Privacy Policy

1. Who we are

BabyCare AI (the Service) is operated by Gorillaz Group, Tel Aviv, Israel (WeWork Midtown, Tel Aviv). Gorillaz Group is the database owner and the controller of the personal information processed through the Service (we, us, our).

• Email: support@grlz.co.il — for privacy matters, please use the subject line Privacy;
• Phone / WhatsApp: +972-50-907-5907.

2. Scope of this policy

This policy applies to the BabyCare AI web app — whether used in a browser or installed as an app (PWA) on a phone, tablet or computer — and to your communications with us about the Service. It forms part of the Terms of Use. Information about cookies and data stored on your device is set out in the Cookie & Local Storage Policy, and the medical limitations of the Service are described in the Medical Disclaimer.

The Service works in two modes:

• Guest mode — without an account, everything you enter is stored only in your browser (localStorage) on your device and is not sent to our server, except when you actively use the online features described below;
• Account mode — your data is synced to our server so that family members you invite can see and update it.

3. What information we collect

We collect only information you provide yourself or that is technically necessary to run the Service:

4. Legal basis and voluntary provision (section 11 notice)

In accordance with section 11 of the Privacy Protection Law, 5741-1981, we inform you that:

• You are under no legal obligation to provide any information. Providing information depends on your free will and consent. However, without certain information (for example, an email and password for an account, or a child's birth date for age-based content) some features will not work;
• The information is used for the purposes described in this policy — mainly to provide the features you request, sync data within your family, secure the Service and contact you about your account;
• The information may be transferred to the recipients listed in the Third parties section, including OpenAI in the USA when you use AI features, and to family members you invite.

We process information on the basis of your consent — given when you register, enter information and enable specific features (AI, maps, notifications, microphone, camera) — and to the extent necessary to provide the Service you requested and to comply with the law. You may withdraw your consent at any time by stopping use of a feature, changing settings or deleting your account. Withdrawal does not affect processing carried out before it.

5. How we use information

• To provide the features: day tracker, WHO growth percentiles, the Israeli Ministry of Health vaccine calendar, the fever and medicine dose helper, the medical record, sleep sounds, reminders and more;
• To sync data between devices and members of a family account;
• To answer AI questions, analyse photos, translate and recognise documents — only when you use these features;
• To deliver the reminders and notifications you enabled;
• To run the community chat;
• For security: preventing abuse, rate-limiting login attempts and protecting accounts;
• To respond to your inquiries and to comply with the law.

We do not use your information for advertising, do not sell or rent it, and do not build marketing profiles. We currently do not use analytics or advertising cookies.

6. Health information

Information about your child's health — allergies, blood type, symptoms, illnesses, hospital stays, vaccines, growth measurements and medical documents — is especially sensitive information under the Privacy Protection Law as amended by Amendment 13. We handle it accordingly:

• It is used only to provide the features you use and is visible only to members of your family account;
• In guest mode it stays on your device; in account mode it is stored on our server, with access limited to your family;
• Only a short child context (age, sex, weight, allergies, blood type, a brief summary of a recent illness) is attached to AI requests — without name or email;
• Do not post health details in the community chat — messages there are visible to other users.

The Service is not a medical device and does not replace a doctor. See the Medical Disclaimer.

7. AI processing and transfer of data abroad

When you ask a question, translate, check a photo (for example, of a rash or a toy) or scan a hospital discharge letter online, the text or image you submit and a short child context (age, sex, weight, allergies, blood type, a brief summary of a recent illness — without name or email) are sent through our server to OpenAI, L.L.C. (USA) for processing, and the answer is returned to you.

• Under OpenAI's API terms, data sent through the API is not used to train models by default and is retained by OpenAI for up to 30 days for abuse monitoring;
• This is a transfer of information to a database outside Israel, carried out in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001;
• You can avoid this transfer by not using AI features. The offline knowledge base works without sending anything;
• If AI scanning is unavailable, text recognition (OCR) runs locally in your browser using Tesseract.js. The image is not uploaded anywhere; only the script and language files are downloaded from the jsDelivr CDN, which exposes your IP address to the CDN;
• Cry analysis runs on your device; the audio is not uploaded.

