Legal

Bloomana Privacy Policy

A product of Guaico LLC · Charlotte, North Carolina

Effective date: August 3, 2026 · Last updated: August 3, 2026

This policy covers what we collect, how we use and share it, how long we keep it, how we protect it, and the privacy choices available to you. Section 2 explains which information is ours to answer for and which belongs to your practice.

Bloomana is practice-management software for birth workers, provided by Guaico LLC, a North Carolina limited liability company ("Bloomana," "we," "us," or "our"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, how we protect it, and the choices available to you.

This policy applies to bloomana.io, app.bloomana.io, our mobile applications, and related services (the "Service"). It is incorporated into and forms part of our Bloomana Terms of Service, available at https://bloomana.io/terms. Capitalized terms not defined here have the meanings given in the Terms.

This policy does not apply to the privacy practices of any third party, including Stripe, our AI providers, or any other service you connect. Those are governed by their own policies, which are linked in Section 8.

Bloomana processes information in two distinct roles.

As a business for our own account information. When you create an account, subscribe, or contact us, we act as the business or controller of that information and use it as described in this policy.

As a service provider for your practice data. Information you enter about your clients, their families, their appointments, their documents, and their care — "Client Information" — belongs to your practice. You are the business, controller, or covered entity with respect to that information. We process it on your behalf and on your instructions, to provide the Service to you.

YOU, NOT BLOOMANA, ARE RESPONSIBLE FOR: DECIDING WHAT INFORMATION TO PUT INTO THE SERVICE; PROVIDING YOUR OWN PRIVACY NOTICE TO YOUR CLIENTS; OBTAINING AND DOCUMENTING EVERY CONSENT, AUTHORIZATION, AND PERMISSION REQUIRED BY LAW OR BY YOUR PROFESSIONAL OBLIGATIONS BEFORE ENTERING, SHARING, RECORDING, OR TRANSMITTING INFORMATION ABOUT ANY PERSON; RESPONDING TO YOUR CLIENTS' PRIVACY REQUESTS; AND COMPLYING WITH ALL PRIVACY, HEALTH-RECORDS, RECORDING-CONSENT, AND DATA-PROTECTION LAWS THAT APPLY TO YOUR PRACTICE AND YOUR STATE.

If you are a client of a birth worker who uses Bloomana, your doula or practice — not Bloomana — controls your information. Please direct your privacy questions and requests to them. We will refer such requests to the relevant practice.

3.1Information you provide

• Account information: name, email address, phone number, password credentials, practice or business name, role, time zone, profile photo, and communication preferences.
• Practice information: practice settings, team members and seats, service offerings, rates, availability, templates, and business configuration.
• Client Information you enter: client and family names, contact details, addresses, due dates, birth details, appointment and visit records, notes, birth plans, preferences, and any other information you choose to record — which may include health-related information (see Section 7).
• Documents and forms: intake forms, contracts, consents, waivers, invoices, receipts, uploaded files, images, and electronic-signature records.
• Notes and AI-assisted summaries: where you use dictation or AI-assisted note features, the text of your note and the resulting summary. Dictation is converted to text on your own device — audio is not uploaded to or stored by Bloomana.
• Payment information: billing contact and plan details. Payment card details are collected and stored by Stripe, not by Bloomana. We receive subscription and transaction status from Stripe. Payment methods are managed in Stripe; we do not receive or store your card details.
• Communications: messages you send us, support requests, survey and feedback responses, and onboarding materials.

3.2Information collected automatically

• Usage information: features used, pages and screens viewed, actions taken, timestamps, and referring pages.
• Device and technical information: IP address, device and browser type, operating system, app version, device identifiers, language, crash logs, and diagnostic data.
• Approximate location: derived from IP address. Mileage records are entered manually by you; we do not track your location or collect trip data.
• Cookies and similar technologies: see Section 9.

3.3Information from others

We may receive information from your practice owner or administrator (when they invite you), from Stripe about subscription and payment status, from app stores about purchases, and from service providers that support security, error monitoring, and fraud prevention.

We use information to:

• create, authenticate, and maintain accounts and practices;
• provide, operate, personalize, and support the Service and its features;
• process subscriptions, invoices, and payments, and manage plans and seats;
• provide AI-assisted features you choose to use;
• communicate with you about your account, changes, security, and support;
• send product and marketing communications, from which you may opt out at any time;
• monitor, secure, troubleshoot, debug, and improve the Service and develop new features;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms; and
• comply with law, respond to lawful requests, and establish, exercise, or defend legal claims.

