Privacy Policy

1Introduction

We comply with the Personal Data Protection Act No.9 of 2022 (‘PDPA’). This data protection notice (‘Notice’) sets out what personal data we collect from you and/or generate about you including how we collect or generate, use, store and process them in relation to your usage of this Mobile Application (“App”).. Your privacy is important to us and we are committed to safeguarding the privacy of your personal data. It is important that you read this notice carefully and understand how and why we process your personal data on this App. The words used in this Agreement such as “personal data”, “controller”, “data subject”, “processor”, “processing” shall have the same meaning as the PDPA.

Hemas Holdings PLC and consisting of its subsidiaries and affiliates, or hereinafter referred to as “Company”, “we”, “us” or “Hemas” is considered as “controller” under the PDPA.”

2What Information is Collected and Why

We collect the following categories of personal data and the table that follows explains why we collect or process such data.

• Identity data — your name, NIC, hospital assigned patient ID number (if any), or any other document to attest your identity.
• Contact data — your postal address, telephone numbers, email addresses.
• Communication data — survey inputs, chatbot, email, messaging service or phone communications we may have with you.
• Login credentials — your username and password (where applicable), and system-generated session or authentication tokens used to verify your identity and keep you signed in.
• User preferences — preferences related to your services, service locations, product preferences, purchase history including profiling.
• Demographic data — Includes but not limited to age, gender, marital status, geographic locations.
• Mobile Application/App usage data — your IP address, ISP, browser and device details, location data, Mobile Application/App usage behaviour, cookies, and similar mobile identifiers or analytics technologies (e.g. in-app SDKs).
• Payment data — your transaction history and payment details processed via our payment gateway provider.
• Social media data — profile picture, name, location, public feed etc of any social media account details you’ve provided to us.
• Child data — where applicable, personal data relating to your child, such as name, date of birth, gender, and developmental or growth information you choose to record using the App’s tools.
• Health data — personal data relating to your or your child’s health that you provide or that is generated through the App’s tracking tools, such as pregnancy or symptom tracking, growth and weight records, and related dates or calculations.
• User input — information that you provide by entering the data into a data entry form.
• Automatic — information that is automatically generated when you visit and/or use our Mobile Application/App.
• Third party — information about you that is obtained from third parties including delivery partners.

Purposes of collection

← Swipe to see all data types →

Source of collection (by data type)

How long we keep your personal data

All the personal data mentioned above will be kept as long as the user account is active, and for up to a maximum of 12 months after the account is deleted for any dispute resolution, security, and audit), after which it will be permanently deleted or anonymised.

3Legal basis for processing your personal data

We comply with the ‘PDPA when we process your personal data. Depending on the respective purpose, we may rely on one or more of the following lawful basis:

• Your consent the App.
• Contract performance, to enforce the Terms and Conditions of using this App.
• Legal obligation, when we are required by law or a court order to process your personal data.
• Our legitimate interests, when have a lawful and reasonable reasons to process your personal data, provided such interests do not override your rights and interests such as fraud prevention and network security.

When we process any information relating to your health, or any information relating to a child we will rely on the following without limitation:

• Your explicit consent
• personal data which is clearly made public by you.
• Purposes related to statistical matter in accordance with law in a manner that is proportionate to the aim pursued, and in accordance with the PDPA.

4Sharing with Third Parties

We do not sell, trade, or otherwise transfer to third parties your personal data. However, we may need to share your personal data with third parties to complete the purposes stated in section 2 above. Broadly, we may share your personal data with the following entities:

