SleepWiz ("we", "us", "the platform") is the data controller responsible for your personal data. For any privacy-related questions or requests, contact us at: privacy@sleep-wiz.com.
We collect the following categories of personal data: (a) Account information: name, email address, phone number (optional), country, language, profile picture (optional), and authentication credentials, or the account identifier returned by Sign in with Google or Sign in with Apple; (b) Child information: the child's name, date of birth and gender, sleep logs, feeding and diaper logs, daily routines, and free-text notes; (c) Child health information: pregnancy and birth history (whether the child was born at term, gestational week at birth, corrected age, birth weight, and anything unusual during or immediately after birth), weight, height and growth percentiles, diagnosed medical issues (for example asthma, breathing problems, snoring, reflux, ear infections or past surgeries), motor and communication development, and the free-text details you add to these answers. This is health data and is collected only with your explicit consent (see Section 4); (d) Family information: household name, the names, roles, ages and occupations of caregivers, and information about siblings; (e) Communication data: messages and feedback exchanged with consultants through the platform; (f) Technical data: device and operating system type, browser type, IP address in server logs, push notification tokens, and technical error reports; (g) Subscription information: your plan and subscription status. Payments are processed by the Apple App Store. We never receive your payment card details.
We process your data for the following purposes: (a) Providing the sleep consultation service, including your child's personalised sleep plan, which may be prepared with the help of AI tools and is reviewed by your consultant; (b) Enabling communication between parents and their assigned consultants; (c) Managing your account, subscription and preferences; (d) Sending service-related notifications (for example plan updates and consultation reminders); (e) Keeping the platform secure, diagnosing technical errors and preventing abuse; (f) Complying with legal obligations; (g) Sending product updates and tips by email, only if you opted in, which you can withdraw at any time. We do not use your or your child's identifiable data to train AI models, we do not use your child's health information to prepare plans for other families, and we never use health information for advertising or marketing. Where we analyse how the service is used in order to improve it, we use only aggregated or de-identified data that cannot identify you or your child.
We rely on the following legal bases: (a) Performance of our service contract with you, for your account and the core service; (b) Your explicit consent, for your child's health information. Under the EU General Data Protection Regulation (GDPR) this is a special category of data (Article 9(2)(a)), and under the Israeli Protection of Privacy Law it is information of special sensitivity. We ask for this consent separately, at the start of the intake questionnaire where the health information is collected, and not as part of accepting these terms. Because the sleep plan depends on this information, the questionnaire cannot be completed without it. You may withdraw this consent at any time by writing to privacy@sleep-wiz.com. We will then stop using that information and delete it, which means the consultation cannot continue; withdrawal does not affect processing that took place before it; (c) Your consent, for marketing emails, given separately through an optional opt-in; (d) Our legitimate interests in keeping the platform secure, diagnosing errors and preventing fraud. We never rely on legitimate interests to process health information; (e) Compliance with our legal obligations.
SleepWiz uses essential cookies and local storage to keep you signed in, remember your language and display preferences, and support the web app. We do not use advertising cookies, analytics or advertising SDKs, cross-app or cross-site tracking, or the device advertising identifier. To find and fix technical errors we use an error monitoring service (Sentry). It receives technical details about an error, such as the page, the browser and the error message. It is configured so that the text shown on screen, everything you type into forms, and the content of your requests are masked or excluded, so that it does not receive your child's health information. On the web you can decline non-essential cookies, in which case no error session recordings are made.
We use the following service providers to operate the platform. Each processes data only on our behalf and under its data processing terms: (a) Vercel: hosting and server infrastructure, including the service that prepares sleep plans; (b) Supabase: database and file storage; (c) Anthropic: the AI model used to help prepare your child's sleep plan. It receives the questionnaire answers and sleep logs of the child the plan is for; (d) Voyage AI: a text search service used to find relevant guidance. It receives only a short description without names or contact details, such as the child's age in months and sleep-related characteristics; (e) Google: Sign in with Google, and Firebase Cloud Messaging for push notifications; (f) Apple: Sign in with Apple, App Store subscriptions and payments, and push notification delivery on iOS; (g) Sentry: technical error monitoring, as described in Section 5; (h) Zoho: delivery of service emails.
