Privacy Policy

Viami (“Viami”, “we”, “us”) is a parenting app made in Aotearoa New Zealand for families here. This is data about your family — including your children — so we hold ourselves to a simple standard: we only collect what the app needs to work for you, we never sell it, and you can take it with you or delete it at any time.

This policy explains what we collect, why, who processes it, and your rights under the New Zealand Privacy Act 2020 (including information privacy principle IPP3A on indirect collection, in force from 1 May 2026). Questions any time: hello@viami.me.

1. What we collect

Everything below is provided by you inside the app, or generated by your use of it. We collect no data from data brokers, and nothing is collected for advertising.

Your account

• Email address and, if you sign in with Apple or Google, the display name your provider shares. Sign-in is passwordless — we never see or store a password.
• Session and device information needed to keep you signed in, and a push notification token if you turn notifications on.

Your family and children

• Child profiles: a nickname, an age stage, and — only if you choose to provide them when a feature genuinely needs the precision — date of birth, due date, or sex. Sex is always skippable; skipping it simply gives you sex-neutral reference ranges.
• Family members you invite, and the role you give each of them (Primary carer, Co-parent, Co-guardian, Caregiver, Viewer). Roles control exactly what each member can see and do.

Records you create

• Care logs (feeds, sleep, nappies, solids, symptoms), growth measurements, milestones, checklists and notes. These are private to your family and are shown only to members according to the roles you set.

Money tools

• An optional household income band (a range, not a figure) so calculators can estimate your entitlements, and any FamilyBoost claim details or invoices you choose to add.

Connections and enquiries

• Links you establish with early-childhood services, and the audit trail of each link (see section 5).
• If you send an enquiry to a centre, the email address and message you provide. Enquiries are one-off transactional emails with your address as the reply-to — we never auto-follow-up.

Location

• Only the region you select when searching for centres. We do not collect GPS coordinates or track your location.

2. Guest mode — local until you say otherwise

You can use Viami without an account (“Start now — sign up later”). In guest mode your data is stored only on your device and does not reach our servers. If you later create an account, your local data is migrated to it losslessly — and from that point this policy applies to it in full. If you never create an account, deleting the app deletes the data.

3. Usage analytics — patterns, never content

To understand which features help families, we record privacy-preserving usage events (for example, “a sleep record was created”). These events are deliberately stripped of anything sensitive. By design, our analytics never contain:

• the content of any record, note, or question you ask the AI assistant — only that an action of a given type happened;
• a child’s name or photo;
• a child’s exact date of birth — only a coarse age bracket (such as “3–12 months”);
• a child’s sex, ever;
• GPS coordinates — at most the region you selected.

Child identifiers in analytics are one-way hashed, and are never shared with advertising platforms. Actions taken by Caregivers or Viewers are attributed to their own account and are not used to build a profile of your child.

You can opt out of analytics entirely in Family → Account → Analytics. With the switch off, only anonymous aggregate counts remain.

4. The AI assistant

When you ask the assistant a question, your question and the minimum relevant context from your own child’s records are sent — via our servers, never directly from your device — to our AI providers (Anthropic, with OpenAI as fallback) to generate the answer. Under our API agreements with these providers, your data is not used to train their models. Your question text is never included in analytics.

The assistant has safety guardrails: questions that suggest a genuine medical red flag are routed to clear “see a doctor” guidance rather than generated advice. The assistant is not a medical professional — see our Terms for the full disclaimer.

5. Connecting institutions — and your IPP3A notice

Viami can connect to the services around your child, such as an early-childhood centre. Connections follow a strict three-state design: linking is not sharing. When a link is first claimed, zero data moves. The institution verifies with the minimum possible disclosure, and nothing flows until you explicitly confirm — child by child — that the match is correct.

When a confirmed connection means we will start receiving information about you or your child from that institution (for example daily updates or attendance from a centre), we tell you — at the moment the connection is first established — what categories of information we will collect, from whom, and for what purpose. That notice is placed permanently in your Inbox so you can always look it up. This is your notice under IPP3A of the Privacy Act.

Where a centre runs on a partner platform (such as KIDOMO), data moves only through a controlled interface after your confirmation, and only the categories described in your notice.

6. Who processes your data

We do not sell or rent your information to anyone. A small number of service providers process data on our behalf, strictly to run Viami:

Provider	What for	What they see
Anthropic / OpenAI	Generating AI assistant answers	Your question and minimal record context; not used for model training
Resend	Transactional email (sign-in links, enquiry copies, invitations)	Your email address and the message being sent
Apple / Google	Sign-in and push notification delivery	Standard sign-in identity; push tokens and notification envelopes
Cloud infrastructure	Hosting and storage	Encrypted traffic and stored application data

The centre directory you search is the Ministry of Education’s public ECE directory — public data we read, not a party that receives yours. We may also disclose information if the law requires it, and we will tell you when we lawfully can.

7. Where your data lives, and how it’s protected

Viami is operated from New Zealand on cloud infrastructure; some servers may be located outside New Zealand. Wherever data is held, it stays under this policy, and we take the steps required by IPP12 to ensure it is protected by comparable safeguards. All traffic between your device and our servers is encrypted in transit (TLS). Access to production data is restricted to the small number of people who operate the service, and role-based permissions in the app control what each family member can see.

8. How long we keep it

We keep your data for as long as your account is active, so your child’s journey is there when you come back to it. Connection audit trails and IPP3A notices are kept for as long as the account exists, because they are your permanent record of what was shared. When you delete your account — or a child’s data — deletion cascades as described below.

9. Data & deletion — export, delete, leave

Export

Family → Account → Export my data gives you everything — account, children, records, growth, connections and their audit trails, consents, enquiries, FamilyBoost claims and your Inbox — in an open, machine-readable format you can keep or take elsewhere.

Delete your account

Family → Account → Delete account & all data permanently deletes your account and everything in it: children’s profiles, all records, connections and consents, sessions, and the analytics events linked to your children. Deletion begins immediately and completes across all our systems within 30 days. This cannot be undone — export first if you want a copy.

Delete one child’s data

You can also delete a single child’s data from Family → child profile. Deletion cascades through that child’s logs, connections and analytics.

Guests

Guest data lives only on your device: deleting the app deletes it.

Prefer to ask a human? Email hello@viami.me from your account address and we’ll handle export or deletion for you.

10. Your rights

Under the Privacy Act you can ask us for access to the personal information we hold about you, ask us to correct it, and ask us to delete it. The in-app export and deletion tools above answer most requests instantly; for anything else, email hello@viami.me and we’ll respond within 20 working days.

If you’re not happy with how we’ve handled your information, tell us first — we genuinely want to fix it. You also have the right to complain to the Office of the Privacy Commissioner (privacy.org.nz).

11. Children

Viami is built for parents and caregivers, not for children to use themselves. Information about children is entered and controlled by their parents or guardians, protected by the commitments in this policy — and by one more: we designed Viami knowing that one day your child gets to read what was kept about them.

12. Changes to this policy

If we change this policy in any meaningful way, we’ll tell you in the app (and in your Inbox) before the change takes effect, and the current version will always live at this address. The effective date at the top tells you when it last changed.

13. Contact

Viami · Aotearoa New Zealand
hello@viami.me