Version 4.8 · Effective Date: 14 October 2026
This policy is published in English. Translations are provided for convenience; if there is any inconsistency, the English version governs, except where the law of your country gives you the right to rely on the version in your language.
Registered entity: Materna L.L.C-FZ, trading as Materna by Ibiza, a free zone company incorporated in Meydan Free Zone, Dubai on 20 August 2026, trade licence number 2652540.01, registered address Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, UAE.
Materna L.L.C-FZ, trading as Materna by Ibiza ("Materna", "we", "us", "our") is the data controller for personal data collected through the Materna platform at maternabyibiza.com ("the Platform"). Personal data collected before incorporation, when the founder operating the Platform acted as data controller, transferred to the Company when it was incorporated on 20 August 2026, and the Company assumes responsibility for all such data. For any data protection matter, including requests about your rights, contact us at privacy@maternabyibiza.com.
Materna is an educational platform. It is not a health service provider and does not carry out any health work or procedure of the kind regulated by UAE Federal Law No. 2 of 2019 on the Use of Information and Communications Technology in the Health Fields (the "Health Data Law"). Information you share about your pregnancy or your baby is treated by us as sensitive personal data and handled with heightened protection under the data protection laws that apply to you (see section 11). Your conversations with the AI Concierge, and the information you enter during onboarding, are educational personalisation data. They are not medical records: they are not created or maintained by a healthcare professional, do not form part of any clinical or medical record, and are not used to diagnose, treat, or monitor any condition.
You are never required to share health information to use the Platform. If you do, we handle it on the basis of the agreement described in section 3.2.
When you use the AI Concierge, the questions you send and the answers you receive are stored in our database (hosted by Supabase). Before your question is used to search our knowledge base or to write a reply, we aim to remove details that could identify you or other people — such as names, workplaces, neighbourhood or building names, email addresses and phone numbers — and replace them with neutral placeholders. This removal is itself carried out by an AI model (Anthropic), so that one step reads your question as you wrote it. The resulting version, after this removal process, is what is then sent to OpenAI to create a text embedding (used to retrieve relevant guidance from our knowledge base) and to Anthropic, which generates the reply. Earlier messages in the same conversation are sent in the same form: for members, we keep an encrypted copy of each message with those details removed, and that copy is what is sent. In a small number of cases, the automatic removal cannot be completed, and then only email addresses, phone numbers, web links and long numbers are removed before sending. If you are a member and have chosen to share it, the AI Concierge is also given your stage of pregnancy (with your current week) or your baby's age, and whether this is your first baby, taken from your profile so that it does not have to ask. Your name, email, dates and other profile details are never sent to these providers. If the AI Concierge greets you by your first name, the name is added by our own servers after the reply has been written. If you use voice input, your recording is sent to OpenAI to be transcribed into text before any details are removed; Materna does not store the recording. Because details cannot be removed from a recording, you may prefer to type anything you would rather not share.
These providers, and the other providers listed in section 5, are located outside the UAE and outside Brazil, mainly in the United States; our database is hosted in South Korea. Using the Platform therefore means transferring your personal data, including health-related information, to other countries. We rely on your consent for this transfer. You give it before your first question to the AI Concierge, when you create an account, and when you use the hospital bag builder, and the wording you agree to names the transfer expressly (see section 3.2). Each provider is also bound by a data processing agreement that requires it to protect your data in line with this Policy. These providers process the conversation content solely to deliver the service. Because messages may contain health information, please share only what you are comfortable storing. You can withdraw your consent or ask us to delete your conversation history at any time by writing to privacy@maternabyibiza.com. If you withdraw it, we stop sending your data abroad, which means we can no longer answer your questions or keep your account.
If you email us, we receive your email address, your name if you include it, and whatever you write. We use it only to answer you and to keep a record of what we agreed. Our inboxes are provided by Google Workspace (see section 5).
When you use the Hospital Bag Builder, we collect your name, your email address, and the answers you give to its questions, and we generate a personalised PDF from them. Before we create your list, we ask you to confirm that you understand these details are sent to providers outside the UAE, and we keep a record of that agreement linked to a one-way code made from your email address, not to your email itself. Materna does not store your answers — they are used only to build your PDF and are discarded once the PDF has been generated. The PDF shows your name and reflects your answers — for example where you plan to give birth, the type of birth you are planning and how you plan to feed your baby — so the email we send you contains that information. Your PDF is sent to you by our transactional email provider, Resend, which keeps a copy of sent emails for 30 days before deleting it. This section refers to the free tool on our website; if you are a member and use the builder inside the app, your answers are saved to your account, as described in section 8.
