Cora by Co-nurse

Privacy Policy

Effective Date: July 10, 2026

This policy explains how Cora by Co-nurse (the "App") handles personal information when you use our breastfeeding, postpartum, infant-care, AI coaching, and community features.

Important health and safety note: Cora is a general wellness and informational product. It does not provide medical diagnosis, treatment, emergency care, or a substitute for advice from a qualified clinician. In an emergency, contact local emergency services or a licensed healthcare professional immediately.

1. Introduction and scope

Cora is operated by Co-nurse Health Technologies ("Cora," "Co-nurse," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, store, and protect personal information in connection with the Cora mobile application, related web pages that link to this Policy, customer support channels, AI coaching features, and community features (together, the "Services").

This Policy is written to be understandable first and legal second. Some sections also include region-specific information for users in the European Union, European Economic Area, United Kingdom, the United States, and Gulf Cooperation Council countries.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use the Services.

2. Definitions

"Personal information" or "personal data" means information that identifies, relates to, describes, can reasonably be linked to, or can be used to contact a person or household.
"Sensitive information," "special category data," or "health-related wellness information" means information that applicable law treats with extra protection, including certain information about breastfeeding, postpartum recovery, infant care, mood, symptoms, sleep, or similar wellness topics.
"AI conversation data" means the messages, prompts, questions, and responses exchanged through Cora AI.
"Forum content" means posts, comments, replies, display names, and messages that you choose to share in community features.
"Service providers" means companies or individuals that process information for us so we can operate the Services, such as hosting, analytics, customer support, payment, crash-reporting, and AI infrastructure providers.

3. Information we collect

We collect different information depending on which Cora features you use and what you choose to share. You do not need to provide every type of information listed below to use every part of the Services.

Category	Examples	Source	Why we use it
Account and contact information	Name, email address, phone number, password credentials, language preference, country/region.	You provide it when registering or updating your account.	Create and secure your account; authenticate you; communicate with you; provide support.
Profile and caregiving information	Pregnancy or postpartum stage, baby's age or date of birth, feeding method, birth-related or caregiving preferences you choose to share.	You provide it in onboarding, profile, forms, or AI chat.	Personalize app content and Cora AI responses.
Health-related wellness information	Breastfeeding questions, latch concerns, milk supply concerns, postpartum symptoms, infant care context, mood or sleep information you choose to share.	You provide it through Cora AI, onboarding, forms, support, or community features.	Operate Cora AI and wellness features; provide relevant informational guidance; support safety escalation when needed.
AI conversation data	Prompts, messages, questions, and AI-generated responses.	Generated when you use Cora AI.	Generate responses; maintain context during your use; improve safety, quality, and reliability where permitted by law.
Community/forum content	Posts, comments, replies, display names, reports, and messages to community participants or professionals where available.	You provide it when using community features.	Operate the community; enable peer support; moderate content; enforce community rules.
Feeding and lactation tracker data	Feeding sessions, pumping or lactation logs, timing, notes, or related local entries.	You enter it in the tracker.	Current implementation stores this locally on your device by default. It is not sent to Cora servers unless a future sync, backup, export, or cloud feature is introduced and disclosed.
Usage, device, and diagnostics data	App version, device type, operating system, session events, crash logs, approximate region from IP/device settings.	Collected automatically through the App and service providers.	Keep the App working; diagnose crashes; secure the Services; understand feature performance.
Subscription and transaction information	Subscription status, billing confirmation, renewal status, refund/support records. Full card details are handled by payment processors, not stored by Cora.	Generated through app store or payment processor interactions.	Manage subscriptions and payments; prevent fraud; provide customer support.
Support and feedback	Messages you send to support, survey responses, feedback, screenshots you voluntarily provide.	You provide it when contacting us or responding to surveys.	Respond to your request; improve the product; troubleshoot issues.

3.1 Information about infants and children

Cora is designed for adults. We do not knowingly collect personal information directly from children. If you are a parent or caregiver, you may choose to enter limited information about an infant or child, such as age or feeding context, to receive age-appropriate informational guidance. That information is treated as part of your account information and is used to provide the Services to you.

