In short: to use Nanalu you create an account with just your email, no password. What you record (your due date, the baby chest, tasks and notes) is kept on your phone and in a protected copy in your account, so nothing is lost when you change phones. No ads, no tracking and no data sales. You can export everything and delete your account, with all its data, at any time in the app.
1. Who we are
Nanalu is an app by MedUnity (MEDUNITY LTDA - ME, CNPJ 59.158.563/0001-55, R 63 S/N, Quadra 65, Etn Itaguaí, Caldas Novas/GO, CEP 75682-106, Brazil), a Brazilian digital health company, which is the controller of the personal data processed in the app. The physician responsible for the content is Dr. Wilson Nunes Neto (CRM-SP 263817, Brazil). This policy covers the Nanalu app for Android and iOS and the nanalu.app website. It follows Brazil’s General Data Protection Law (LGPD) and, for people in the European Economic Area, the United Kingdom and Switzerland, the GDPR (section 9).
2. What data we process
| Data | Where it comes from |
|---|---|
| Email address | You provide it to create your account and sign in (with a one-time code, no password). |
| Record of your consents (date and version of the terms and this policy) and whether you want news by email | Created when you accept, at sign-up. |
| What you want to be called (first name or nickname, optional) and what you want to follow first | You tell the app at the start or in Family. |
| Due date (optional), whether this is your first baby (optional) and end of pregnancy (birth, loss or other reason, and date of birth) | You record it in the app. |
| Answers about your home (babies, laundry, weather, nappies), baby chest items and what arrived | You record it in the app. |
| Tasks, appointments, reminders and notes | You record it in the app. |
| Technical sign-in records (date, time, IP address and type of device or browser) | Created automatically when you sign in and open the app. |
| Device preferences (appearance, reminders, language and country) | Stay on your phone only; they are not sent to your account. |
Your name is optional and only used in the app’s greeting. The app does not ask for your surname, phone number, ID numbers, location, photos, contacts, camera or microphone.
3. Why we use it
- To create and keep your account, and store and sync what you record across your devices.
- To send your sign-in code and important notices about your account or these terms.
- To send Nanalu news by email, only if you tick that option. You can opt out at any time by email.
- To keep sign-in records, as required by Brazilian law, and to protect your account.
We do not use your data for advertising, consumer profiling or automated decisions.
4. Health data
Pregnancy information is sensitive health data. We ask for your specific, separate consent at sign-up, and we only use it to make the app work for you. It is never sold, never used for ads and never shared with family members, employers, insurers or anyone else. You can withdraw your consent at any time by deleting your account.
Reminders are discreet by default: the lock screen only shows “Nanalu”. You can change this in Family › Reminders.
5. Where your data is stored and who we share it with
The app saves everything on your phone first, so it works offline. When you are online, it syncs a copy with your account, in a database hosted by Supabase in São Paulo, Brazil. We use only the service providers needed to run the app, acting on our instructions:
- Supabase: database, accounts and sending the sign-in code (data stored in São Paulo, Brazil; Supabase is a US company).
- Hostinger: email delivery for the sign-in code.
- Cloudflare: hosting of this website.
- Google Play and the App Store: installing and updating the app, under their own policies.
We never sell or rent data. We disclose data to authorities only when the law requires it.
6. How long we keep it
- Account data and what you record: while your account exists. When you delete your account, it is removed from the database immediately; automatic database backups are overwritten within 7 days.
- Sign-in records: 12 months, then deleted automatically (Brazilian law requires at least 6 months, even after the account is deleted).
- On your phone: until you sign out, delete your account or uninstall the app.
7. Your rights
- Access and correct: everything you recorded can be seen and edited in the app.
- Take it with you: in Family › Your account, tap “Export everything” (.json) or “Chest as spreadsheet” (.csv).
- Delete your account and all data: in Family › Your account, tap “Delete my account”. If you can’t access the app, email [email protected] from your account’s email address and we will delete it within 15 days.
For any other request, contact our data protection officer at [email protected].
8. Security
- All communication between the app and the server is encrypted (HTTPS), and the database is encrypted at rest by the provider.
- Each account can only read and change its own data. This rule lives in the database itself (row-level security) and is tested.
- Team access to the database is restricted to the people who operate the app and is not used to read your content, except to handle a support request from you.
- There is no password to leak: you sign in with a one-time code sent to your email.
If a security incident could put you at risk, we will tell you and the competent authorities, as the law requires.
9. If you are in the EEA, the UK or Switzerland (GDPR)
The GDPR also applies to you. Our legal bases are:
- performance of the contract for your account and the app’s functions (Art. 6(1)(b));
- your explicit consent for health data (Art. 9(2)(a)) and for news emails (Art. 6(1)(a));
- legal obligation and legitimate interest in security for sign-in records (Art. 6(1)(c) and (f)).
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent at any time, without affecting earlier processing. You can also lodge a complaint with your local data protection authority. Your data is stored in Brazil; transfers rely on safeguards recognised by the GDPR, such as standard contractual clauses with our providers, or on an adequacy decision where one applies.
10. Permissions on your phone
- Internet: to sign in and sync your data.
- Notifications (optional): only for the reminders you create and the new-week reminder, if you turn it on.
- File sharing: only when you tap “Export”.
- Opening links and calling: sources open in the browser and the emergency button opens the dialler, always after you tap.
11. Children
Nanalu is for people aged 18 or over who are pregnant or caring for a baby. Information about the baby is recorded by the responsible adult, in their own account.
12. This website
nanalu.app uses no cookies, forms, analytics or third-party fonts or scripts. Like any website, the host (Cloudflare) logs technical access data, such as IP address and browser, for a limited time for security. The “Notify me” button only opens your email app with a ready-made message; if you send it, we use your address only to reply and to tell you when the app is out.
13. Changes
If this policy changes, we will publish the new version here with the new date. Important changes will be announced in the app and, when the law requires, will need your new consent.
14. Contact
MedUnity — MEDUNITY LTDA - ME, CNPJ 59.158.563/0001-55.
R 63 S/N, Quadra 65, Etn Itaguaí, Caldas Novas/GO, CEP 75682-106, Brazil.
Data protection, privacy and support: [email protected].