Legal

Privacy Policy

Version 25 September 2026. Little Steps is provided by the operator of Little Steps.

In short

We hold your child’s care information only to run the service you asked for, and only with your consent.
We never sell data and never use it for advertising.
Each optional use (sharing with therapists, AI help, DNA reading, photo links, the scannable E-card, live location) is a separate switch you can turn off at any time.
You can download everything, or delete a child’s record or your account, yourself from the app.

1. Who is responsible

the operator of Little Steps is the controller of personal data processed in Little Steps. Where a clinic or school gives you access, that organisation and the operator of Little Steps act together for the records they manage. Contact: the contact address shown in the app.

2. What we collect

Account: email address, password (stored only as a one-way hash), role, language, time zone, notification choices, two-step sign-in settings.
Child’s care record (entered by you or the care team you invite): name you choose, age band, allergies, assessments, goals, plans, practice logs, diary notes, messages, appointments, reports. This can include health information, which we treat as special-category data.
Optional, only with the matching consent: a photo for the E-card; links to photos/videos; a DNA report (read once, then the file is discarded); GPS positions from a device you link to your child.
Safety features: emergency contacts and people allowed to collect your child (entered by you); the location of someone who scans your child’s E-card only if that person chooses to share it.
Security records: sign-in times, IP address, device type and an audit log of access and changes — to protect accounts and investigate misuse.

3. Why we use it (legal basis)

To provide the service you signed up for (contract).
Health, photo, DNA, AI and location processing: your explicit consent as parent/guardian, which you can withdraw in the app at any time.
Account security, fraud prevention and legal obligations (legitimate interest / legal duty).
In an emergency you raise (“Report missing”), to alert the people you listed and help find your child (vital interests).

4. AI assistance

If you turn on “AI help”, notes and scores are de-identified (names and contact details removed) before being sent to an AI provider to draft summaries and activity ideas. AI output is a preliminary suggestion for your care team to review — it never names medicines or diagnoses. With AI off, a built-in rules engine is used and nothing leaves our servers.

5. Who we share with

People you invite to your child’s care team, with the access you give them.
Service providers acting on our instructions: hosting, email delivery, and — only if enabled — SMS/WhatsApp delivery and an AI provider. They may not use the data for their own purposes.
Anyone who scans your child’s E-card sees only the details you ticked (or, in lost mode, the essentials needed to return your child).
Police or rescue services, when you share a report, poster or live-location link with them.
Authorities when the law requires it.

6. How long we keep it

Care records: while your account and the record exist. Deleting a child’s record erases it; archived records stay until you delete them.
E-card scan locations: 90 days. GPS positions: 30 days. Both are kept longer only while a missing-child report is open.
Security and audit logs: as long as needed to protect the service and meet legal duties.
Backups are overwritten on a rolling schedule.

7. How we protect it

Encrypted connections (HTTPS), hashed passwords, encrypted secrets, strict separation between organisations, per-child access control, optional two-step sign-in, automatic sign-out, alerts for new-device sign-ins, rate limits and a tamper-resistant audit log.

8. Your rights

You can access and download your child’s full record (Record → Export), correct it, withdraw any consent, delete a child’s record, and delete your account (Settings → Security). You may also object to processing or complain to the data protection authority where you live. For anything else, contact the contact address shown in the app.

9. Children

Accounts are for parents, guardians and professionals. Children use Little Steps only through a parent’s or professional’s account (for example Kid mode), and the parent or guardian gives consent for them.

10. Cookies and local storage

We use only essential cookies: one keeps you signed in and one protects forms against cross-site attacks. Your device also stores your language choice and any practice logged while offline. No analytics or advertising cookies.

11. Changes

If we change this policy in a meaningful way we will tell you in the app or by email before it applies.