfer to the United States

Your personal information is stored and processed in the United States.

This is important and we want you to understand it rather than have it buried:

• While your information is in the United States, it is subject to United States law.
• United States courts, law enforcement, and government agencies may be able to obtain access to it through lawful process, and in some circumstances without notice to you.
• Canadian privacy law does not prevent this transfer, but it requires that we tell you about it, that we protect the information through contractual and other means, and that we remain accountable for it while a service provider holds it.

We remain responsible for your information when we transfer it to a service provider. We use contracts requiring comparable protection, and we apply the safeguards described in Section 8. Section 6.3 describes how we handle legal requests, including the heightened protection we apply to pregnancy and reproductive health information.

If you would prefer that your information not be stored in the United States, we cannot currently offer that, and you should not use the Services. We will update this section if that changes.

Questions about the transfer can go to our privacy team at hello@mybirthbridge.com. You may ask for information about our policies and practices relating to service providers outside Canada.

B3. Your rights in Canada

In addition to the rights in Section 9:

• Access. You may ask what personal information we hold about you, how we have used it, and to whom we have disclosed it. We will respond within 30 days. If we need more time we will tell you within 30 days, explain why, and give you a new date. If we refuse, we will tell you why and tell you how to complain.
• Correction. If information is inaccurate or incomplete, we will correct it, and where appropriate we will tell any third party who received the incorrect information.
• Withdrawal of consent. See B1.
• Complaint to us. Contact our privacy team. We will acknowledge within 5 business days and respond substantively within 30 days.
• Complaint to a regulator. You can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376, or to your provincial regulator. You do not have to complain to us first.

B4. Breach of security safeguards

If a breach creates a real risk of significant harm to you, we will:

• Report it to the Office of the Privacy Commissioner of Canada as soon as feasible.
• Notify you as soon as feasible, with enough information for you to understand the significance of the breach and to take steps to reduce or mitigate the harm.
• Notify any other organization or government institution that may be able to reduce the risk of harm.

We keep a record of every breach of security safeguards involving personal information, whether or not it created a real risk of significant harm, for at least 24 months, and we provide those records to the Commissioner on request.

B5. Quebec

If you are in Quebec, the following applies in addition.

Person in charge of the protection of personal information. This role is held by the person exercising the highest authority within BirthBridge, as Law 25 provides.

You can reach them at hello@mybirthbridge.com, or by mail at the address in Section 13. A request addressed to the person in charge of the protection of personal information will reach them.

Confidentiality by default. Any account or profile setting that affects who can see your information is set to the most private option by default. You choose to make information public. For families, your account and your requests are private and are shared only with the professional you contact. For professionals, your public profile is public by design because that is the point of a listing, and we will tell you clearly which fields are public before you complete it.

Express consent for sensitive information. Information about health, pregnancy, and the care you seek is sensitive. We ask for your express consent, separately from your acceptance of this policy, before we collect or use it, and we tell you the purpose at the time.

Tracking and profiling technology. Google Analytics and Google Tag Manager are deactivated by default. We ask before turning them on and you can turn them off at any time in cookie settings. We do not use any technology that profiles you for advertising, tracks you across other websites, or locates you precisely. Strictly necessary technology, such as what keeps you signed in, is not profiling technology and remains active.

If you would prefer to be excluded from our own measurement, described in Section 2 of the Cookie Policy, write to hello@mybirthbridge.com and we will exclude you.

Transfer outside Quebec. Before transferring personal information outside Quebec we conduct a privacy impact assessment considering the sensitivity of the information, the purpose of its use, the protections it would receive, and the legal framework of the destination.

Portability. You may ask us to communicate the computerized personal information you have given us to you, or to another person or organization you designate, in a structured, commonly used technological format.

De-indexing and cessation of dissemination. You may ask us to stop disseminating your personal information, or to de-index any link that gives access to it, where the dissemination contravenes the law or a court order, or where it causes you serious injury to reputation or privacy, the injury is clearly greater than the public interest in knowing the information, and stopping it would not exceed what is necessary to prevent the injury.

Automated decisions. If we ever make a decision about you based exclusively on automated processing, we will tell you at the time, and on request we will tell you the personal information used, the reasons and principal factors that led to the decision, and your right to have the information corrected. You may present your observations to a member of our staff who can review the decision. As described in Section 3.1, search ranking is not such a decision.

Complaints. You may complain to the Commission d'acces a l'information du Quebec at cai.gouv.qc.ca or 1-888-528-7741.

Language. You may contact us in French at hello@mybirthbridge.com, and you may exercise every right in this Schedule in French. We will respond in French. Where we publish a French version of this policy and there is any discrepancy between it and the English version, the French version prevails for residents of Quebec.

B6. Alberta

If you are in Alberta, we notify you, as required by the Personal Information Protection Act, that we use service providers located outside Canada, in the United States, to process personal information on our behalf. The categories of information and purposes are described in Sections 2, 3, and 6.2. You may contact our privacy team for information about our policies and practices with respect to those service providers, and about how to reach a person who can answer questions about them.

You may complain to the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca.

B7. British Columbia

You may complain to the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.

B8. Commercial electronic messages

We send commercial electronic messages to Canadian recipients only where we have your express or implied consent under Canada's Anti-Spam Legislation. Every commercial message identifies us, gives our contact information, and includes an unsubscribe mechanism that works for at least 60 days after the message is sent. We act on unsubscribe requests within 10 business days.

You can withdraw consent at any time using the unsubscribe link or by emailing hello@mybirthbridge.com.

B9. Health information in Canada

HIPAA is a United States law and does not apply in Canada. Health information in Canada is governed by provincial legislation, and the rules depend on whether your birth professional is a regulated health professional.

Our Health Information Policy explains this, including what applies when your provider is a registered midwife in Ontario (PHIPA), Alberta (Health Information Act), or another province, and what applies when your provider is a doula, lactation consultant, or childbirth educator who is not a regulated health professional.

B10. Accessibility

We aim to meet WCAG 2.1 Level AA. If you have difficulty accessing any part of the Services, or need this policy in an alternative format, contact hello@mybirthbridge.com and we will provide it and work with you to resolve the barrier.