Privacy Policy

1. Who we are

Responsible party: Inverix IP (Pty) Ltd, registered in the Republic of South Africa.

Contact: info@littlesteps.africa

For POPIA-specific information and data-subject rights, see our POPIA notice.

2. Information we collect

• Account information: name, email address, authentication identifiers (including Apple or Google sign-in tokens where used), and language preferences.
• Baby and health data you enter: infant profile details, growth measurements, vaccination records, feeding and sleep logs, diaper changes, symptoms, milestones, photos you choose to upload, voice notes, and clinic summaries you generate.
• Caregiver and sharing data: invite codes, linked caregiver accounts, and permissions you grant to family members or helpers.
• Device and usage data: app version, device type, notification tokens, sync timestamps, and diagnostic logs needed to operate and secure the service.
• In-app purchase data: when you buy Little Steps+ through Apple or Google, we receive purchase and entitlement status from RevenueCat (our in-app purchase partner) to unlock features on your account. We do not receive your full payment card details — billing is handled by the app store.

We do not sell personal information. We do not use baby health data for advertising profiling.

3. How we use information

• Provide core tracking, reminders, exports, and backup features you request.
• Send vaccine and clinic reminders when you enable notifications.
• Sync data securely between your devices and our servers.
• Improve reliability, security, and support.
• Comply with law and respond to valid legal requests.

Health-related processing requires your explicit consent during onboarding. You may withdraw consent in Settings; withdrawal limits future processing but does not erase data already shared with your clinic at your direction.

4. Legal bases

• Consent: processing of special personal information (health data) under POPIA and similar laws.
• Contract: providing the app and account features you sign up for.
• Legitimate interests: fraud prevention, security monitoring, and service improvement, balanced against your rights.

5. Sharing and disclosure

We may share information only in these situations:

• With caregivers you invite: according to the access you grant inside the app.
• Service providers: cloud hosting, authentication, in-app purchase management (RevenueCat), and notification delivery partners bound by confidentiality and data-processing terms.
• Legal requirements: when required by court order or applicable law.

Clinic exports and QR summaries are generated by you and shared by you—we are not responsible for how third parties handle records once you share them.

6. Storage, security, and retention

Data is encrypted in transit (TLS) and stored on secure cloud infrastructure. Access is restricted to authorised personnel and systems on a need-to-know basis.

We retain account and health data while your account is active. You may request account and data deletion directly within the app via the Settings menu at any time. If you schedule account deletion, a 30-day grace period applies before permanent erasure, unless a longer period is required by law. You may export your data at any time from Settings prior to deletion.

7. Your rights

Depending on your location, you may have the right to:

• Access and receive a copy of your personal information.
• Correct inaccurate data.
• Delete your account and associated data.
• Object to or restrict certain processing.
• Lodge a complaint with a supervisory authority.

South African users: see our POPIA notice for Information Regulator details.

Requests: email info@littlesteps.africa from your registered account email.

8. Children

Little Steps Africa is designed for parents and legal guardians to record information about their children. Accounts must be created by an adult. We do not knowingly collect personal information directly from children under 13 without parental involvement.

9. International transfers

Our service providers may process data outside South Africa (for example, in the European Union). Where required, we implement appropriate safeguards such as contractual clauses and security controls.

10. Changes

We may update this policy from time to time. Material changes will be communicated in-app or by email where appropriate. Continued use after the effective date constitutes acceptance of the updated policy.