This Privacy Policy describes how Blümi collects, uses, stores, and shares your personal information. It applies to all users — individuals building a birth plan, and care providers using Blümi to support their clients.
1. Who We Are
Blümi is operated by Blümi Inc., a corporation incorporated in Ontario, Canada. We operate the Blümi web application at blumi.ca, helping individuals prepare personalized birth preferences and enabling care providers to support their clients.
Privacy questions? Reach us at hello@blumi.ca.
2. Scope of This Policy
By creating a Blümi account or using our services, you agree to the collection and use of your information as described here.
3. Information We Collect
Account information
When you create an account, we collect your email address and a password. Passwords are stored using industry-standard cryptographic hashing — we cannot access your actual password. We also store your account role (individual client or care provider) and subscription tier.
Birth plan information
The Blümi birth plan builder lets you save the following. Where you have an associated care provider, this information is visible to them:
- Your name and expected due date
- Your pronouns and preferred terms
- Your planned birth location
- The name of your support person and care team
- A personal note or message to your care team — an open free-text field where you may share anything you choose
- Health considerations selected from a list: Gestational Diabetes, Gestational Hypertension, Preeclampsia, Placenta Previa, GBS, Cholestasis, HELLP Syndrome, Cervical Insufficiency, Anaemia, Rh Incompatibility
- Preferences regarding comfort measures — both non-medical (aromatherapy, movement, breathing) and medical (epidural, nitrous oxide, opioids, and others)
- Preferences regarding labor management, induction, monitoring, pushing, and positions
- Preferences for after birth: cord clamping, skin-to-skin, newborn care procedures
- Emotional support, personal care, and trauma-informed care preferences
- Preferences in the event of an emergency, surgical birth, or NICU admission
- Items flagged as questions to explore with your care team
Your birth plan data is used solely to generate, save, and display your plan — and to share it with your care provider where applicable. It is never used for advertising, sold to third parties, or used to train AI models.
Care provider and practice information
If you are a care provider or practice, we collect your email address, practice name, the names and 4-digit PINs of practitioners in your account, client invitation records, client notes you record, and client assignment records.
Payment information
When you purchase a subscription, we share your email address, selected plan, and a user identifier with Stripe. Your card details go directly to Stripe's PCI-DSS certified platform — they are never transmitted to or stored by Blümi. We store only a reference to your Stripe customer record and your payment status.
Information collected automatically
Blümi does not use advertising cookies, behavioral tracking, or third-party analytics. Our hosting providers (Vercel, Supabase) collect standard server logs — IP addresses, browser type, request timestamps — for security and operations. Your browser also loads fonts from Google Fonts, which receives your IP address as a standard web request.
4. How We Use Your Information
- To create and maintain your account and verify your identity
- To save and display your birth plan so you can access and edit it any time
- To share your birth plan with your associated care provider, where you have accepted their invitation
- To process your subscription through Stripe and manage your feature access
- To send transactional emails: account confirmation, password resets, and renewal notifications via Stripe and Supabase
- To maintain, improve, and secure the Blümi platform
- To comply with applicable laws and respond to lawful requests
5. How Your Information Is Shared
With your care provider
If you create your account through a care provider's invitation, or link your account to a provider, that provider will have access to your complete birth plan — including health considerations, medication preferences, personal notes, and all other information you've entered. In practice and collective accounts, your plan may also be visible to other assigned practitioners and the practice administrator.
Your birth plan is never shared with a provider unless you have accepted an invitation from them.
Provider notes: Providers may write internal notes about their clients in the Blümi portal. These notes are visible to the provider and, in practice accounts, to the administrator and assigned practitioners. If you would like to know what notes have been recorded about you, contact hello@blumi.ca.
With third-party service providers
- Supabase — our database and authentication provider. All account and birth plan data is stored on Supabase infrastructure.
- Stripe — our payment processor. We share your email, selected plan, and a user identifier to process subscriptions.
- Vercel — our application hosting provider. Vercel hosts Blümi and processes request data as part of normal operations.
We do not sell, rent, or share your personal information with third parties for marketing purposes.
Legal disclosures
We may disclose your information if required by law, court order, or government authority, or where we reasonably believe disclosure is necessary to protect our rights or the safety of others.
6. Where Your Data Is Stored
Blümi's data is stored on Supabase infrastructure hosted on Amazon Web Services in the United States (US East — North Virginia). Our application is hosted on Vercel, a US-based company. Both are subject to US law.
If you are in Canada: your personal information is transferred to and stored in the United States. This is permitted under PIPEDA, but it means your data may be subject to US laws that could allow US government authorities to access it in certain circumstances. By using Blümi, you consent to this transfer. We remain responsible for your information even when held by these providers, and require them to maintain appropriate safeguards.
7. How Long We Keep Your Information
We retain your account and birth plan information for as long as your account is active. If you delete your account, your personal information and birth plan data will be deleted within 60 days of your request, except where a longer period is required by law.
Stripe retains billing and transaction records per financial regulations and its own policies — we don't control that retention.
If your care provider's subscription lapses, your birth plan remains accessible to you and is not deleted as a result.
8. How We Protect Your Information
- All data is transmitted over HTTPS (TLS encryption in transit)
- Supabase encrypts data at rest using AES-256 volume encryption
- Passwords are stored using cryptographic hashing — we cannot retrieve your password
- Database access is controlled by Row-Level Security, so each user can only access their own data
- Stripe webhook requests are verified using HMAC-SHA256 to prevent tampering
No system is completely secure. We maintain reasonable safeguards but cannot guarantee absolute security.
9. Your Rights and Choices
For all users
- Access — request a summary of information we hold about you
- Correction — update most information directly within your Blümi account
- Export — download your birth plan as a PDF any time from within the app
- Deletion — request account and data deletion at hello@blumi.ca (see Section 7 for timelines)
Canadian users — PIPEDA
Under PIPEDA you have the right to know what personal information we hold, access and correct it, and in some circumstances withdraw consent. Contact us at hello@blumi.ca. If we haven't adequately addressed your concern, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
US users
California residents may have rights under the CCPA, including the right to know what we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. Contact hello@blumi.ca to exercise your rights. Other US state privacy laws may also apply depending on where you reside.
10. Children's Privacy
Blümi is not intended for anyone under 18. We don't knowingly collect information from minors. If you believe we've done so inadvertently, contact hello@blumi.ca and we'll delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email and/or through a notice in the app before changes take effect. Continued use after that date constitutes acceptance.