MAMÁPrivacy Policy — MAMÁ
Last updated: 27 September 2026
MAMÁ is provided by Nordic Byte LTD, a company registered in England and Wales (company number 16978110), registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("Nordic Byte", "we", "us").
This policy explains what personal data we collect through the MAMÁ web app (https://panel.mama.suils.es) and mobile apps (Android/iOS), why, for how long, who we share it with, and what rights you have. If you are in the United Kingdom, this processing is governed by the UK GDPR and the Data Protection Act 2018. If you are in the European Union, the EU GDPR applies as well. These are similar but separate legal frameworks, with different supervisory authorities; we comply with both.
If anything here is unclear, contact us before using MAMÁ: info@nordicbyte.co.uk.
1. Who is responsible for your data
Nordic Byte LTD is the data controller for the personal data described in this policy: we decide why and how your data is processed. Some parts of MAMÁ are handled by outside companies acting as our processors (data processors under UK/EU GDPR) — see section 4. They only process your data on our documented instructions.
2. What we collect and why
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name/nickname, email, password (hashed), language, subscription status | Create and run your account, billing | Contract (performing the service you asked for) |
| Goals and tasks | Personal goals, to-dos, progress | Core app function | Contract |
| Emotional check-ins | Mood, anxiety level, sleep quality/duration, free-text notes | Core app function, personalising the AI's responses | Explicit consent (special category health data) |
| Symptoms | Physical symptoms you log | Core app function | Explicit consent (special category health data) |
| Medical profile | Allergies, medication, conditions | Core app function, safety of the AI's suggestions | Explicit consent (special category health data) |
| Mental health profile | PHQ-9, GAD-7 questionnaire answers and scores | Track and reflect mental wellbeing over time | Explicit consent (special category health data) |
| AI conversations | Messages you send to the AI advisor in any chat mode (emotional advisor, habit coach, health diary, general chat), and its replies | Provide the assistant, improve safety filters | Explicit consent (special category health data, since these conversations routinely contain health information) |
| Emergency contact | Name and phone number of a person you designate | Alert someone if our crisis-detection flags a risk to your safety | Vital interests of you or another person (Art. 6(1)(d) / Art. 9(2)(c) UK & EU GDPR) — this is the one exception where we may act without waiting for your explicit consent, because the point is to protect life |
| Technical/usage data | Device type, OS, crash logs, IP address, push/notification tokens | Keep the service running, security, debugging | Legitimate interest / contract |
| Payment data | Handled directly by Stripe; we only see your subscription status and the last 4 digits of your card, if shown by Stripe | Billing | Contract |
On "explicit consent": for the health-related data in the table above, we do not rely on you simply using the app. Before you can enter this data, MAMÁ asks you for a separate, clearly worded, opt-in confirmation naming the type of health data involved. You can withdraw this consent at any time from Settings; if you do, we stop processing new data of that kind and you can request deletion of what we already hold (section 8).
We do not use your health data to train any AI model, ours or our providers', and we do not sell your data to anyone.
3. The AI assistant, specifically
When you talk to MAMÁ in any chat mode (emotional advisor, habit coach, health diary or general chat), your messages are sent to OpenAI (through the OpenAI API) to generate a reply. OpenAI processes your messages as our processor, under its data processing addendum. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models, and OpenAI may keep it for up to 30 days to detect abuse before deleting it.
MAMÁ's AI is not a substitute for professional medical or psychological care. See the separate Medical Disclaimer, which is part of these terms.
4. Who we share data with (processors and recipients)
- Stripe — payment processing and subscription billing.
- OpenAI — generates the assistant's replies to your messages.
- Email — reminders and account emails are sent from our own mail server, hosted with the rest of our infrastructure (see next point). No third-party email service is involved.
- Our hosting provider — Hetzner Online GmbH, with our servers in a data centre in Finland (European Union).
Each of these acts as our data processor under a written agreement that limits what they can do with your data. We do not sell personal data to advertisers or data brokers.
We may also disclose data where required by law, to protect vital interests (see the emergency-contact case above), or to protect our rights, safety or property.
5. International data transfers
Nordic Byte LTD is a UK company; some of our processors may be based outside the UK and/or outside the EU (for example, a US-based AI provider). Where personal data moves:
- From the UK to elsewhere: we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision, as appropriate to the recipient.
- From the EU to elsewhere (for our EU users): we rely on the European Commission's Standard Contractual Clauses (SCCs), or an adequacy decision, as appropriate.
- Between the UK and the EU: the UK benefits from an EU adequacy decision for personal data transfers, and the UK recognises the EEA as adequate; we still name this transfer explicitly here because these are two separate legal regimes, even where the outcome is the same in practice.
Our servers and our mail server are in Finland (EU), so your stored data stays in the EEA. The transfers that do leave the EEA and the UK are the messages you send to the AI assistant, which OpenAI processes in the United States, and payment data handled by Stripe.
6. How long we keep your data
- Account and subscription data: for as long as your account is active, plus the period required for tax and accounting records under UK law (normally 6 years after the end of the relevant accounting period).
- Health-related data (check-ins, symptoms, medical/mental profile, AI conversations): for as long as your account is active. If you delete your account, this data is deleted within 30 days, except where we must keep a minimal record to comply with a legal obligation or to defend a legal claim.
- Emergency contact details: kept only while you have one configured; removed if you delete it or close your account.
- Technical/crash logs: typically retained for up to 12 months for debugging and security, then deleted or anonymised.
7. Security
We use encryption in transit (HTTPS/TLS) and access controls limiting who inside Nordic Byte can see your data. No system is 100% secure; if we become aware of a breach affecting your personal data, we will notify the relevant supervisory authority (ICO in the UK, and/or the competent EU authority) and, where required, you, within the timeframes the law sets.
8. Your rights
Under the UK GDPR and, where applicable, the EU GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"), including a self-service account deletion in the app.
- Restrict or object to certain processing.
- Data portability for data you provided to us.
- Withdraw consent at any time for anything based on consent (including all special category health data), without affecting processing carried out before the withdrawal.
- Complain to a supervisory authority:
- UK: the Information Commissioner's Office (ICO), ico.org.uk.
- EU: the data protection authority of your country of residence.
To exercise any of these rights, contact info@nordicbyte.co.uk. We will respond within one month, as required by law.
9. Children and minimum age
MAMÁ is intended for users 18 years of age or older. We do not knowingly collect data from children. If we learn that we have collected personal data from someone under 18, we will delete it.
10. Changes to this policy
We may update this policy as MAMÁ evolves. If we make material changes, we will notify you in the app or by email before they take effect, and — where the change affects special category health data — we will ask for your consent again.
11. Contact
Nordic Byte LTD — info@nordicbyte.co.uk 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom