Legal
Privacy Notice
Matresa Limited — Last updated: 13 August 2026
Legal Documents
The following document sets out how Matresa is designed to be used and the scope of its intended purpose:
Intended Use Statement v1.41Introduction
Matresa Limited (company number 16378985, registered in England and Wales) provides the Matresa mobile application and related web administration system (together, the "Platform"). This notice explains what personal data we collect about you when you use the Platform, why we collect it, who we share it with, and the rights you have under UK data protection law.
This notice applies to individual users of the Platform, whether you have signed up directly or you have been given access by an employer or other organisation providing Matresa as a workplace benefit (an "Organisation"). It should be read together with our Terms of Use, Cookie Policy, AI Transparency Policy and Community Guidelines.
1.1 Who we are
We are Matresa Limited, and we are the data controller responsible for your personal data. Our registered office is at Nelson House, 2 Hamilton Terrace, Leamington Spa, Warwickshire, CV32 4LY, United Kingdom.
1.2 Contacting us
Questions about this notice or your data: admin@matresa.co.uk. You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113, but we would welcome the chance to put things right first.
2The data we collect
We collect the following categories of personal data about you. Most of this is health data that you choose to give us, because that is the purpose of the Platform — this notice does not treat that as an edge case or an afterthought.
| Category | Examples |
|---|---|
| Identity and contact data | Name, date of birth, username, email address, phone number (if given). |
| Account and technical data | Login credentials, device and app version, IP address, device identifiers, crash and diagnostic logs. |
| Health and wellbeing data (special category data) | Your responses to wellbeing check-ins and structured questionnaires (including item-level responses drawn from validated frameworks such as PHQ-9, EPDS and GAD-7); diary entries and notes about your health, symptoms, pregnancy or postnatal recovery; notes about your maternity and clinical appointments; any information you choose to compile to share with your GP or midwife. |
| Wearable and device data | If you connect a wearable device via Apple Health or Android Health Connect: metrics such as heart rate, sleep, steps and heart rate variability. |
| Second Ear recordings and transcripts | Audio recordings you make of your own medical appointments, and the resulting transcript, which will typically also contain the voice and statements of your healthcare professional and anyone else present — see Section 5 below. |
| Community content | Your forum nickname and avatar (not your real name or photo, unless you choose to include identifying information in a post — please don't), posts, comments, and reports you submit. |
| Florrie interaction data | Questions you ask Florrie and the approved content it points you to. |
| Usage data | How you interact with the Platform — features used, content viewed, push notification engagement. |
| Payment data | If you subscribe, confirmation from Apple or Google that you have an active subscription and its price tier. We do not receive or store your card details — these are handled entirely by Apple or Google. |
| Work-related data (Organisation access only) | If you are given access via an Organisation: your name and work email address, used only to set up and administer your account — see Section 6.3. |
2.1 Special category data
Most of the health and wellbeing data described above is 'special category data' under Article 9 of the UK GDPR, which the law treats as more sensitive and gives extra protection. We rely on your explicit consent (Article 9(2)(a) UK GDPR) to process this data, which you give during onboarding before you can use the relevant features, and which you can withdraw at any time — see Section 10.
2.2 Research participation (optional)
Separately from the consent described in Section 2.1, during onboarding we ask whether you would like to opt in to Matresa using your data for research studies aimed at improving the understanding of maternal health and outcomes.
- If you say no, or don't answer, your data is used only for the core purposes described in this notice and is not used for research — it stays within the app.
- If you say yes, we may use your health and wellbeing data for research purposes, on the basis of the explicit consent you give at that point — see Section 4.
You can change your answer at any time in your account settings. Doing so will not affect your ability to use the rest of the Platform, and will not affect any research use that already took place before you withdrew consent.
3How we collect your data
- Directly from you: when you register, complete a check-in or questionnaire, write a diary entry, post in the Community, message support, or ask Florrie a question.
- From your device, with your permission: wearable and health data from Apple Health or Android Health Connect; recordings you make using Second Ear.
- From an Organisation, if applicable: limited account set-up information such as your name and work email address.
- Automatically: technical and usage data collected as you use the app (see our Cookie Policy for the equivalent on our website).
4Why we use your data and our legal bases
We only use your personal data where we have a valid legal basis to do so.
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the core Platform (check-ins, diary, appointment notes, wearable trends, Florrie, Second Ear) | Identity, health and wellbeing data, wearable data, Second Ear data | Contract (Art 6(1)(b)) for account/identity data; explicit consent (Art 9(2)(a)) for health data |
| Operating the Community, including moderation and safeguarding | Community content, identity data | Contract, and legitimate interests (Art 6(1)(f)) in keeping the Community safe |
| Signposting you to your clinical team or emergency services based on static, pre-defined triggers in your check-in responses | Health and wellbeing data | Explicit consent (Art 9(2)(a)); vital interests (Art 9(2)(c)) in the rare case of an immediate safety concern |
| Research studies (optional) | Health and wellbeing data, identity data | Explicit consent (Art 9(2)(a)), given separately at onboarding — you can withdraw at any time; see Section 2.2 |
| Security, fraud prevention, and maintaining the Platform | Account and technical data | Legitimate interests (Art 6(1)(f)) |
| Complying with our legal and regulatory obligations, including as a UKCA-marked Class I medical device manufacturer | Relevant account, health and complaint data | Legal obligation (Art 6(1)(c)) |
| Service improvement and analytics | Usage data; anonymised/aggregated data where possible | Legitimate interests (Art 6(1)(f)), or consent where required for cookies/analytics technologies |
| Marketing communications (optional) | Contact data | Consent (Art 6(1)(a)) — you can opt out at any time |
5Florrie, automated features, and human oversight
Florrie retrieves and directs you to pre-approved Matresa educational content in response to your questions. It does not generate original clinical guidance and does not access the open internet.