If we learn that a child has created an account directly or provided information in violation of applicable law, we will take reasonable steps to delete the information and close the account, unless retention is required by law.

4. How we use information

We use personal information for the purposes below:

Provide, operate, maintain, and secure the Services.
Create and manage user accounts, authentication, subscriptions, and support requests.
Generate AI-assisted wellness information in response to your questions.
Personalize Cora content and responses based on information you choose to share.
Operate and moderate community features, including reviewing reported content.
Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms of Service or community rules.
Analyze app performance, crashes, and aggregate usage so we can improve the Services.
Comply with law, respond to lawful requests, and establish, exercise, or defend legal claims.

Cora AI uses automated processing to generate conversational responses. Those responses may be personalized to the information you provide, but Cora does not make legal, financial, employment, insurance, or similarly significant decisions about you.

5. Legal bases for processing

Where laws such as the GDPR, UK GDPR, or similar frameworks require a legal basis, we rely on one or more of the following:

Performance of a contract: to provide the Services you request, including account features, Cora AI, community features, and subscription management.
Consent: where required by law, including for certain sensitive or health-related wellness information, marketing communications, or optional analytics/advertising technologies.
Legitimate interests: to operate, secure, debug, improve, and protect the Services, provided those interests are not overridden by your rights and freedoms.
Legal obligation: to comply with applicable law, accounting, tax, consumer protection, and regulatory duties.
Vital interests or safety: in rare cases where processing is necessary to protect someone's life, physical safety, or urgent welfare.

Some jurisdictions require a separate explicit consent for certain health-related or special category information. Cora's available consent and privacy controls may vary by market. If a separate consent is required for a feature in a jurisdiction, we will implement the required consent flow or limit that feature until the required controls are available.

6. Cora AI

6.1 What Cora AI is

Cora AI is an AI-powered informational coaching feature focused on breastfeeding, postpartum wellness, and infant-care topics. It is designed to provide general wellness information and supportive guidance, not medical diagnosis, treatment, emergency triage, or professional clinical care.

6.2 How AI conversation data is processed

When you send a message to Cora AI, your message and relevant context you choose to share may be processed by Cora and by third-party AI infrastructure or service providers so that a response can be generated. These providers process information for the purpose of operating the feature and are expected to protect the information under contractual confidentiality and data protection obligations.

6.3 Model improvement

We may use de-identified, aggregated, or otherwise privacy-protective AI interaction data to evaluate quality, safety, reliability, and product performance, where permitted by law. Where you have given consent during registration, de-identified question-and-answer pairs (with no name, email, or phone number included) may also be added to a training dataset and used for AI model training, fine-tuning, and academic research or scientific publication purposes. We do not use identifiable AI conversation data for purposes that require a separate consent unless that consent has been obtained or another lawful basis applies.

6.4 Safety escalation

If Cora AI or community features identify language that may indicate an emergency, self-harm risk, harm to a child, or another acute safety concern, the App may display emergency resources or safety guidance. Depending on the market and configuration, content may also be flagged for human review for safety or moderation purposes.

7. Feeding and lactation tracker

The current feeding and lactation tracker is designed as a local, device-based feature. Entries you create in the tracker are stored on your device by default, using local app storage, and are not transmitted to Cora servers in the current implementation.

Because tracker entries are local by default, they may not be available if you uninstall the App, clear app data, change devices, or lose access to your device, unless a separate export, backup, or sync option is made available and used.

If we introduce cloud sync, backup, server-side analytics, or server-side processing for tracker data in the future, we will update this Policy and provide any notice or consent required by law before using tracker data in that new way.

8. Community features

Community features may allow you to post questions, comments, replies, or messages that can be seen by other users or by professionals participating in Cora's community, depending on the feature design and region.

Please avoid posting information about yourself, your child, or third parties that you do not want others to see. We may moderate community content using automated tools and human review to enforce community rules, protect safety, and respond to reports.

