Fraya Consumer Health Data Privacy Policy
Effective October 23, 2026.
1. Who this policy is for
This policy applies to you if you are a resident of Washington or Nevada, or if your consumer health data is collected in Washington or Nevada, and you use the Fraya app. It describes only consumer health data: personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status, or the health status of a child whose care you record in Fraya. Everything else is covered by the Fraya Privacy Policy at fraya.app/privacy.
Fraya is operated by Fraya LLC, an Illinois limited liability company, called "Fraya", "we" and "us" below. We are the regulated entity responsible for the consumer health data described here.
Where this policy refers to a child, it means a child whose feeding, sleep, diapers, solids, milestones, photos or notes a caregiver records in the app. We treat that child as a consumer under these laws, and a parent or legal guardian exercises the child's rights on the child's behalf.
2. Consumer health data we collect, and why
We collect consumer health data only when you, or another caregiver in your family, type or select it in the app. Every category below is collected and used for the same three purposes:
- Providing the tracking service to your family. Storing the entries you record and showing them back to you and to the other caregivers in your family.
- Generating summaries and the doctor report on your device. Today's Progress, Advanced Insights, reminder nudges and the doctor report PDF are computed on your device from the entries you have recorded. These summaries are not stored or transmitted by us. The PDF leaves your device only to the destination you choose when you share it.
- Synchronizing your family's records. Copying the entries to our cloud database so that they appear on your other devices and on the devices of the other caregivers in your family.
We do not use consumer health data for advertising, marketing, profiling, or any inference about you other than the on-device summaries described above.
2.1 Health data about the child
| Category | What it contains |
|---|---|
| Feeding records | Bottle feeds: volume and unit, duration, milk type (breast, formula, mixed, donor or other) and a free-text milk-type note. Nursing sessions: side and durations. |
| Solids records | Foods given, amount, preparation method, whether the food is an allergen and which type (dairy, egg, peanut, tree nut, wheat, soy, fish, shellfish or sesame), whether a reaction occurred, its severity (mild, moderate or severe) and free-text reaction notes. Custom foods your family defines: name, category, allergen flag and type, and an optional photo. |
| Sleep records | Night sleep or nap, start time, end time and duration. |
| Diaper records | Diaper type, whether it was a blowout, wet and dirty amounts, stool color (including red), stool consistency and whether a rash was present. |
| Play and Care records | Tummy time and other activities, with duration and activity type. |
| Developmental milestones | For each CDC milestone, its status (achieved, not yet or skipped), the date it occurred and any notes. |
| Child profile | Name, date of birth, sex (male, female, other or prefer not to say) and an optional profile photo. The name and date of birth are not health status on their own, but they are linked to every record above. |
| Memories | Photos of the child and notes, each with a title and description. |
| Free-text notes | Notes attached to nursing, pumping, Play and Care, sleep and solids entries. |
| Who logged each entry | The account identifier of the caregiver who recorded the entry, which the doctor report can print as a caregiver name. |
2.2 Health data about you, the caregiver
| Category | What it contains |
|---|---|
| Breastfeeding sessions | Side, durations and any notes. |
| Pumping sessions | Amount expressed, duration, side, pump type, per-side amounts and any notes. |
2.3 Data derived from the above
Today's Progress, Advanced Insights and reminder nudges are calculated on your device from the records above and are not stored or sent to us. The doctor report PDF (child's name, date of birth and age, the date range, daily feeds, sleep, diapers and solids, allergen reactions and, optionally, caregiver names) is rendered on your device, handed to the sharing destination you pick, and then deleted from the device.
3. Where consumer health data comes from
We obtain consumer health data from two sources only:
- You, when you type or select entries in the app, and when you choose photos from your device.
- The other caregivers in your family, when they record entries about the same child.
We do not obtain consumer health data from data brokers, health providers, wearables, connected devices, other apps, or public records.
4. Why we collect and share it
Recording your baby's care is the service you ask us for when you create an account and add a baby, and we collect consumer health data only as far as that service needs. Showing the log to the caregivers in your family is part of the same service: you choose who is in your family when you invite them or accept an invitation, and the app tells you what they will see before you do. The service providers in section 5 run the service for us. We do not collect consumer health data beyond what is necessary to provide the service you have asked for.
5. Consumer health data we share, and with whom
5.1 Categories shared
Every category listed in section 2 is disclosed to the service providers in section 5.2 and to the other caregivers in your family (section 5.3), because that is what synchronizing and sharing your family's records requires. No category of consumer health data is disclosed to anyone else.
