PRIVACY POLICY
Baby FM Application & the babyfm.rs website
Effective Date: August 18, 2026
Applicable in: European Union | United States | United Arab Emirates | Republic of Serbia
WHAT THIS DOCUMENT COVERS
Baby FM is two separate things, and they collect different data for different reasons. This policy is split so you can read only the part that concerns you:
• Part A — the Baby FM application. The mobile app you sign into. It handles account details and your child’s health data. Sections I–XII.
• Part B — the babyfm.rs website. This site. No account, no health data — only visitor statistics and, if you write to us, what you type into the contact form. Sections XIII–XVI.
Using the website does not create an account and does not give us any health data. Where the two parts differ, the part covering what you are actually using governs.
Cookies and similar technologies are described in full in our Cookie Policy, which forms part of this policy.
PART A — THE BABY FM APPLICATION
Sections I to XII describe the mobile application only.
I. WHO WE ARE
Baby FM is an application designed for parents and caregivers to monitor their children’s pediatric health. It integrates therapy tracking, temperature monitoring, medication reminders, and health reports for pediatricians.
“Baby FM” is the exclusive property of BABY FM DOO, registered in the Republic of Serbia, Veljka Dugosevica 54, Belgrade. PIB: 112487122, MB: 21685119. Registered with the Business Registers Agency of the Republic of Serbia.
Baby FM DOO is the data controller and processor responsible for your personal data. Contact: info@babyfm.rs
II. DATA WE COLLECT
We collect the following categories of personal data:
Account Information
• Full name and email address
• Phone number
• Password (stored in encrypted form)
Child Health Data (Sensitive)
To provide health monitoring features, we collect and store data about the child, including:
• Body temperature measurements and trends
• Therapy schedules and medication reminders
• Special events (baths, feedings, doctor visits)
• Health reports for pediatricians
This is sensitive health data and is processed only with your explicit consent and for the purpose of providing the service.
Device and Usage Information
• Device type, model, and operating system
• IP address
• App usage patterns and interaction data
• Crash reports and performance data
Push Notifications
With your permission, we collect your device push notification token to send medication reminders, temperature alerts, and health notifications. You may disable this at any time in your device settings.
III. PURPOSE OF PROCESSING AND LEGAL BASIS
We process your data for the following purposes:
• Provide and maintain the application and its health monitoring features
• Send health alerts, therapy reminders, and push notifications
• Generate health reports for pediatricians (with your consent)
• Improve application features and user experience
• Provide customer support
• Comply with legal obligations
Legal bases (GDPR Art. 6 & 9): (1) Performance of contract; (2) Explicit consent for sensitive health data (Art. 9(2)(a)); (3) Legitimate interest; (4) Legal obligation.
IV. JURISDICTION-SPECIFIC RIGHTS AND OBLIGATIONS
European Union — GDPR
If you are located in the EU/EEA, the General Data Protection Regulation (GDPR) applies. You have the following rights:
• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / right to be forgotten (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time (Art. 7(3))
To exercise these rights, contact: info@babyfm.rs
Supervisory Authority: Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, Bulevar Kralja Aleksandra 15, 11000 Belgrade. Email: office@poverenik.rs, Tel: +381 11 3408 900.
United States — CalOPPA / CCPA / COPPA
If you are located in the United States, the following additional provisions apply:
California Residents (CCPA):
• You have the right to know what personal information is collected, used, shared, or sold.
• You have the right to request deletion of your personal information.
• You have the right to opt out of the sale of personal information. We do not sell personal information.
• You have the right to non-discrimination for exercising your CCPA rights.
• To submit a verifiable consumer request, contact: info@babyfm.rs
COPPA (Children’s Online Privacy Protection Act):
Baby FM is intended for use by parents and caregivers, not directly by children. We do not knowingly collect personal information directly from children under the age of 13. If we become aware that a child under 13 has provided personal information without parental consent, we will delete such data immediately. Parents may contact us at info@babyfm.rs to review, delete, or refuse further collection of their child’s information.
CalOPPA:
In accordance with the California Online Privacy Protection Act, we will not distribute your personal information to outside parties without your consent. Users may visit our app anonymously where applicable. We will notify users of any changes to this Privacy Policy by updating this document and the effective date.
United Arab Emirates — PDPL (Federal Decree-Law No. 45/2021)
If you are located in the UAE, the Personal Data Protection Law (PDPL) applies. The following provisions apply:
• We process your personal data based on your consent or as required for the performance of a contract.
• You have the right to access, correct, and request deletion of your personal data.
• You have the right to withdraw consent at any time.
• We will not transfer your personal data outside the UAE without ensuring adequate protection measures are in place.
• Sensitive personal data (including health data) is processed only with your explicit consent.
For UAE-related data inquiries, contact: info@babyfm.rs
V. HOW INFORMATION IS SHARED
We do not sell your personal data. We may share data only in the following limited circumstances:
• With Your Consent: For example, when sharing a health report with a pediatrician.
• Service Providers: Cloud hosting and infrastructure providers bound by data processing agreements and confidentiality obligations.
• Legal Requirements: When required by applicable law, court order, or to protect user safety.
• Business Transfer: In the event of a merger or acquisition, users will be notified before data is transferred.
• Website analytics: For visitors to babyfm.rs only, Google (see Part B, section XIV). The application does not share data with Google Analytics.
VI. DATA STORAGE AND RETENTION
Your data is stored on secure cloud servers located in the EU. We retain your personal data for as long as your account is active or as needed to provide the service. Upon account deletion, data is removed within 90 days, except where retention is required by applicable law.