If you delete community content or close your account, some content may be removed, anonymized, or retained in limited form where necessary for moderation records, legal obligations, dispute resolution, safety, or technical integrity of community threads.

9. How we disclose information

We do not sell your personal information for money. We may disclose information to the following categories of recipients when needed to operate, protect, or improve the Services:

Cloud hosting and infrastructure providers.
Third-party AI infrastructure or AI service providers that help generate Cora AI responses.
Payment processors, app stores, and subscription management providers.
Analytics, diagnostics, crash-reporting, security, and customer engagement providers.
Customer support and communication providers.
Professionals or community moderators, where a feature involves interaction with them or safety/moderation review.
Legal, accounting, insurance, and professional advisers.
Government authorities, regulators, law enforcement, or courts where required by law or necessary to protect rights, safety, property, users, or the public.
A successor or potential successor in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to appropriate confidentiality protections.

Some privacy laws define "sale," "sharing," or "targeted advertising" broadly. If a feature or service provider arrangement falls within those definitions in your jurisdiction, we will provide the required notice and opt-out choices.

10. Cookies, SDKs, analytics, and advertising

10.1 In the App

Cora may use in-app software development kits (SDKs), analytics tools, crash-reporting tools, and similar technologies to keep the App working, understand product performance, improve reliability, and support customer engagement. The App does not use third-party advertising SDKs or advertising identifiers.

10.2 On our websites

Our websites use cookies and similar technologies (such as pixels and tags) in the following categories: (a) strictly necessary technologies required for the website to function, such as remembering your cookie choices and display preferences; and (b) optional analytics and advertising technologies, which we use only with your consent where required by law.

With your consent, we use Google Analytics 4 to understand how visitors use our websites, and advertising pixels provided by Meta Platforms (Meta Pixel) and TikTok (TikTok Pixel) to measure the effectiveness of our advertising and to reach audiences who may be interested in Cora. These providers may collect or receive information such as your device and browser information, IP address, pages viewed, and interactions with our websites and advertisements, and may combine it with other information they hold about you under their own privacy policies. These technologies are used on our websites only; they are not embedded in the App.

Where consent is required (including in the European Union and the United Kingdom), optional analytics and advertising technologies remain off until you accept them through our cookie banner. You can change or withdraw your choices at any time through the "Cookie settings" link on our websites. Where we rely on consent-based measurement, we also honor consent signals through Google's consent mode.

Depending on your jurisdiction, the use of advertising pixels may be considered "sharing" of personal information for cross-context behavioral advertising or "targeted advertising." You can opt out through the cookie banner, the "Cookie settings" link, or the "Do Not Sell or Share My Personal Information" link on our websites, and we honor opt-out preference signals such as Global Privacy Control (GPC) where required by law. You can also use the opt-out tools offered by Google, Meta, and TikTok in their own settings.

10.3 Your choices

Where applicable law requires consent for optional analytics, advertising identifiers, or similar technologies, we will request consent before they are activated and provide controls to withdraw consent or opt out as required. Declining optional cookies does not affect your ability to use our websites or the App.

11. Security

We use technical and organizational safeguards designed to protect personal information from unauthorized access, loss, misuse, disclosure, alteration, or destruction. These may include encryption in transit, access controls, secure hosting practices, monitoring, vulnerability management, confidentiality obligations, and incident response procedures.

No app, website, AI system, or storage method can be guaranteed to be completely secure. You are responsible for protecting your login credentials and for contacting us if you believe your account has been compromised.

12. Retention and deletion

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain your account, comply with law, resolve disputes, protect safety, prevent fraud, and enforce agreements.

The current implementation does not include a fixed automatic job that deletes or anonymizes AI conversation data after 36 months or account data 24 months after closure. Instead, account deletion and anonymization occur when you use the in-app "Delete my account" flow or when we process a valid deletion request, subject to limited exceptions required by law, security, safety, backups, fraud prevention, or dispute resolution.

