INTESTINA

Your family’s privacy

In effect as of September 8, 2026.

Information in this version

The app stores child names or nicknames and birth dates; caregiver names and household membership; food and optional quantities; diaper observations; sleep times and awakenings; notes; consultation questions and professional instructions transcribed by the family. Saved records are stored locally and synchronized with the server. Initial preferences and unsaved consultation drafts stay on the device.

Photo copies stay on the device that took them. Requesting an automated reading sends the image through our API to the configured vision provider. Our database stores the resulting observation, not the image. Photos are not synchronized between caregivers.

The device keeps an access credential. Recovery requires a previously saved secret; the server stores its hash. There is no email, Apple or Google sign-in in this version. Contacts, location and microphone access are not requested.

Sharing and providers

Invited caregivers can view and edit records for every child in the household. Only the responsible caregiver manages invitations and access. Revocation prevents further access to household data on the server; it cannot recall exports or offline copies already downloaded.

Consultation PDFs and text are shared only when you choose a destination. A pediatrician receives nothing automatically. Automated vision uses Anthropic when configured; retention depends on the applicable contract and configuration. We make no zero-retention promise.

Advertising and data sales are not implemented. Production providers, regions, retention periods and contractual safeguards must be identified before this policy is published.

Corrections, deletion and recovery

You can edit and delete records. Pending changes stay on the device until synchronization; conflicting caregiver edits require an explicit choice. Deleted records carry a deletion marker so other devices can apply the change.

Family → Settings and privacy offers history export and account deletion. Deletion by the responsible caregiver removes the household from the server. Deletion by another caregiver removes their membership and their own household records. Access credentials and recovery are revoked. Local deletion is completed on the requesting device.

Recovery restores synchronized records only, using a secret saved beforehand. It does not restore local photos or unsent changes, and it revokes the old device. Keep the secret private: possession can permit account recovery.

Exports already delivered to others remain under their control. We cannot guarantee that every server backup disappears instantly.

Scope and contact

Adults are responsible for the child information they enter and the people they invite. The app is not designed for children to manage their own accounts. Logs and photos do not measure microbiota or establish diagnoses.

The project lists hola@intestina.app as its contact. The responsible legal entity, launch markets, consent for child data, providers and request-handling process must be confirmed before release.