If you use the Baby log, we store the entries you make about your baby — feed times (breast side, bottle amount or food group), nappy changes and sleep times. These are your baby's personal data and we treat them as sensitive: they are stored only for you, are never sent to the AI Concierge or any AI provider, are not interpreted by Materna, and are deleted with the rest of your data (see Section 4). We store no free-text notes about your baby. The details you record in each entry — breast side, bottle amount, food group and nappy type — are stored encrypted with our own key. The times of entries are not encrypted. You can download your Baby log as a PDF for the dates you choose. We create the file when you ask for it and do not keep a copy; it is saved to your device, and anyone you share it with will be able to read it. Because this is information about your child, we ask for your agreement, as a parent, the first time you add your baby's name or open the Baby log. You can withdraw it in your profile at any time; the Baby log then stops and its entries are deleted.
If you use the contraction timer or the kick counter, we store what you record: for contractions, the start time and length of each one you time; for the kick counter, the start time of each session and the number of movements you counted. This is information about your pregnancy and we treat it as sensitive: it is stored only for you, is never sent to the AI Concierge or any AI provider, is not interpreted by Materna, and is deleted with the rest of your data (see Section 4). These records hold times and counts only and are not encrypted with our own key. You can download them as a PDF for the dates you choose. We create the file when you ask for it and do not keep a copy; it is saved to your device, and anyone you share it with will be able to read it. We ask for your agreement the first time you use these tools, and you can withdraw it in your profile at any time.
If you book a one-to-one session, you book directly with Ibiza's own licensed practice in Dubai, which is a separate business from Materna. The booking calendar shown on our consultations page belongs to that practice and runs on its scheduling service, Cal.com. Your name, email address, chosen time and payment details go directly to the practice, not to Materna.
The practice is responsible for that information, and for any notes it keeps, as an independent controller under applicable UAE data protection law. Its own privacy notice is shown when you book. Materna does not receive or store your booking details.
Payment for a session is taken by that practice through its own payment provider. Materna does not receive your payment and does not store your card details.
Lawful basis: we need this to provide the service you asked for. We use your data to create and maintain your account, provide access to the AI Concierge and Platform content, and send account-related emails. This also covers the free-question limit on the AI Concierge, remembering your language, sending you a document you ask for, and replying when you write to us. Paid subscriptions and payment processing are not yet active.
Lawful basis: your consent. Before your first question to the AI Concierge, and before we create your hospital bag list, we show you a short statement that names the health-related information you may share and its transfer to providers outside the UAE, and ask you to confirm with "I understand and agree". When you create an account, you give the same agreement in the consent boxes at sign-up. We keep a record of when you agreed, in which language, the exact wording you saw, and which version of this Policy it referred to. For the AI Concierge this record is linked to a coded identifier for your browser, not to your name; for the hospital bag builder, to a one-way code made from your email address. We process your health-related data — including AI conversation content — to personalise educational content and AI responses to your stage of pregnancy or parenthood. You may withdraw this consent at any time by contacting privacy@maternabyibiza.com. Because the AI Concierge cannot work without it, withdrawing this consent means we can no longer answer your questions or keep your account.
Optional choices. Some features ask for your agreement separately, and you can use the Platform without them: using your stage of pregnancy or your baby's age to tailor AI Concierge answers; the Baby log and your baby's name; and the kick counter and contraction timer. Each stays off until you turn it on, and you can turn it off in your profile at any time, which switches off only that feature.
Lawful basis: turning your data into anonymised statistics is part of the processing you agree to in section 3.2; once anonymised, the data no longer identifies anyone. We may analyse anonymised, aggregated data — including anonymised AI conversation feedback — to improve the Platform. No individual user is identifiable from this analysis.
Lawful basis: your consent, given through a separate box that is never ticked for you. We never make it a condition of using the Platform or of receiving a document you asked for. With your consent, we may send educational content, Platform updates, and promotional communications via Klaviyo. You may unsubscribe at any time via the link in any email or by contacting privacy@maternabyibiza.com. If you use the hospital bag builder and separately tick the box to hear when Materna opens, we record that consent in Klaviyo along with your first name, language preference and where you signed up, and we send you one email when Materna opens. Ticking the box is optional — you receive your list either way.
