Privacy notice

Seedpod is provided by Thrive Children Services Ltd ("Thrive", "we"), which is responsible for your information as the data controller.

You can contact us about anything in this notice by using Report a problem in the app, or by phoning Thrive on 01227 852666.

• Your account: your name, email address, your password (stored scrambled so nobody can read it) and, if you switch it on, your two-step sign-in setting.
• Each journal: the name of the person it's for, and anything added to it, such as their date of birth, support needs, emergency contact, allergies, medicines, weight and height, and diary entries about medicines, sleep, food, toileting, mood, health, milestones and notes.
• Who did what: who logged or corrected each entry and when, who has access to each journal, and a record of reports made (what was included, not the report itself).
• Problem reports you send us, with the page you were on and your phone or browser type.
• Technical information our hosting providers collect to run the service securely, such as IP addresses.

We use your information to provide the journal you've asked for. Our legal basis is that this is necessary to provide the service to you (UK GDPR Article 6(1)(b)).

Much of what goes into a journal is health information, which the law treats as special category data. We only store it with your explicit consent (Article 9(2)(a)), which you give when you create your account. You can withdraw it at any time by deleting the journal or your account.

We keep records of who did what, and use technical information, to keep Seedpod secure and to put things right if something goes wrong. This is in our legitimate interests (Article 6(1)(f)).

We don't sell your information, show you adverts, or use your journal entries to train or run artificial intelligence.

Only the people the journal's main owner (or a family admin) invites, and only as much as their role allows. For example, carers can only see the last 24 hours and the essentials.

Thrive staff do not read journals. Our technical team can reach the database to keep Seedpod running. We would only look at a journal's contents to fix a problem you've reported and asked us to look into, or where the law requires it, and we keep a record whenever we do.

We don't monitor what families write. If we ever became aware that a child or adult was at risk of serious harm, we may share information with the right authorities, as the law allows.

• Journal and account information is stored by Supabase in a London (UK) data centre, encrypted when stored and when sent.
• The Seedpod website is delivered by Cloudflare, whose servers may be outside the UK. Journal information passes through them on its way to you, encrypted, but is not stored there.
• Account emails (for example, confirming your address or resetting your password) are sent by an email provider that may be based in the United States, under the UK's approved safeguards for international transfers.

We keep your information while you use Seedpod. When a main owner deletes a journal, everything in it is deleted straight away.

When you delete your account, you have 14 days to change your mind and to download a complete record of your journals. After 14 days, your account and every journal only you use are deleted for good and can't be recovered. Entries you wrote in someone else's journal stay part of their record, shown as written by a deleted account.

Deleted information may remain in our providers' backups for a short time until those backups expire.

At the end of the pilot we'll tell you what happens next, and you'll be able to download your entries or have them deleted.

• See the information we hold about you, and get a copy.
• Correct information that's wrong (you can correct entries yourself).
• Delete it: delete a journal you own, or delete your account from your Account page (final after 14 days).
• Take it with you: download entries as a spreadsheet from any report.
• Withdraw your consent at any time, by deleting the journal or your account.
• Object to how we use your information.

To ask about any of these, contact us as above. We'll reply within one month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Most journals are about someone else, often a child. Only start a journal if you're their parent or guardian, or you're responsible for their care and have the right to record this information.

If the person is old enough to understand and make their own decisions, talk to them about the journal, and stop or delete it if they don't want it.

Every request is checked by the database's own access rules, so people only reach the journals they've been invited to. You can switch on two-step sign-in from your Account page, and Seedpod signs you out after four hours without use.

If something went wrong that put your information at risk, we'd tell you, and report it to the Information Commissioner's Office where the law requires.

If we make changes that affect what you've agreed to, we'll tell you in the app and ask you to agree again.