We process Client Information only to provide the Service to your practice, as permitted by our Terms, or as required by law.

Where you use AI-assisted features, text you submit may be sent to approved third-party AI service providers for processing and returned to you as output. Audio is not sent — where you dictate a note, speech is converted to text on your own device.

WE DO NOT USE YOUR CONTENT OR CLIENT INFORMATION TO TRAIN ARTIFICIAL-INTELLIGENCE MODELS. WE CONTRACTUALLY REQUIRE OUR AI PROVIDERS TO PROCESS YOUR CONTENT ONLY TO PROVIDE THE REQUESTED SERVICE AND NOT TO TRAIN THEIR MODELS ON IT.

AI output may be inaccurate or incomplete and must be reviewed by you before use. Before using any AI-assisted feature, you are responsible for reviewing your state's laws — including recording and consent laws — and for obtaining informed consent from your client, as required by Section 9 of the Terms. We do not obtain that consent for you and do not verify that you have obtained it.

We do not use AI to make automated decisions that produce legal or similarly significant effects about you or your clients.

• We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.
• We do not use your Client Information for our own marketing.
• We do not use Your Content to train AI models.
• We do not knowingly permit our service providers to use information for their own independent purposes.

BLOOMANA IS NOT HIPAA COMPLIANT. WE DO NOT REPRESENT OR WARRANT THAT THE SERVICE MEETS THE REQUIREMENTS OF THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT ("HIPAA"), AND WE DO NOT OFFER OR ENTER INTO BUSINESS ASSOCIATE AGREEMENTS. WE ARE NOT A COVERED ENTITY, BUSINESS ASSOCIATE, OR SUBCONTRACTOR UNDER HIPAA, AND NOTHING IN THIS POLICY, THE TERMS, THE SERVICE, OR ANY COMMUNICATION FROM US MAKES US ONE.

Information you record in Bloomana may relate to pregnancy, birth, postpartum recovery, lactation, mental health, or other sensitive topics. You alone decide whether to place such information into the Service. If you are subject to HIPAA, state health-privacy law, state medical-records law, reproductive- or maternal-health privacy law, or genetic- or biometric-privacy law, you are solely responsible for determining whether your use of the Service satisfies your obligations, and for the consequences if it does not. See Section 8 of the Terms of Service, which also sets out your indemnity and release to us for such information.

If you require a HIPAA-compliant system for particular records, you must maintain that system separately and not rely on Bloomana for it.

We share information only as described below. We do not sell it.

8.1Service providers

We use trusted third-party providers to operate the Service. Each processes information only as needed to provide its service to us and under contractual confidentiality and security obligations. Current categories and key providers include:

We link to each provider's home page rather than to a specific policy page, because providers move and rename those pages and a direct link would break. Each provider publishes its current terms and privacy policy on its own site. Providers may change from time to time; this list is kept current on this page.

WE ARE NOT RESPONSIBLE OR LIABLE FOR THE PRIVACY OR SECURITY PRACTICES OF ANY THIRD-PARTY PROVIDER, OR FOR ANY BREACH, LOSS, MISUSE, OUTAGE, OR ACT OR OMISSION OCCURRING AT OR THROUGH ONE. SEE SECTION 13 OF THE TERMS OF SERVICE.

8.2Within your practice

Practice owners, administrators, and users you invite can access practice data according to the roles and permissions the practice owner sets. Practice owners control that access and may add or remove users at any time.

8.3At your direction

We share information when you direct us to — for example, when you send a form, contract, or invoice to a client, connect a Stripe account, or enable an integration.

8.4Legal and safety

We may disclose information if we believe in good faith that it is required by law, subpoena, court order, or other lawful process, or that it is reasonably necessary to enforce our Terms, investigate fraud or a security incident, protect the rights, property, or safety of any person, or respond to an emergency.

8.5Business transfers

If Guaico LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy with comparable protections.

8.6Aggregated and de-identified information

We may create and use aggregated or de-identified information that cannot reasonably be used to identify you or any client. We will not attempt to re-identify it, and will require the same of recipients.

We use cookies and similar technologies that are strictly necessary to authenticate you, keep you signed in, remember preferences, maintain security, and understand how the Service is used. We do not use advertising cookies or third-party tracking for targeted advertising.