When you delete your account, Cora will delete, anonymize, or de-identify personal information associated with your account in production systems according to the App's deletion flow. Some information may remain for a limited time in backups, logs, transaction records, legal records, or records that we must keep for security, fraud prevention, accounting, compliance, dispute resolution, or safety reasons.

Local tracker data stored on your device may remain on that device unless you delete it in the App, clear the App's data, uninstall the App, or otherwise remove it from your device. Server-side account deletion does not necessarily erase data stored only on your device.

13. International transfers

Cora may be used in different countries, and our service providers may process information in countries other than the country where you live. Privacy laws in those countries may differ from those in your jurisdiction.

Where applicable law requires safeguards for international transfers, we use measures such as contractual protections, standard contractual clauses, transfer impact assessments, technical safeguards, consent where appropriate, or other legally recognized mechanisms.

We will not promise region-specific storage or data localization unless that storage architecture is actually implemented for the relevant market.

14. Your privacy rights and choices

Depending on where you live, you may have rights to access, download, correct, delete, restrict, object to, or receive a portable copy of your personal information. You may also have the right to withdraw consent, opt out of certain processing, appeal a decision, or lodge a complaint with a privacy regulator.

Current in-app controls support access/export of your data and account deletion. If you want to correct information, object to processing, restrict processing, withdraw consent, or exercise another right that is not currently available as a dedicated in-app button, contact us using the contact method listed in Section 18. We will review and respond according to applicable law.

We may need to verify your identity before responding to a request. We will not discriminate against you for exercising privacy rights, to the extent required by law.

15. Region-specific information

15.1 European Union, EEA, and United Kingdom

If you are located in the EU, EEA, or United Kingdom, GDPR or UK GDPR rights may apply. These may include the rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority.

Health-related wellness information may be considered data concerning health or special category data. Where Article 9 or equivalent rules require explicit consent or another special legal basis, Cora will rely on the applicable legal basis and will provide consent controls where required before enabling the relevant processing.

15.2 United States

Cora is a general wellness product and is not a healthcare provider, health plan, covered entity, or business associate under HIPAA. Information you provide to Cora is not treated as HIPAA-protected health information unless a separate legal arrangement states otherwise.

Some U.S. state privacy laws may give residents rights to know, access, delete, correct, opt out of sale/sharing or targeted advertising, limit use of sensitive personal information, appeal decisions, and avoid discrimination for exercising rights. We do not knowingly sell or share personal information of children under 16 in a way that requires opt-in authorization under applicable state law.

We do not sell personal information for money. However, our use of advertising pixels on our websites (described in Section 10.2) may be considered "sharing" for cross-context behavioral advertising or "targeted advertising" under some state laws. You can opt out at any time through the cookie banner, the "Cookie settings" link, or the "Do Not Sell or Share My Personal Information" link on our websites, and we honor Global Privacy Control (GPC) signals where required. This does not apply to the App, which does not use advertising SDKs.

Certain states have consumer health data laws that may apply to wellness information. Where those laws apply, we will provide required notices, consent mechanisms, and rights for covered consumer health data.

15.3 Gulf Cooperation Council countries

If you are located in the United Arab Emirates, Saudi Arabia, or another Gulf Cooperation Council country, local data protection laws may apply. Where such laws require consent or other safeguards for health-related or sensitive information, cross-border transfers, or privacy rights, we will follow the applicable requirements for that market.

16. Children's privacy

Cora is intended for adult users. We do not knowingly allow children to create accounts or provide information directly to us where doing so would violate applicable law. Parents and caregivers may provide limited infant or child information as part of their own account to use Cora's informational features.

17. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, technology, legal requirements, or data practices. If we make material changes, we will provide notice through the App, email, website notice, or another reasonable method, and we will request renewed consent where required by law.

The Effective Date at the top shows when this Policy was last updated.

18. Contact us

Cora is operated by Co-nurse Health Technologies.

If you have questions, concerns, or privacy requests, contact us at [email protected] or through the in-app privacy settings.

For privacy requests, please include enough information for us to verify your identity and locate your account. Do not send emergency medical requests through privacy channels.