We do not calculate a score, severity band, or risk level from your check-in or questionnaire responses, and we do not use your personal data to make any decision about you that is based solely on automated processing and that has a legal or similarly significant effect on you, as described in Article 22 of the UK GDPR. Where the app shows you a signposting reminder, this is a static, pre-defined message, not an automated clinical assessment. Our AI Transparency Policy explains this in more detail.
6Sharing your data
We do not sell your personal data, and we do not use your health data for advertising. We share data only as follows:
- Service providers who help us run the Platform (for example, hosting, transcription for Second Ear, analytics, and customer support tools), under contracts that require them to protect your data and use it only as we instruct.
- Apple and Google, to process payments if you subscribe, and, where you have connected a wearable device, to provide the health data you have authorised through Apple Health or Android Health Connect.
- Your GP, midwife or other healthcare professional — only where you choose to share information with them; they are not users of the Platform and are not obliged to review or act on anything you share.
- Regulators and authorities, including the MHRA and ICO, where we are required to by law, or emergency services, in the rare circumstances described in Section 5.
- Research partners, only if you have separately opted in to research participation during onboarding — see Section 2.2.
- Professional advisers, such as our lawyers, auditors and insurers, where necessary.
- A buyer, if we sell or reorganise our business, subject to the same protections in this notice.
6.1 We do not sell your data or use it for advertising
We do not sell, rent or share your personal data with data brokers or advertisers, and we do not use health data obtained through Apple Health or Android Health Connect for advertising, marketing, or credit or insurance decisions.
6.2 Second Ear and third-party (healthcare professional) data
If you use Second Ear to record your own medical appointment, the recording and transcript will usually also contain the voice and statements of your healthcare professional and anyone else present. You are responsible for telling them the conversation is being recorded — see our Terms of Use. We process this incidental third-party data only to provide the transcription and follow-up-action features to you, on the basis of our legitimate interest in providing a personal note-taking tool you have asked for, balanced against the healthcare professional's own privacy interests.
6.3 Organisations (workplace benefit access)
If you're given access to Matresa by an Organisation, we do not share your individual wellbeing check-in responses, diary entries, Second Ear content or community activity with that Organisation. Any reporting we provide to an Organisation is limited to aggregated, anonymised usage data from which you cannot reasonably be identified.
7International transfers
Your data is primarily hosted on servers in the UK. Some of our service providers may process data outside the UK, including in countries that do not have UK "adequacy" status. Where this happens, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we carry out a transfer risk assessment before relying on them.
8Data security
We protect your data using encryption in transit and at rest, role-based access controls, mandatory multi-factor authentication for administrative accounts, audit logging, and regular security testing. No system is completely secure, but if a breach happens that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours as required by law, and tell you directly if there is a high risk to you.
9How long we keep your data
We keep your personal data for as long as your account is active. If you delete your account (including by cancelling your subscription, as described in our Terms of Use), we will delete or anonymise your personal data within a set period, except where we need to keep limited information for longer:
- To comply with a legal or regulatory obligation — for example, as a medical device manufacturer we may need to retain certain safety and complaint records for a minimum period after a product version is withdrawn, even after your account is deleted, generally in an anonymised or pseudonymised form wherever possible.
- To establish, exercise or defend legal claims.
- Where we are required to keep financial records for tax purposes (typically up to 6 years).
10Your rights
Under UK data protection law, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Erase your data (the "right to be forgotten"), subject to the exceptions in Section 9.
- Restrict or object to our processing of your data, including processing based on legitimate interests.
- Receive a copy of your data in a portable format, or ask us to transfer it directly to another provider, where technically feasible.
- Withdraw consent at any time, where we rely on consent (including your separate research consent — see Section 2.2) — this will not affect anything we did before you withdrew it, but may mean some features stop working.
- Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you — as explained in Section 5, we do not make such decisions.
To exercise any of these rights, contact us at admin@matresa.co.uk or use the in-app account settings. We will normally respond within one month.
11Children
Matresa is intended for adults aged 18 and over. We ask for your date of birth at registration to help confirm this. If we discover that we have collected personal data, including health data, from someone under 18 without an appropriate basis for doing so, we will delete it promptly.
12Cookies
Our website uses cookies and similar technologies. See our Cookie Policy for full details and how to manage your preferences.
13Marketing
We will only send you marketing communications if you have given consent, or where otherwise permitted by law, and you can opt out at any time using the unsubscribe link or by contacting us.
14Changes to this notice
We may update this notice from time to time. The current version will always be available on the Platform, and we will tell you about significant changes.
15Contact us
Email admin@matresa.co.uk, or write to us at Nelson House, 2 Hamilton Terrace, Leamington Spa, Warwickshire, CV32 4LY, United Kingdom.