VII. INFORMATION SECURITY
We implement industry-standard security measures including:
• SSL/TLS 1.2+ encryption for all data in transit
• Encrypted storage for sensitive health data
• Role-based access controls
• Regular security audits and vulnerability monitoring
• Employee training on data protection best practices
No method of transmission over the internet is 100% secure. If you have security concerns, contact: info@babyfm.rs
VIII. INTERNATIONAL DATA TRANSFERS
Baby FM operates primarily within the EU. Where data is transferred internationally (including to the US or UAE), we ensure appropriate safeguards are in place, including:
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Compliance with UAE PDPL transfer restrictions
IX. CHILDREN’S PRIVACY
Baby FM is designed to be used by parents and caregivers to monitor their children’s health. Accounts are created and managed by adults. We do not knowingly collect personal data directly from children under 13 (US) or under 18 (EU/UAE/Serbia). If you believe a minor has provided data without appropriate consent, contact us immediately at info@babyfm.rs and we will delete such data promptly.
X. ANALYTICS IN THE APPLICATION
We may use third-party analytics tools to understand how users interact with the application. These tools may collect anonymized usage data. You may opt out of analytics data collection through the application settings.
Analytics on the website works differently and is described in Part B, section XIV. The application settings do not control the website, and the website’s cookie notice does not control the application.
XI. CHANGES TO THIS POLICY
We may update this Privacy Policy periodically. Material changes will be communicated by:
• In-app notification
• Email notification
• Updated effective date at the top of this document
Continued use of the application after changes constitutes acceptance of the updated Policy.
XII. CONTACT AND DATA PROTECTION OFFICER
For any privacy-related questions or to exercise your rights:
• General inquiries: info@babyfm.rs
• App support: app@babyfm.rs
• Address: Baby FM DOO, Veljka Dugosevica 54, 11000 Belgrade, Serbia
• Website: www.babyfm.rs
We aim to respond to all privacy requests within 30 days.
PART B — THE BABYFM.RS WEBSITE
Sections XIII to XVI describe this website only. They do not apply to the application.
XIII. WHAT THE WEBSITE COLLECTS
The website has no visitor accounts, no login for visitors, and collects no health data. It processes three things:
• Visitor statistics. Which pages are opened, from which country, and on what kind of device. Described in section XIV.
• What you send through the contact form. The form asks for your name, e-mail address, a subject and a message. We use it only to answer you. The legal basis is our legitimate interest in replying to enquiries (GDPR Art. 6(1)(f); ZZPL čl. 12), or steps taken at your request before entering into a contract where your message is about becoming a customer. We keep correspondence only as long as needed to deal with the matter.
• Server logs. Our hosting provider records standard access logs, including IP addresses, for security and to keep the site running (GDPR Art. 6(1)(f)).
Please do not send a child’s health information through the contact form. It is an ordinary e-mail channel, not the secure route the application provides.
XIV. ANALYTICS ON THE WEBSITE
The website uses Google Analytics 4 (measurement ID G-D21R9PP1S7), provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and its affiliates including Google Ireland Limited. We use it to count visits and see which pages are useful. We are also preparing to advertise Baby FM through Google Ads. Advertising is not running yet, but pressing Accept in the cookie notice already grants permission for it, so we say so here rather than widening what Accept means later without telling you. The Cookie Policy lists what advertising will set, and what we will not do.
Nothing is stored on your device until you agree. Analytics and advertising storage are both denied by default, in every country. No analytics or advertising cookie exists until you press Accept in the cookie notice.
Before you answer, nothing at all is sent to Google. Google Analytics is not merely prevented from writing cookies — it is not downloaded, so no page address, no device details and no IP address leave your browser for it. Until 18 August 2026 the site did send Google a cookieless signal on every page load, which is the standard setup; we measured what it carried, decided it was not good enough, and removed it. The cost is ours: visitors who decline, or never answer, are not counted at all. See the Cookie Policy, section V.
After you press Accept, Google Analytics sets the cookies listed in the Cookie Policy and measurement becomes cookie-based. The legal basis for that is your consent (GDPR Art. 6(1)(a); ZZPL čl. 15).
Withdrawing takes one button. Open the Cookie Policy and press Cookie settings in section VI. Your stored choice is erased, permissions return to denied, the analytics cookies are deleted from your browser, and the notice reappears so you can choose again. You may withdraw at any time, and withdrawal does not affect the lawfulness of what was processed before it. If we ever widen what Accept covers, your earlier choice stops counting and you are asked again.
Where the data goes. Google may process this data outside Serbia and outside the European Economic Area, including in the United States, under the European Commission’s Standard Contractual Clauses together with Google’s supplementary measures. Google states that it does not log or store individual IP addresses of visitors from the EU, Switzerland or the UK. Serbia is not in the EEA, so we do not claim that guarantee for visitors from Serbia.
XV. COOKIES AND SIMILAR TECHNOLOGIES
Every cookie and browser-storage item this site can set, what it is for, how long it lasts and how to remove it, is listed in the Cookie Policy, which forms part of this policy.
XVI. YOUR RIGHTS ON THE WEBSITE
The rights in section IV apply here too: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (GDPR Art. 15–21 and Art. 7(3); ZZPL čl. 15 and čl. 21–32). Write to info@babyfm.rs and we will answer within 30 days.
You may also complain to the Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, Bulevar kralja Aleksandra 15, 11000 Beograd, office@poverenik.rs — or, if you are in the EU/EEA, to the supervisory authority where you live.