Version 4.1 · Effective Date: 22 August 2026
This policy is published in English. Translations are provided for convenience; if there is any inconsistency, the English version governs.
Registered entity: Materna L.L.C-FZ, trading as Materna by Ibiza, a free zone company incorporated in Meydan Free Zone, Dubai on 20 August 2026, trade licence number 2652540.01, registered address Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, UAE.
Materna L.L.C-FZ, trading as Materna by Ibiza ("Materna", "we", "us", "our") is the data controller for personal data collected through the Materna platform at maternabyibiza.com ("the Platform"). Personal data collected before incorporation, when the founder operating the Platform acted as data controller, transferred to the Company when it was incorporated on 20 August 2026, and the Company assumes responsibility for all such data. The responsible contact for data protection matters is Ben Fox: hello@maternabyibiza.com.
A Data Protection Officer (Encarregado) for Brazilian data subjects will be designated if required at the Platform's scale under the LGPD; until then, data protection enquiries should be directed to the email above.
Materna is an educational platform. It is not a health service provider and does not carry out any health work or procedure of the kind regulated by UAE Federal Law No. 2 of 2019 on the Use of Information and Communications Technology in the Health Fields (the "Health Data Law"). Information you share about your pregnancy or your baby is treated by us as sensitive personal data and handled with heightened protection under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), GDPR Article 9, and Brazil's Lei Geral de Proteção de Dados (LGPD) Article 11. Your conversations with the AI Concierge, and the information you enter during onboarding, are educational personalisation data. They are not medical records: they are not created or maintained by a healthcare professional, do not form part of any clinical or medical record, and are not used to diagnose, treat, or monitor any condition.
You are never required to share health information to use the Platform. If you do, you do so voluntarily and consent to its processing as described in this Policy.
When you use the AI Concierge, the questions you send and the answers you receive are stored in our database (hosted by Supabase). To generate a response, your question is sent to OpenAI to create a text embedding (used to retrieve relevant guidance from our knowledge base) and to Anthropic, which generates the reply.
These service providers are located outside the UAE and outside Brazil (in the United States and/or other jurisdictions). Providing the service therefore involves the international transfer of your personal data, which may include sensitive data. We rely on two safeguards for this transfer: (a) your explicit consent to the transfer, given at sign-up before any paid processing begins; and (b) data processing agreements with each provider imposing contractual data-protection obligations consistent with this Policy. These providers process the conversation content solely to deliver the service. Because messages may contain health information, please share only what you are comfortable storing. You can withdraw your consent or request deletion of your conversation history at any time by emailing hello@maternabyibiza.com.
When you submit an enquiry through our 'Work with Ibiza directly' form, we collect the details you provide — which may include your name, email address, phone number, estimated due date, location, and your message — so that we can respond to your enquiry. This information is processed through our email platform, Klaviyo.
When you use the Hospital Bag Builder, we collect your name, your email address, and the answers you give to its questions, and we generate a personalised PDF from them. Your answers are not stored anywhere — they are used only to build your PDF in the moment and are discarded once it is generated. Your PDF is sent to you by our transactional email provider, Resend.
Lawful basis: Contract (GDPR Art. 6(1)(b); LGPD Art. 7(V); UAE PDPL). We use your data to create and maintain your account, provide access to the AI Concierge and Platform content, and send account-related emails. Paid subscriptions and payment processing are not yet active.
Lawful basis: Explicit consent (GDPR Art. 9(2)(a); LGPD Art. 11(I); UAE PDPL). We process your health-related data — including AI conversation content — to personalise educational content and AI responses to your stage of pregnancy or parenthood. You may withdraw this consent at any time by contacting hello@maternabyibiza.com, though this may limit personalisation.
Lawful basis: Legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7(IX); UAE PDPL). We may analyse anonymised, aggregated data — including anonymised AI conversation feedback — to improve the Platform. No individual user is identifiable from this analysis.
Lawful basis: Consent (GDPR Art. 6(1)(a); LGPD Art. 7(I); UAE PDPL). With your consent, we may send educational content, Platform updates, and promotional communications via Klaviyo. You may unsubscribe at any time via the link in any email or by contacting hello@maternabyibiza.com. If you ask us to send you a document and separately tick the box to receive Ibiza's notes, we record that consent in Klaviyo along with your first name, language preference and where you signed up, so we can send you content in your own language. Ticking the box is optional — you receive your document either way.
