Ronnie
Privacy policy
Ronnie helps parents keep track of their baby’s blood sugars, feeds, nappies and expressing. Nurses, midwives and doctors can use it too, for the babies they’re looking after. That’s sensitive information, so Ronnie is built to keep as little of it as possible anywhere but your own phone.
Who we are
Ronnie is made by Numeris Digital Limited in London. We are the data controller for the small amount of information described below. You can contact us about privacy at hello@ronnie.app.
The short version
- Your baby’s records are stored on your phone, not on our server.
- If you share between phones, the records are encrypted on your phone before they’re sent. Our server only ever holds scrambled data it can’t read.
- No adverts, no tracking cookies, no analytics, and nothing is sold.
- You can delete everything at any time, from the app or by clearing it from your phone.
What we hold, and why
| Information | Where it’s kept | Why |
|---|---|---|
| Readings, feeds, nappies, expressing, notes, questions and settings | On your phone only | So you can use the app. We never see them |
| Shared records, if you turn on sharing | Our server, encrypted on your phone first with a key only your phones have | To keep your phones in step. We can’t read them. Stopping sharing for everyone deletes them |
| Reminder settings, if you turn on reminders | Our server: your phone’s notification address and when the next reminders are due, not the readings | To send reminders when the app is closed |
| A photo of an obs chart, if you use chart scanning | Sent through our server to Anthropic, which reads it and sends back the readings. Not kept by us. In professional mode, the photo is cropped and patient details covered on the phone before it’s sent | To read the handwritten readings for you to check. Ronnie asks for your agreement before your first scan |
| Cot records, in professional mode | On the phone only. Never synced or sent to us | So staff can keep track of the babies they’re caring for |
| Unlock details | Our server: a scrambled fingerprint of an NHS email (never the address), the number of the donation or subscription that unlocked, and how many phones used each code | To check an unlock is genuine |
Who helps us
- Stripe takes subscription payments. Your card details go straight to Stripe, never to us. See Stripe’s privacy policy.
- JustGiving takes donations to the Starlight neonatal unit. Your donation and its details are between you, JustGiving and the charity. We only check that a donation was made.
- Postmark sends the one-time codes we email to NHS staff and to subscribers adding another phone.
- Anthropic reads chart photos when you use chart scanning. Photos aren’t used to train its models.
- Anthropic, Stripe and Postmark are based in the US, so some of this data may be handled there. We rely on their data processing terms, which include safeguards for data sent outside the UK.
- Our web host runs the server that holds the encrypted shared records and the other details above.
Our lawful basis
We process the details above because you ask us to: to share records, send reminders, read a chart or check an unlock (performing our agreement with you). Information about your baby’s health is special category data. Ronnie keeps it on your phone, and anything that does reach us is either encrypted so we can’t read it, or sent only when you choose to use a feature that needs it (your explicit consent). Ronnie asks for that agreement before your first chart scan, and you can stop scanning at any time. As a parent or carer, you make these choices, and exercise your baby’s rights, on your baby’s behalf.
For nurses, midwives and doctors
In professional mode, cot records stay on your phone: they’re never synced or sent to our server. Label cots by bay and cot, never by the baby’s name. Before a chart photo is read, Ronnie asks you to crop it to the readings and cover the baby’s name, hospital number and any label, and only that cropped part leaves the phone. Only use Ronnie where your trust’s policies allow it, and keep the baby’s notes as the record. Your trust remains responsible for its patient records.
How long we keep it
- Shared records: until you stop sharing for everyone, or ask us to delete them.
- Reminder settings: until you turn reminders off, or the phone stops accepting them.
- Unlock details: for as long as the unlock is in use, or until you ask us to delete them.
- Emailed codes: 15 minutes.
Your rights
You can ask to see, correct or delete the information we hold about you, or object to how we use it, by emailing hello@ronnie.app. Because most of it is encrypted or on your phone, the quickest way is usually in the app: More, then Share with your partner, then Stop sharing for everyone. If you’re unhappy with how we’ve handled your information, please tell us first at hello@ronnie.app. We’ll acknowledge your complaint within 30 days and keep you updated until it’s resolved. You can also complain to the Information Commissioner’s Office.
Security
Shared records are encrypted with AES-GCM on your phone, with a key that’s only in your sharing code and never sent to us. The site only works over HTTPS. Unlocks are signed by our server so they can’t be faked.
Not medical advice
Ronnie is a record-keeping aid. It doesn’t give medical advice or replace your care team. Always follow their advice, and if you’re worried about your baby, call the ward, your midwife or 999.
Changes
If we change how Ronnie uses information, we’ll update this page and the date at the top, and mention it in the app’s “What’s new”.