AI answers may be inaccurate and are not medical advice.

8. Third parties

We share information only to the extent needed for the functions below, or with family members you invite. We do not sell information. We may disclose information if required by law or by a competent authority.

Third-party services process information under their own privacy policies.

9. Cookies and local storage

We use one essential session cookie (bcsid), a cookie that remembers your consent choice (bc_consent), browser localStorage for your in-app data and a Service Worker cache for offline use. Optional third-party services (Google Maps, jsDelivr) load only after consent or an explicit action by you. Details: Cookie & Local Storage Policy.

10. Retention

• Account data — while the account is active. When you delete your account (Account → Delete account), your user is deleted immediately from the live database; if you are the last family member, the family, children, records and documents are deleted as well. If other members remain in the family, the shared family data stays available to them. Backups, if any, rotate within 30 days;
• Guest data — on your device until you erase it (Cookie settings → Erase data on this device) or clear your browser data;
• Login-attempt IP addresses — up to 15 minutes;
• Community chat messages — may be retained until removed on request;
• Push subscriptions and reminders — until you turn off notifications or the subscription expires;
• Data held by OpenAI — up to 30 days under its API terms.

11. Security

We protect information in accordance with the Privacy Protection (Data Security) Regulations, 5777-2017, including:

• HTTPS encryption in transit;
• Passwords stored only as a salted hash (bcrypt / Argon2), never in plain text;
• A session cookie with the HttpOnly and SameSite=Lax flags;
• CSRF protection using a dedicated request header;
• Rate limiting of login attempts;
• A server data folder that is not publicly accessible;
• Access to family data limited to members of that family.

No system is 100% secure. In the event of a serious security incident, we will notify the Privacy Protection Authority and affected users as required by law. Please protect your password and your device: in guest mode, anyone with access to your unlocked device can see the data stored on it.

12. Your rights and how to exercise them

Under sections 13-14 of the Privacy Protection Law, 5741-1981, and Amendment 13 (in force since 14 August 2025), you may:

• review the information about you held in the database;
• request correction of information that is incorrect, incomplete, unclear or outdated;
• request deletion of information;
• withdraw consent for optional features.

In-app tools:

• Account → Download my data — an export of your data in JSON format;
• Account → Delete account — immediate deletion as described in the Retention section;
• Cookie settings → Erase data on this device — erases the data stored in your browser.

You can also send a request to support@grlz.co.il with the subject Privacy. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

13. Children

The Service is intended for adults (18+) — parents and legal guardians — who enter information about their own children. Children do not use the Service themselves and must not open an account.

By entering information about a child or about another family member (for example, the other parent), you confirm that you are entitled to do so. A family member joins only with the family invite code and gets access to all shared family data.

14. Notifications and device permissions

Notifications. If you enable them, your browser creates a push subscription — an address at the Google (FCM), Apple or Mozilla push service plus encryption keys. We store it together with the scheduled reminder times and texts in order to deliver your reminders. The content is end-to-end encrypted to your device under the Web Push standard. You can turn notifications off at any time in the app or in your browser settings.

• The microphone (cry analysis, voice input) and the camera are used only after you grant browser permission. Cry audio is analysed on your device and is not uploaded. Voice dictation uses the browser's speech recognition and may be processed by the browser vendor (for example, Google or Apple);
• Location is requested only when you tap to find nearby hospitals or pharmacies, and is passed to Google Maps;
• You can revoke any permission in your browser or device settings.

15. Changes to this policy

We may update this policy. The new version will be published on this page with a new date, and material changes will be announced in the app. We recommend reviewing this page from time to time.

16. Contact and complaints

• Privacy questions and requests: support@grlz.co.il, subject line Privacy;
• Phone / WhatsApp: +972-50-907-5907;
• Address: Gorillaz Group, WeWork Midtown, Tel Aviv, Israel.

If you are not satisfied with our response, you may file a complaint with the Privacy Protection Authority: gov.il.

This policy is governed by the laws of the State of Israel.