We do not sell, rent or trade your personal data. We do not share it for advertising and we do not share it with data brokers. We share data only with the service providers listed in Section 6, and only as necessary to operate the platform, or where required by law.
Your data may be processed and stored on servers outside Israel, including in the European Union and the United States, by the service providers listed in Section 6. Where data is transferred internationally, we rely on safeguards recognised by applicable law, such as adequacy decisions or standard contractual clauses.
SleepWiz processes information about children, including health information, as provided by their parents or legal guardians. In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information directly from children under the age of 13. All child-related data is entered and managed by a parent, legal guardian or authorised caregiver on the child's behalf. By using the service you confirm that you are such a person and that you have the legal authority to consent to the processing of this data. Access to a child's information is limited to the members of the child's household, the consultant assigned to the household, and authorised staff of the platform and of the consultant's organisation who need it to provide or support the service. Access to a child's records is logged.
Subject to applicable law, you have the following rights regarding your personal data: (a) Access: request a copy of your personal data; (b) Rectification: correct inaccurate or incomplete data; (c) Deletion: request deletion of your personal data and account; (d) Restriction: limit how we use your data in certain circumstances; (e) Portability: receive your data in a structured, machine-readable format; (f) Objection: object to processing based on legitimate interests; (g) Withdrawal of consent: withdraw any consent at any time, including your consent to the processing of your child's health information and to marketing emails, without affecting processing that took place before. To exercise any of these rights, contact us at: privacy@sleep-wiz.com. We will respond within the timeframe required by applicable law.
We retain your personal data for as long as your account is active and as needed to provide the service. When you delete your account: (a) personal data and child-related data, including health information, are deleted within 30 days; (b) aggregated and de-identified data that cannot identify you or your child may be retained for research and product improvement; (c) certain data may be retained longer where the law requires it (for example billing records). Inactive accounts may be cleaned up after an extended period of inactivity, with prior notice.
We apply technical and organisational measures appropriate to the sensitivity of the data, including: (a) encryption of data in transit (HTTPS/TLS); (b) secure authentication (including OAuth 2.0); (c) role-based access controls that limit each person to the data their role requires; (d) logging of access to children's records; (e) excluding health information from error monitoring; (f) periodic security reviews of our infrastructure, in line with the Israeli Protection of Privacy (Data Security) Regulations. No system is completely secure. You are responsible for keeping your sign-in credentials safe.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will: (a) notify the relevant supervisory authority within the timeframe required by law; (b) notify affected users without undue delay where the breach is likely to result in a high risk to them; (c) take immediate steps to contain and remediate the breach.
If you enable push notifications, we store a push notification token for your device. It is used solely to deliver service-related notifications (for example consultant messages and plan reminders). You can disable push notifications at any time in your device settings or browser permissions, and the stored token is then deleted.
We may update this Privacy Policy from time to time. When we make significant changes we will notify you through the platform or by email and update the "Last updated" date. Where a change requires your consent, we will ask for it rather than treat continued use as consent.
For privacy-related inquiries, data access requests or complaints, contact our Privacy Officer at: privacy@sleep-wiz.com. If you are not satisfied with our response, you may complain to the Israeli Privacy Protection Authority or to the data protection authority in your country.
This Privacy Policy is governed by the laws of the State of Israel, including the Protection of Privacy Law, 5741-1981, as amended, and the regulations under it, and by the GDPR where it applies to you. Jurisdiction is vested in the competent courts in Israel, without derogating from any right you have under the law of your country of residence.
Contact our Privacy Officer: privacy@sleep-wiz.com