We keep personal data only for the periods in the table below. Your onboarding and AI conversation data are educational personalisation data, not clinical records. Deletion is automatic: when your membership ends (at the end of the last period you paid for, including after you cancel), your conversations, notes, birth plan, bag list, the logs you keep and your pregnancy details are deleted 90 days later, and we email you before that happens; conversations with the public AI Concierge are deleted 90 days after they take place. If your account has no active membership and you have not signed in for 24 months, we treat your membership as ended. Deleted data is removed from our backups within 7 days. You can also ask us to delete your data at any time by emailing privacy@maternabyibiza.com.
| Data Category | Retention Period | Reason |
|---|---|---|
| AI conversation logs | Account lifetime + 90 days (member conversations); 90 days (public AI Concierge conversations) — deleted automatically | Service delivery and quality review |
| AI Concierge feedback (ratings and the reason chosen) | 90 days (public AI Concierge); account lifetime + 90 days (members) | Quality review |
| Records of your agreement to this Policy | Account lifetime + 90 days, then deleted (members); 2 years (visitors) | Evidence of your consent |
| Account email | Account lifetime + 2 years | Contract and dispute resolution |
| Payment records | 7 years | UAE tax and commercial law requirements |
| Health / onboarding data | Account lifetime + 90 days, then deleted | Educational personalisation |
| Email marketing consent | Until withdrawn, or 24 months without renewal — then deleted | Evidence of consent |
| Waitlist sign-ups, including the "tell me when Materna opens" box | Until 6 months after launch, or until you unsubscribe | Telling you when Materna opens |
| Emails you send us | 24 months after our last reply | Answering you and keeping a record |
| Anti-abuse identifier (materna_vid) | 1 year | Enforcing free-question limits |
We use the following third-party services which may process your personal data on our behalf. Each is subject to appropriate data protection obligations.
All the providers below process data outside the UAE and outside Brazil, mainly in the United States; our database is hosted in South Korea. The only exception is the key vault that holds our encryption key, which is in the UAE. We rely on your consent for these transfers (see section 2.3), supported by a data processing agreement with each provider.
Data Processing Agreements (DPAs) with Anthropic, OpenAI, and Supabase are incorporated by reference on our acceptance of each provider's standard terms, as all three may process health-related data. The knowledge-base embedding provider is OpenAI (text-embedding-3-small).
| Processor | Purpose | DPA Status |
|---|---|---|
| Anthropic PBC | AI language model — generates AI replies and performs the initial removal of identifying details from questions before the resulting version is sent for further AI processing; processes AI conversation content (with identifying details removed, except when performing that initial removal) and, for members who choose to share it, the stage of pregnancy or baby's age from the profile | Standard terms, incorporated by reference |
| OpenAI, L.L.C. | Text embeddings for the AI knowledge base (from questions with identifying details removed), and voice transcription — processes voice recordings | Standard terms, incorporated by reference |
| Supabase Inc. | Database storage (South Korea) — conversation logs, user data, records of your agreement | Standard terms, incorporated by reference |
| Klaviyo Inc. | Email marketing and automation (United States) | Klaviyo DPA (klaviyo.com/legal) |
| Resend (Plus Five Five, Inc.) | Transactional email — sends the documents you request, such as your hospital bag list, and the emails we send you from hello@maternabyibiza.com | Resend DPA (resend.com/legal/dpa) |
| Vercel Inc. | Platform hosting and serverless functions; anonymous page statistics without cookies | Vercel DPA (vercel.com/legal/dpa) |
| Stripe | Payment processing — card data never seen by Materna | Stripe DPA, part of the Stripe Services Agreement (stripe.com/legal/dpa) |
| Microsoft (Azure Key Vault) | Holds the key that encrypts your content, in the UAE; it does not hold your content | Microsoft Products and Services Data Protection Addendum |
| Google LLC (Google Workspace) | Our email inboxes, including hello@ and privacy@ | Google Cloud Data Processing Addendum |
| Cal.com, Inc. | Shows Ibiza's practice's booking calendar on our consultations page; what you enter there goes to the practice, not to Materna | Not applicable: the booking calendar belongs to Ibiza's practice |
Before your question is sent to Anthropic or OpenAI, identifying details are removed as described in section 2.3. Anthropic and OpenAI do not use the content we send them to train their models. Both may keep it for up to 30 days to monitor for misuse, and during that period their authorised staff may review it. Content flagged for a policy violation may be kept longer under each provider's own policy. We have asked OpenAI for zero data retention; if it is granted, we will update this section.