• Members of the Hemas Group of Companies: information may be shared with entities within the Hemas Group who provide IT and information security services to us. Information may also be shared within the organisation for product/service improvements, customer profiling, feedback escalations, market research and to conduct advertising.
• Our suppliers / service providers: we may need to engage with a host of external suppliers or service providers to carry out various operational work to support our relationship with you. These suppliers/service providers will be subject to a contractual and legal framework that will stipulate various conditions including but not limited to ensuring the confidentiality and privacy of your personal data. The access they may have will be limited to a need-to-know basis and in so far as strictly necessary for them to provide their services to us. Accordingly, these suppliers/service providers will provide services in relation to (including without limitation) IT infrastructure and support, delivery services, communication services, finance and accounting, audit, market research, legal, data analytics, processing payments, web indexing and search results, scoring, assessing and managing credit risk, customer relationship management, content transmission.
• To government, regulatory or law enforcement authorities: we may share your personal data if we are of the opinion that the applicable laws require disclosure your personal data with the government including but not limited to tax and other regulatory bodies, the police or law enforcement authorities.
• Prospective buyers or sellers, including their advisers: we may be required to share your information in the context of an acquisition, merger, joint-venture, or any other form of change in control or any other form of strategic alliance.

5Use of Automated Decisions Making Systems

We may adopt automated decision-making systems on this Mobile Application/App. Automated decision-making means making decisions or profiling your Personal Data purely through automated means without any human intervention. These systems are generally used to support human decision making processes by analysing your data subject to certain criteria set by us. We may use these systems for evaluation purposes of your preferences and make recommendations or offer personalised services, products or content.

6Use of Cookies and Similar Technologies

We use cookies on our App. Please refer to our Cookie Notice for more information.

7Your Rights

Under the PDPA, you are entitled to the following rights, subject to any exceptions permitted under the PDPA:

• Access: you may access your personal data or get a confirmation whether we process any of your personal data. You may also request further information pertaining to how, where and why we process your personal data.
• Withdraw consent: if we have sought your consent to process your information for any of the purposes listed in Section 2 above, then you may be in a position to withdraw your consent for those particular purpose(s). When you withdraw your consent, we will not be able to process your personal data thereafter. However, your withdrawal will not invalidate any processing which we’ve done prior to such withdrawal.
• Object to processing: if we are processing your personal data pursuant to a legitimate interest of ours or due to public interest, then you may request us to refrain from processing your personal data for said purposes. However, your objection will not invalidate any processing which we’ve done prior to such objection.
• Rectification & update: you have the right to request rectification of any inaccurate data or completion of incomplete personal data which we process.
• Erasure: if you think that we are processing your personal data in contravention to the PDPA, or you have withdrawn your consent regarding any processing that was founded upon your consent, then you may request us to erase your personal data. Any request for deletion will be evaluated against our legal obligations to retain the said data.
• Review of automated decisions: if any decision that affects your rights are taken by us based on purely automated means without human intervention, in certain circumstances you may have the right to request us to review the said decision.

However, please note that the exercise of the above rights is subject to certain conditions stipulated under the PDPA.

You also have the right to make a complaint to the Data Protection Authority of Sri Lanka established under the Personal Data Protection Act No.9 of 2022 regarding our use of your personal data.

8Data security

We are committed to securing your personal data and safeguarding the confidentiality, integrity and availability of your personal data by using appropriate organisational and technical measures.

Some of these measures include, using secure information systems and networks when we transmit and store your personal data, implementing access restrictions and allow access on need-to-know basis to our staff and our external service providers and suppliers, regular training and guidance to our staff on privacy and data protection, use of anonymisation and encryption as appropriate, implementing internal procedures to duly detect and respond to data breaches.

In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.

All transactions are processed through a payment gateway provider and are not stored or processed on our servers.

9International transfers

Your personal data may be transferred and processed outside of Sri Lanka in one or more countries in certain circumstances. Such circumstances may typically arise when your personal data may be stored/hosted on cloud platforms. Whist we strive to process personal data in countries where the Sri Lankan Data Protection Authority has given adequacy decisions, for operational reasons, this may not always be possible. Therefore, we have adopted appropriate safeguards to ensure the security and privacy of your Personal Data through comprehensive contractual and legal means.

10Contact

If you need any clarifications regarding this data protection notice, you may contact us at support@babypedia.lk

To exercise any of your rights under this data protection notice, please complete the following form and sent it to support@babypedia.lk

11Changes to this data protection notice

We may update this data protection notice from time to time to reflect the changes in our services, data protection practices or legal obligations. Any significant changes will be notified by posting the updated notice on our Mobile Application/App, or by contacting you directly through registered channels.

Last updated: 23 June 2026