Privacy Policy

Who we are

Bloom is operated by Gatto Nero Services LLC (“we”). For any question or request about your data, write to [email protected].

What Bloom holds

• Your account: email, name and the sign-in method.
• Your preferences: language, currency, time zone, country of residence.
• What you tell us in onboarding and everything you add: plan steps, appointments, health records and notes, medications and vaccines, documents and files, costs and insurance details, and your questions for professionals.
• Your shared space: who is in it and any invitation you send (the invited email and a hashed link, never the link itself).
• Your subscription, if you have one: the plan, its status, the renewal date and your Stripe customer ID. We never see or store your card number.

Signing in

You can sign in with a one-time code we send to your email, or with your Google account.

If you choose Google, Google tells us your name, your email address and your profile picture. We use your name and email address only to create your account and to recognize you when you sign in. We do not show or use the profile picture, and we do not receive anything else from your Google account (such as your contacts, your email messages or your files).

We do not sell this information, do not use it for advertising and do not use it to train AI models. Bloom's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can stop using Google sign-in at any time by deleting your account in Settings, or by removing Bloom's access in your Google Account permissions.

Who can see it

Inside Bloom, the two people in a shared space see and can edit the same information. There are no hidden or private areas between partners. Nobody else can see your data, and a link or an email address alone never gives access to a shared space: an invitation can only be accepted by a signed-in account that uses the invited email.

• Interactive reports you choose to share are reachable by anyone who has the secret link, and optionally an access code. You can create and revoke them. Reports show only what you included.
• We do not read the health content of your account. Technical access to the production database is limited to running and securing the service.

Documents and files

Uploaded files are stored privately. They are opened only through short-lived, signed links for people in your household.

AI features

AI features are part of Bloom Premium. When you ask Bloom to read a document or insurance policy, organize your history, structure a note or prepare an appointment, the text or file you chose is sent to our AI provider (OpenAI) to produce the result. This happens only when you start it. We do not send your name or unrelated records. We use OpenAI's business API, which by OpenAI's own terms does not use this content to train its models. AI output is a draft to review, never medical advice. Records created from AI suggestions are marked so you can check them.

Payments

Premium payments are processed by Stripe. Stripe collects your card and billing details directly, and its privacy policy applies to what it handles. We receive only the subscription status, the plan, the renewal date and your customer ID.

Service providers

• Supabase: database, authentication and file storage (EU, Frankfurt).
• Hetzner and Cloudflare: the servers and network that run Bloom (EU).
• Cloudflare Turnstile: a check that you are a person, on our public forms (the tools, the newsletter and the Bloom Partners application). It reads technical signals from your browser; it does not use advertising.
• OpenAI: AI processing, only when you use an AI feature. It may process the request outside the EU.
• Stripe: Premium payments.
• Amazon Web Services (SES): sign-in codes, invitation and notice emails.
• Resend: account-change emails sent by our authentication provider.
• Sentry: error reports when something breaks. They contain where it failed, never what you wrote.
• Google Analytics: counts visits to the public website only (never inside your account), without advertising features.
• Affitor: attributes sign-ups and Premium subscriptions to the partner who referred you, only if you arrived through a partner link and pressed Accept on the cookie banner. It receives the partner click and your opaque account number, never your name, email address or anything about your health.
• PostHog (US): product analytics, only if you accept the cookie banner. It receives the page, the kind of button pressed and your opaque account number, never your name, email or what you type.
• Exchange-rate data (European Central Bank via Frankfurter) is fetched without sending any of your data.

Analytics and logs

We record basic product events (for example, that a feature was used for the first time) to improve Bloom. They never include the content of your health records, notes or documents.

If you press Accept on the cookie banner, we also use PostHog (servers in the United States, under the standard contractual clauses) to see how each signed-in account uses Bloom: which screens are opened and which buttons are pressed, linked to your account number (an opaque identifier), never to your name or email address. We do not record your screen, what you type or the text you see, and we cut every page address down to its path, without ids or query. If you press Decline, none of this starts, and Bloom works exactly the same.

On the public website (not inside your account) we also use Google Analytics to count visits and clicks on the main buttons, with only the page address and no advertising features. In the European Union, the United Kingdom and Switzerland it starts without cookies and uses them only if you press Accept.

If you arrive on the public website through a partner’s link and press Accept, Affitor’s tracker remembers which partner sent you, so that partner can be credited. If you then create an account or subscribe to Premium, Bloom tells Affitor the partner click and your opaque account number (and Stripe carries the same two values with the payment). Nothing about your health is involved, and if you press Decline none of this starts.

Free tools and the newsletter

If you use a free tool on our website without an account, your answers are kept for up to 7 days so you can come back, sign in or open the link we email you if you ask for one. The newsletter is separate and opt-in: we write to you only after you confirm through a link, and you can unsubscribe at any time by writing to [email protected].

Bloom Partners applications

If you apply to Bloom Partners, we collect the name, email address and country you enter and, only if you choose to add them, a link to your Instagram, TikTok or website and a few words about yourself. We do not ask for health information here, and we ask you not to include any.

We use these details only to review your application, to write to you about the program and, if you are welcomed in, to give you Bloom Premium access. We do not add you to the newsletter or send you marketing because of an application. Only our team can see applications: they are stored in our database (Supabase, EU) and are not shown publicly or shared with anyone else.

You send the application by choice, and by ticking the box you consent to this use. You can ask us to delete or correct your application at any time by writing to [email protected]. We keep it for as long as we need it for the program, or until you ask us to delete it.

Cookies

Bloom always uses the cookies needed to keep you signed in and to remember your language and your cookie choice. If you press Accept, analytics cookies are also set (PostHog and, on the public website, Google Analytics and, if you arrived through a partner’s link, Affitor’s partner cookie). We do not use advertising cookies. You can change your choice at any time with “Cookie settings” in the footer of the website or in Settings.

How long we keep it

• Your data stays while your account exists.
• When you delete your account, your data and files are removed from the live service right away. Backups kept by our database provider are overwritten on their regular schedule, within 30 days at most.
• Payment records are kept by Stripe and by us for as long as tax and accounting rules require.

Your rights and choices

• Edit or delete anything you added, at any time.
• Export your data from Settings.
• Change your name, email, language and currency in Settings.
• Delete your account in Settings. Your account, sign-in and sessions end immediately and your files are removed. Health records about you are deleted. If you share a space, items you created for you both stay with your partner, who becomes the owner; if you are alone, the whole space is deleted.
• If you live in the European Union, the United Kingdom or Brazil, you also have the rights set by the GDPR and the LGPD: access, correction, deletion, portability, restriction and objection, and the right to complain to your data protection authority. Write to [email protected] and we will answer within 30 days.

Why we may process your data

We process your data to provide the service you asked for. Health information is added by you, and by adding it you choose to give it to Bloom: you can delete it at any time. We also process limited technical data to keep Bloom secure and working.

Children and age

Bloom is for people who are 18 or older. Information about a child you add belongs to your household.

Changes

If we change this policy, we will update the date above and, for important changes, tell you in the app.