Most browsers let you block or delete cookies, but blocking necessary cookies will prevent the Service from working. We currently do not respond to browser "Do Not Track" signals, but we do honor recognized opt-out preference signals such as Global Privacy Control (GPC) where required by law — noting that we do not sell or share personal information in any event.

We use reasonable administrative, technical, and physical safeguards designed to protect information, including encryption in transit, encryption at rest with our infrastructure providers, access controls and role-based permissions, logging, and vendor review.

NO METHOD OF TRANSMISSION OR STORAGE IS COMPLETELY SECURE. WE CANNOT AND DO NOT GUARANTEE THE SECURITY OF ANY INFORMATION, AND WE DO NOT WARRANT THAT THE SERVICE WILL BE FREE FROM UNAUTHORIZED ACCESS, LOSS, OR CORRUPTION. YOU ARE RESPONSIBLE FOR SAFEGUARDING YOUR CREDENTIALS AND DEVICES, FOR MANAGING WHO IN YOUR PRACTICE HAS ACCESS, AND FOR DECIDING WHAT INFORMATION IS APPROPRIATE TO STORE IN THE SERVICE. SEE SECTIONS 15, 16, AND 19 OF THE TERMS OF SERVICE.

If we become aware of a security incident affecting your information, we will notify you as and to the extent required by applicable law. Where you are the controller or covered entity for the affected information, you are responsible for any notification to your clients, regulators, or others.

We retain information for as long as your account is active and afterward only as reasonably necessary to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, enforce our agreements, and maintain security.

Following termination, we may make Your Content available for export for up to 30 days upon written request, after which we may permanently delete it, subject to legal retention duties and limited routine backups that expire on our ordinary cycle. Some deletions you confirm within the Service are immediate and permanent.

YOU ARE RESPONSIBLE FOR MAINTAINING YOUR OWN COPIES OF ANY RECORDS YOU MUST RETAIN FOR PROFESSIONAL, TAX, INSURANCE, PAYER, OR LEGAL PURPOSES. TO REQUEST A COPY OF YOUR DATA, EMAIL HELLO@BLOOMANA.IO. BLOOMANA IS NOT YOUR SYSTEM OF RECORD OR ARCHIVE.

12.1Account choices

You can review and update your account and practice information in the Service, manage notification and marketing preferences, opt out of marketing email using the unsubscribe link, control team access as a practice owner, request a copy of your records by emailing hello@bloomana.io, and cancel your subscription at any time in account settings.

12.2State privacy rights

Depending on your state of residence, you may have the right to: confirm whether we process your personal information and access it; obtain a copy in a portable format; correct inaccuracies; request deletion; limit the use of sensitive personal information; and opt out of sale, targeted advertising, and certain profiling — noting that we do not sell personal information, do not share it for targeted advertising, and do not engage in profiling that produces legal or similarly significant effects. You have the right not to be discriminated against for exercising these rights, and you may designate an authorized agent to act for you.

To exercise a right, email hello@bloomana.io from the address on your account or with sufficient information for us to verify your identity. We will respond within the time required by applicable law. If we decline a request, you may appeal by replying to our response with the word "Appeal"; we will respond to appeals within the period your state's law requires and will tell you how to contact your state attorney general if you disagree.

If your request concerns Client Information held in a practice's account, we will refer it to that practice, which is the controller of that information and is responsible for responding.

12.3California

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we have not done so in the preceding 12 months. We do not knowingly collect personal information from anyone under 18. Categories of personal information we collect, our purposes, our disclosures, and our retention practices are described in Sections 3, 4, 8, and 11.

The Service is intended for use by professionals aged 18 and over and is not directed to children. We do not knowingly collect personal information directly from children. A practice may record information about an infant or minor as part of its own records; that information is controlled by the practice, and the practice is responsible for the legal basis, consent, and notice for it. If you believe a child has provided information to us directly, contact hello@bloomana.io and we will take appropriate action.

The Service is operated from and intended for use in the United States, and information is stored and processed in the United States. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law, and you understand that your information will be transferred to and processed in the United States.

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, for material changes, provide notice by email or through the Service before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance. The current version is always available at https://bloomana.io/privacy.

Related: Bloomana Terms of Service

Bloomana Privacy Policy — Effective August 3, 2026. Guaico LLC, Charlotte, North Carolina.