Stern & Signal LabsBumpAI Privacy Policy
Effective date: 1 November 2026
Last updated: 9 November 2026 (app use minutes and the staff console).
1. Who this policy covers
BumpAI is a pregnancy companion app offered by STERN & SIGNAL LABS LIMITED, a private company limited by shares registered in Nigeria (RC 9575107) ("Stern and Signal Labs"). This policy explains what BumpAI collects, why, who can see it, how long it is kept and the choices each user has. It applies to the BumpAI apps for Android and iPhone and the services behind them.
BumpAI is not a healthcare provider and is not a covered entity or business associate under HIPAA. Health information a user brings into BumpAI is protected by this policy, by applicable state consumer health data laws and by the FTC Health Breach Notification Rule, rather than by HIPAA.
BumpAI is for adults aged 18 and over. It is not directed to children, and Stern and Signal Labs does not knowingly collect information from anyone under 18.
2. What BumpAI collects
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Email address, sign in method, name | The user |
| Pregnancy and profile | Due date, pregnancy history, preferences, care team, emergency number | The user, and her patient portal if she connects one |
| Health records and logs | Check ins, symptoms, blood pressure, glucose, weight, sleep, kicks, food and supplements, medicines, lab results, visit notes she adds | The user, and connected sources |
| Connected sources | Health Connect, wearables (for example Oura, Fitbit), calendar events, patient portal records (for example Epic MyChart, Oracle Health) | Only sources the user chooses to connect |
| Photos and documents | Bump photos, ultrasound images, insurance card images, documents she uploads | The user |
| Conversations | Messages with the companion and the replies it writes | The user and the companion |
| Approximate location | A location she enters or allows, to find nearby care | The user |
| Country | Her country, so the app can compare the baby's size to everyday foods from where she lives and show the units she uses | Her care team or patient portal address when she has connected one, otherwise her phone's SIM, mobile network, time zone and region settings. BumpAI does not use GPS or precise location for this, and she can change it in Settings |
| App use | Minutes the app is open and in use each day, the main screen that is open (for example Chat or Home), the app version and the time zone offset. BumpAI records the screen name only | The device |
| Device | Push notification token, app version | The device |
BumpAI measures app use with its own service, as described in the row above. It has no advertising identifiers, third party analytics SDKs or tracking pixels.
Sensitive health information from patient portals
When a user connects a patient portal, records with a sensitive privacy label, or in the mental health, HIV and sexually transmitted infection, genetic testing or substance use groups, are not imported unless she turns that group on. Free text clinical notes are off by default. Routine prenatal screening results import by default.
3. How BumpAI uses information
Information is used only to provide BumpAI to the user who supplied it:
- to show her records, trends and lab results, and to keep her profile up to date;
- to let the companion answer her questions and send the reminders and check ins she has turned on;
- to find nearby care when she asks;
- to compare the baby's size to everyday foods from her country and show measurements in the units she uses;
- to keep the service secure, prevent abuse and fix problems;
- to see how BumpAI is used overall, as counts and totals across many users, so it can be improved and its running costs kept in check;
- to meet legal obligations.
Stern and Signal Labs does not sell personal information, does not share it for advertising, does not use it for advertising, and uses it only to provide BumpAI to the user and, as totals across many users, to run and improve the service.
4. Who can access information
| Who | What and why |
|---|---|
| The user | Everything about her, at any time |
| People she authorizes | A partner she invites sees only what she chooses to share, and she can stop sharing at any time. Size comparisons a partner sees follow the partner's own country |
| Stern and Signal Labs staff | A small team uses an internal console that shows counts and totals by country. Support staff can see a summary of one account under a coded id, with no name, email or messages, to help her. A clinical safety reviewer can open the risk alerts of one account to check the app's safety rules, records a reason each time, and every such access is logged. Each person reaches only what their role needs. Staff may also access data to operate and secure the service, or when the law requires it |
| Service providers | Companies that process data on Stern and Signal Labs' behalf under contract, only to run BumpAI: Anthropic (AI model that writes companion replies, used only after the user accepts the AI consent), Supabase (database), Render (hosting), Google Firebase Cloud Messaging and Apple Push Notification service (push delivery), Resend (email delivery), Geoapify and OpenStreetMap (nearby care search, receiving the area searched, not health data) |
| Sources she connects | Her portal, wearable or calendar provider receives the request she authorizes |
| Legal requests | Where required by law, or to protect the rights, safety or property of users, the public or Stern and Signal Labs |
| A business transfer | If Stern and Signal Labs is involved in a merger, acquisition or sale of assets, information may transfer under this policy, and users will be told before it becomes subject to a different policy |
Users authorize this access generally by using BumpAI and the permissions inside it; they are not notified each time data is accessed.
5. Where data is stored and how it is protected
Data is stored on servers in the United States (Supabase, us-east-1; Render, Virginia). It is encrypted in transit. Patient portal access tokens are encrypted before storage, and the app keeps its sign in session in Android Keystore on Android and in the Keychain on iPhone. Access is restricted by row level security so each account can reach only its own records. No system is perfectly secure; if a breach affects a user's information, Stern and Signal Labs will notify affected users and regulators as the law requires.
6. How long data is kept
Data is kept as long as the account is open. Items a user removes are deleted after 30 days. Minute by minute app use records are deleted after 35 days; daily totals are kept while the account is open. When a user deletes her account, her data is erased; an anonymous monthly total of AI processing cost and an anonymous daily total of minutes in the app, with no link to any user, are kept. Daily database backups are kept for 7 days, so erased data leaves the backups within 7 days.
Deleting the app from the phone does not delete the account; use Settings › Delete account & data.
7. Choices and rights
Every user can, inside the app:
- download a complete copy of her data (Settings › Export my data);
- correct her profile and records, including the country the app uses for size comparisons;
- delete individual items, disconnect any source, and delete her account and all its data;
- turn sensitive record groups, the AI companion, reminders and partner sharing on or off.
Depending on where she lives (for example California, Washington, Nevada, Connecticut, Colorado or Virginia), she may have additional rights to know, access, delete, correct, or withdraw consent for the collection and sharing of consumer health data, and to appeal a decision. Requests: [email protected]. Stern and Signal Labs will verify the request, respond within the time the law allows and not discriminate against anyone for exercising these rights.
8. Consumer health data notice (Washington, Nevada and similar laws)
Consumer health data BumpAI collects: the categories in section 2. Purposes: section 3. Sources: section 2. Shared with: section 4, and with no one else; it is not sold. Rights: section 7.
9. Changes
When this policy changes in a way that matters, the app will show the new version and its effective date before it applies. Material changes to how health data is used or shared will ask for consent where the law requires it.
10. Contact
STERN & SIGNAL LABS LIMITED (RC 9575107). Email: [email protected]