Privacy policy for use of the application
Application Privacy Notice
Version / effective date : 2.0 | 17 October 2026
Applicability: Families, account holders and professional users
Document owner: Incubeats Tech Ltd
1. Identity and application of this notice
Incubeats Tech Ltd (“Incubeats”, “we”, “us”) provides a mobile application that enables families to record and manage voices and maternal heartbeat audio for use with babies, including where a participating neonatal hospital is authorised to access and play that audio. This notice explains how personal information is processed when using the application. It should be read with the Incubeats End User Agreement.
For privacy questions or to exercise your rights, contact general@incubeats.com. Incubeats Tech Ltd is established in the United Kingdom. The company’s current registered-office address and company number are available on the Companies House register.
The use of recordings for the HEART-NEO study or any other research is governed by separate research information and arrangements; use of the application does not itself amount to consent to participate in research.
2. Allocation of responsibility
Incubeats acts as a data controller for activities for which it determines the purposes and essential means, including its independent administration of family accounts, support and security functions.
For use of recordings as part of neonatal care, the participating hospital determines the purpose and lawful basis for its clinical processing and acts as controller. Incubeats processes information on the hospital’s documented instructions to the extent it provides the hospital service as its processor. The same account may involve both roles for different operations.
Requests concerning a hospital’s clinical record or care decisions should be addressed to that hospital. Incubeats will assist and, where appropriate, forward requests securely.
3. Categories and sources of information
We process information supplied by account holders: first and last name, relationship to the baby, email address, account credentials, selected hosting region, and hospital preference; the baby’s name, postmenstrual age, gender where supplied, hospital association and baby account identifier; and recorded voice, maternal heartbeat and associated track labels and attributes.
For authorised professional accounts, we process professional email address, hospital affiliation, role and account authentication details. We process operational information including login, access and playback events, timestamps, device or speaker identifiers, support correspondence and security logs.
Parents and other family members provide the recordings. Hospitals supply account codes following their verification of parental responsibility, as described below. We do not use the recordings to identify people through biometric recognition.
4. Health-related information
Certain information concerning a baby receiving neonatal care, including postmenstrual age when linked to the baby and hospital association, may disclose health information and be special-category personal data. Incubeats treats this information with safeguards appropriate to its sensitivity.
For every processing purpose, the relevant controller must establish an Article 6 lawful basis and, where special-category information is involved, an Article 9 condition under applicable UK or EU GDPR. Contract acceptance and a selection to share with a hospital are not automatically equivalent to GDPR explicit consent.
5. Purposes and legal bases
Incubeats uses information to establish and manage accounts; authenticate users; manage recordings and track preferences; make recordings available to the hospital selected by the account holder where applicable; deliver requested playback; respond to support requests; protect users and the service; maintain audit records; and meet legal obligations.
For Incubeats-controlled account and service administration, the usual Article 6 basis is performance of a contract with the relevant account holder where necessary. We rely on legitimate interests, subject to a documented balancing assessment, for proportionate security, fraud prevention and service reliability; and on legal obligation where applicable.
For health information, any separate Article 9 condition applicable to Incubeats-controlled activities must be recorded in its processing register and communicated where required. Hospital clinical processing relies on the bases and Article 9 condition determined by that hospital and set out in its own patient information. Incubeats does not claim that the hospital-sharing selection alone establishes these bases.
6. Registration and hospital authorisation
During family registration, the account owner first indicates whether they intend Incubeats to be used at a hospital (2nd screen). Where hospital use is selected, the account owner identifies the hospital authorised to access the baby’s recordings (3rd screen). The account owner separately accepts the End User Agreement (4th screen). These are distinct decisions.
The hospital is responsible for checking parental responsibility or other appropriate authority before issuing the baby account code to an individual permitted to establish an account. The baby account code identifies the relevant baby’s account; it does not override hospital-level permissions.
When a hospital is selected, saved recordings are available through the cloud to appropriately authorised hospital users. The account owner may change the selected hospital within the app. The previous hospital then loses access through Incubeats, although information lawfully retained by the hospital outside the service may remain subject to its policies.
7. Security and access
Audio held in Microsoft Azure Storage is protected by Azure Storage’s automatic AES-256 encryption at rest. Azure Storage secure transfer is required for REST API operations and the minimum TLS setting is 1.2. Additional infrastructure encryption is not enabled; this does not disable Azure Storage’s standard encryption at rest.
Access to recordings is subject to hospital isolation and baby-level permissions. Baby identifiers are designed not to be predictable. Access and playback events are logged. Incubeats speakers do not persistently store recordings; playback is delivered via the cloud service.
Professional users must be authorised by their hospital. Verification of a professional email address and affiliation with the hospital is part of the account-provisioning process; the hospital and Incubeats work to remove or disable access when staff no longer require it. No online service can guarantee absolute security.
8. Hosting, recipients and international access
During registration the account holder selects a United Kingdom or European Union data region. According to the current service configuration, recordings and their backups are retained in the corresponding selected country or region.
Personal data may be processed by contracted hosting, engineering, support and operational service providers under appropriate confidentiality and data-protection arrangements. The participating hospital receives access only where it is selected and authorised. We do not sell family recordings.
The location of data storage does not by itself eliminate international data transfers, which may also arise through authorised remote support or supplier access. Where restricted transfers occur, appropriate safeguards will be applied under applicable law. Further information about relevant recipients and safeguards may be requested using the contact details above.
9. Retention and deletion
We retain information only for the period needed for the service, security, applicable legal requirements and any instructed hospital retention. Account holders may delete their family accounts using the application and may delete individual tracks. A new heartbeat does not alter a heartbeat embedded in previously saved tracks.
Backup deletion may occur on a different cycle from active-service deletion. Incubeats maintains an internal retention schedule and will explain applicable periods or criteria upon request.
Hospital-related information processed solely on a hospital’s instructions is returned or securely deleted at the end of the service in accordance with its agreement, subject to applicable legal requirements.
10. Your rights
Depending on the processing and applicable law, you may have rights to be informed, access, rectification, erasure, restriction, portability and objection, as well as rights concerning decisions made solely by automated means. These rights are subject to statutory conditions and exceptions.
Where processing relies on consent, that consent can be withdrawn without affecting earlier lawful processing. Withdrawal of in-app hospital access is distinct from requests directed to the hospital for its clinical records.
Contact general@incubeats.com to make a request. You also have the right to complain to the UK Information Commissioner’s Office (www.ico.org.uk) or a competent EU supervisory authority where applicable.
11. Changes and contact
We may revise this notice when the application, legal obligations or processing arrangements change. The current version will be made available within the application and on the Incubeats website. Material changes will be communicated where required.
Privacy contact: general@incubeats.com. Publication date: 17 October 2026.