Consumer Health Data Privacy Policy

This policy covers the consumer health data that Cotokim collects on cotokim.com, as Washington's My Health My Data Act and Nevada law define it. Cotokim is run from Brazil, and you can reach us at contato@cotokim.com. The rest of your information is covered by our Privacy Policy.

The health data we collect and how we use it

• Your due date. The month and year build your list for the season and the climate your baby will be born into. We keep the exact date only if you give it to us for the full plan.
• The number of babies you expect, to set the quantities.
• Your baby's birth date, if you add it, to adjust the list to your baby's age.
• Your list: the items, sizes and quantities we calculate from these answers, and what you mark on it. Together, they show that you are expecting a baby.
• The fact that you use Cotokim to prepare for a baby, linked to the email of your account and, if you buy the full plan, to your purchase.
• The due month on your baby shower page, only if you choose to show it.

We use this data only to build, save and show your list and your plan, and to show it to the people you choose. We never use it for advertising. We collect it with your consent, which you give on the screen that appears when you first save your list.

Where it comes from

From you, when you answer the questions and use your list; from the family members you invite, who can edit the list; and from our own calculation of the list based on your answers. We do not get health data from any other source.

We never ask for your weight, health conditions, complications, type of delivery, tests or medicines, and we do not collect your precise location. The due date and pregnancy week calculators on our pages work in your browser: what you type there is not sent to us. The free list without an account is also calculated in your browser and is not stored.

Who it is shared with

• People you choose: the family members you invite see your due date and your list. Whoever has the link to your shower page sees the due month, only if you choose to show it.
• Stripe, if you buy the full plan: it receives your email and the purchase, which shows that you use Cotokim, to process the payment and, for its own purposes, to prevent fraud and meet its legal obligations, under Stripe's privacy policy. It does not receive your due date or your list.
• Anthropic, which provides Claude, the AI tools we use to run Cotokim and to answer your messages: when we use them, it receives the health data involved, such as your due date or your list, and also handles it under Anthropic's privacy policy.
• Nobody else. We do not sell health data, we do not share it with advertisers or data brokers, and we have no affiliates.

Our processors handle it only on our behalf, to run Cotokim: Hetzner, the server that stores it, in the United States; Cloudflare, the network that delivers the site; Resend, which sends our emails, such as sign-in codes; Google (Gmail), where the messages you send to contato@cotokim.com arrive; and the encrypted backups, kept in a storage service in the United States and on administration computers in Brazil.

How we process it

• We store it on our server in the United States and send it only over encrypted connections. Only the people who run Cotokim, and the AI tools described above, can access it.
• Apart from what this policy describes, no other company collects your health data through Cotokim, on our site or across other websites. We use no advertising pixels, tags or tracking tools.
• If you gave us the exact due date, we delete the day 3 months after the due date and keep only the month and year and the sizes, so your list keeps working.
• Encrypted backup copies are deleted on a rolling basis within 45 days.

Your rights and how to use them

• Confirm and access: in My account, "Download my data" gives you the health data we keep about you and your list. You can also ask us whether we collect, share or sell your health data, and for the list of everyone we shared it with. Today that list has the people you chose, Anthropic and, if you bought the full plan, Stripe.
• Review and correct: change your answers in My account at any time.
• Withdraw your consent and stop the collection: in My account, "Delete the list and the baby's data" deletes your health data and withdraws your consent. Without it, we cannot keep your list; the free list without an account still works.
• Delete: "Delete the list and the baby's data" or "Delete my account", in My account, deletes your health data from our server at once and from the encrypted backups within 45 days. When you ask us by email to delete it, we also pass your request to the companies that process it for us, to Anthropic and to Stripe.

By email. Write to contato@cotokim.com from the email of your account. If we cannot confirm that the request is yours, we may ask for more information. You do not need to create an account, and requests are free. We reply within 30 days and complete deletions within that time. If another request needs more time, we tell you why before then.

Appeal. If we decline your request, reply to our answer to appeal. We answer in writing within 45 days, with our reasons. If we keep declining it, we give you the contact of your state attorney general.

Using these rights never changes the price or the service you get.

Changes to this policy

Before we collect new categories of health data, use it for new purposes or share it with new kinds of recipients, we update this policy and ask for your consent. We tell account holders about changes like these by email. This policy takes effect on the "Updated on" date at the end of this page.

Contact

contato@cotokim.com