5.2 Service providers acting on our instructions
The following service providers process consumer health data, or identifiers linked to it, on our behalf under a written contract. They may not use it for their own purposes.
| Service provider | What it receives | Why | How to contact it |
|---|---|---|---|
| Microsoft Azure (Central US region, United States) | The database that holds every category in section 2 (the full tracking log, child profiles, the storage paths of photos, family membership records and subscription status). Separately, diagnostic logs that hold identifiers (your user ID, family ID, child ID, entry ID, a device ID and a masked form of your email) but never the content of entries or notes; kept 30 days. | Cloud database and application logs | https://go.microsoft.com/fwlink/?linkid=2126612 |
| Supabase (United States, Amazon Web Services US East region) | Sign-in data (your email address, password in hashed form, display name and, if you sign in with Google or Apple, the identity token they issue) and photo storage (the child's photos; each stored photo's path contains the uploading caregiver's user ID and the child's ID). Supabase receives no tracking entries. | Sign-in and photo storage | privacy@supabase.com |
| Sentry (United States; crash reports kept up to 90 days) | Crash reports from the app, containing device model, operating system, app version and a trail of recent app activity. The trail can contain identifiers (family, child and entry IDs, and photo storage paths, which include the uploading caregiver's user ID). It does not contain the content of entries or notes. | Crash reporting | compliance@sentry.io |
| RevenueCat | Your user ID, used as the subscriber identifier, and the purchase information its software collects to manage your subscription. RevenueCat receives no consumer health data. | Subscription management | compliance@revenuecat.com |
| Apple and Google | Only the identity used to sign you in. They receive no consumer health data. | Sign-in identity | Apple and Google privacy pages |
5.3 The other caregivers in your family
When you join a family in Fraya, or invite another caregiver into yours, every caregiver in that family can see every category in section 2 for every child in the family, including entries recorded before they joined, every photo, and the display name and email address of each caregiver. Caregivers join only by invitation from the family's owner and by entering an invitation code. Section 4 explains why this sharing is part of the service. You can see who is in your family at any time in the Caregivers screen.
5.4 Disclosures you make yourself
When you share the doctor report PDF, or any screen, from your device, the recipient you choose receives whatever it contains. That disclosure is made by you, not by us.
5.5 Affiliates
We have no affiliates and share consumer health data with none.
5.6 Sale
We do not sell consumer health data. We will not sell it without first obtaining your separate, valid written authorization as the law requires.
6. Your rights and how to exercise them
You have the right to:
- Confirm whether we are collecting, sharing or selling consumer health data about you, and to access that data.
- Receive a list of all third parties and affiliates with whom we have shared or sold your consumer health data, with a way to contact each of them. Section 5.2 is that list of service providers; the caregivers in your family are shown in the app's Caregivers screen.
- Withdraw your consent to our collection and sharing of your consumer health data, by emailing us or by deleting your account in the app. Because the log is the service, withdrawing means we delete your consumer health data as in item 4.
- Have your consumer health data deleted. If you own your family, deleting your account in the app (Profile, Delete account) deletes the family's log for everyone, immediately. If you are a caregiver in someone else's family, deleting your account removes your login and membership, but entries you logged, including your own breastfeeding and pumping entries, stay in that family's log; email us if you want those deleted as well. See the Privacy Policy for exactly what account deletion does. When we delete at your request, we also tell the service providers in section 5.2 to delete their copies. Copies in our backups are removed when those backups expire, and in any case within six months of your request. Our backups expire within 30 days.
To exercise any of these rights, email support@fraya.app from the email address attached to your Fraya account. We will verify that the request comes from you or from someone authorized to act for you before we act on it. We cannot require you to create a new account to make a request.
We will respond without undue delay and in any case within 45 days of receiving your request. If reasonably necessary, we may extend that period once by a further 45 days, and we will tell you within the first 45 days if we do so and why. You may make a request free of charge up to twice in any 12-month period.
Appeals
If we decline to act on your request, we will tell you why and how to appeal. To appeal, email support@fraya.app with "Appeal" in the subject line. We will respond in writing within 45 days with the reasons for our decision. If we deny your appeal, our response will tell you how to submit a complaint to the Attorney General of your state:
- Washington: https://www.atg.wa.gov/file-complaint
- Nevada: https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/
7. Changes to this policy
If we change this policy, we will post the new version with a new effective date at https://fraya.app/privacy/health and, where the law requires, ask for your consent again before collecting new categories of consumer health data or using it for a new purpose.