We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law. Your onboarding and AI conversation data are educational personalisation data, not clinical records, and are deleted when no longer needed for the service. Automated time-based deletion is being implemented; until it is fully in place, data is deleted on request — email hello@maternabyibiza.com. The periods below describe our target retention policy, which will be enforced automatically as the relevant features go live.
| Data Category | Retention Period | Reason |
|---|---|---|
| AI conversation logs | Until no longer needed; deleted on request (target: 90 days once automated deletion is built) | Service delivery and quality review |
| Account email and name | Account lifetime + 2 years | Contract and dispute resolution |
| Payment records | 7 years | UAE commercial law requirement |
| Health / onboarding data | Account lifetime + 90 days, then deleted | Educational personalisation |
| Email marketing consent | Until withdrawn + 1 year | Evidence of consent |
| Analytics data (GA4) | 14 months (GA4 default) | Platform improvement |
We use the following third-party services which may process your personal data on our behalf. Each is subject to appropriate data protection obligations.
Data Processing Agreements (DPAs) with Anthropic, OpenAI, and Supabase are incorporated by reference on our acceptance of each provider's standard terms, as all three may process health-related data. The knowledge-base embedding provider is OpenAI (text-embedding-3-small).
| Processor | Purpose | DPA Status |
|---|---|---|
| Anthropic PBC | AI language model — processes AI conversation content | Executed |
| OpenAI, L.L.C. | Text embeddings for the AI knowledge base — processes AI question content | Executed |
| Supabase Inc. | Database storage — conversation logs, user data | Executed |
| Klaviyo Inc. | Email marketing and automation | Klaviyo DPA (klaviyo.com/legal) |
| Resend (Plus Five Five, Inc.) | Transactional email — sends the documents you request, such as your hospital bag list | Resend DPA (resend.com/legal/dpa) |
| Google LLC (GA4) | Platform analytics — anonymised usage data (consent-gated) | Google DPA via Analytics settings |
| Vercel Inc. | Platform hosting and serverless functions | Vercel DPA (vercel.com/legal/dpa) |
| Payment provider | Payment processing — card data never seen by Materna | To execute before subscriptions open |
We use cookies and similar technologies on the Platform. Analytics cookies require your prior consent, collected via the cookie consent banner when you first visit the Platform. You can change your choice at any time using the "Cookie Preferences" link in the footer. Functional cookies (remembering your language, cookie choice, AI disclaimer acknowledgement, and free-question count) do not require consent.
| Cookie | Set by | Duration | Purpose / Consent |
|---|---|---|---|
| _ga | Google (GA4) | 2 years | Analytics — unique visitors. Consent required. |
| _ga_[ID] | Google (GA4) | 2 years | Analytics — session tracking. Consent required. |
| materna_cookie_consent | Materna | Persistent | Remembers your cookie choice. Functional — no consent required. |
| materna-lang | Materna | 1 year | Remembers language preference. Functional — no consent required. |
| materna_q_count | Materna | Session | Tracks free question count. Functional — no consent required. |
| materna_vid | Materna (server-set) | 1 year | Anti-abuse visitor ID for AI free-question limits. Functional — no consent required. |
| materna_tester_id | Materna | Persistent | Remembers beta-tester sign-in. Functional — no consent required. |
| materna_ai_ack | Materna | Persistent | Remembers you acknowledged the AI Concierge disclaimer. Functional — no consent required. |
| Klaviyo onsite (e.g. __kla_id) | Klaviyo | 2 years | Behavioural tracking on the waitlist page. Analytics — only active with your consent ("Accept Analytics"). |
Depending on your location, and subject to the UAE PDPL, GDPR, and LGPD as applicable, you have the following rights regarding your personal data. To exercise any right, contact hello@maternabyibiza.com. We will respond within 30 days.
We implement appropriate technical and organisational measures to protect your personal data, including row-level security on our database, encrypted transfer via HTTPS, access controls limiting who can access production data, and regular review of processor security standards. In the event of a personal data breach likely to result in a risk to your rights, we will notify affected users and the relevant authorities without undue delay, in accordance with applicable law.
We may update this Policy from time to time. For material changes — particularly changes affecting how we process health data or transfer it across borders — we will notify you by email at least 30 days before the change takes effect and require your active re-acceptance before continuing to process your health data under the new terms. Non-material changes take effect upon posting.
Supervisory functions for data protection in the UAE are transitioning to the federal authority responsible for data and AI. If you have a concern, please contact us first at hello@maternabyibiza.com; you may also pursue remedies through the UAE courts. Brazilian users may also petition the ANPD (gov.br/anpd).