We use only cookies and similar storage that the Platform needs to work. We do not use advertising or analytics cookies, so we do not show a cookie banner. This table covers the public site and the member app. Some items are kept in your browser's local storage rather than as cookies; they work the same way and are listed together. None of them requires your consent.
| Cookie | Set by | Duration | Purpose |
|---|---|---|---|
| materna-lang | Materna | Persistent | Remembers your language preference. |
| materna_q_count | Materna | Persistent | Tracks your free question count. |
| materna_vid | Materna (server-set) | 1 year | Anti-abuse visitor ID for AI free-question limits, and the coded identifier linked to your agreement record. |
| materna_ai_ack | Materna | Persistent | Remembers that you agreed to the Privacy Policy before using the AI Concierge. We also keep our own record of that agreement. |
| materna_mic_notice | Materna | Persistent | Remembers that you have seen the voice-note notice, so it is not shown again. |
| Vercel Web Analytics | Vercel | — | Anonymous page statistics. No cookies or browser storage; visits are counted with a daily-resetting hash that cannot follow you across days or sites. |
| sb-[project]-auth-token (and related sign-in cookies) | Materna (member app) | While signed in | Keeps you signed in to the member app. |
| materna_locale | Materna (member app) | 1 year | Remembers your language in the member app. |
| materna_birth_prompt_dismissed | Materna (member app) | Persistent | Remembers that you closed the birth-update prompt on your dashboard. |
| Stripe cookies (e.g. __stripe_mid, __stripe_sid) | Stripe | Set by Stripe | Fraud prevention while you pay, on the checkout page only. Needed to complete a payment you start; see Stripe's cookie policy. |
| Other functional storage | Materna | Session or persistent | Remembers in-page state, such as checklist ticks. No personal data. |
Wherever you live, you have the following rights regarding your personal data. To exercise any right, contact privacy@maternabyibiza.com. We will confirm receipt straight away and give you a full answer within 15 days.
We implement appropriate technical and organisational measures to protect your personal data, including row-level security on our database, encrypted transfer via HTTPS, access controls limiting who can access production data, and regular review of processor security standards. In the event of a personal data breach likely to result in a risk to your rights, we will notify affected users and the relevant authorities without undue delay, in accordance with applicable law.
In addition, the content you write or record on Materna — your first name and your baby's name, your due date and your baby's date of birth, your conversations with the AI Concierge, your notes, the text you type into the birth plan and hospital bag builders, and your Baby log entries — is stored encrypted with our own key. That key is held in a dedicated key vault (Microsoft Azure), separately from our database, and access to it is restricted to Materna's authorised systems. Reads of member data in our database are recorded in an audit log, and where we need to read this content to answer a support request you have raised, or for a safety reason, that access is also recorded. We test that our backups can be restored.
We may update this Policy from time to time. For material changes — particularly changes affecting how we process health data or transfer it across borders — we will notify you by email at least 30 days before the change takes effect and require your active re-acceptance before continuing to process your health data under the new terms. Non-material changes take effect upon posting.
If you have a concern, please contact us first at privacy@maternabyibiza.com. You also have the right to complain to the data protection authority where you live (see section 11), and to go to court.
The Platform follows the same standard for everyone. The laws that apply depend on where you live.
United Arab Emirates. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. We rely on contract (Article 4(9)) and on your consent (Articles 4 and 6). Transfers abroad rely on your explicit consent (Article 23(1)(b)), supported by contracts with each provider. You can complain to the UAE Data Office, or to the authority that assumes its functions (Article 24).
Brazil. Lei Geral de Proteção de Dados (Law No. 13,709 of 2018). We rely on contract (Article 7, V), on your specific and highlighted consent for health-related information (Article 11, I) and, as a parent, for your baby's data (Article 14, paragraph 1). Transfers abroad rely on your specific and highlighted consent (Article 33, VIII). We answer requests about your data in simplified form straight away and in full within 15 days (Article 19). You can petition the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
European Union and United Kingdom. The Platform is not offered to residents of the European Union or the United Kingdom (see our Terms of Service).