Privacy policy
Last updated 24 October 2026 · See also the terms of use
Little Cat is a shared care diary for families looking after a baby or child, including children who have seizures. It holds sensitive health information about your child, so this page sets out plainly what is stored, where, who can see it, and what you can do about it.
In short: your child’s health information
- We never sell it, never use it for advertising or marketing, and never share it with insurers, employers or anyone else.
- Only the people you invite can see your diary. Ebor Labs staff don’t look at it unless you ask us to help with a problem, or the law requires it.
- Which services handle it, and why:
- Supabase (London, UK) stores the diary so it’s on every family phone. Always.
- Anthropic’s Claude reads the parts you choose (a letter, a label, the entries for a summary), and Claude’s opinion on a result for the one family that has it, only for families with Little Cat Pro, only when you use an AI feature. Anthropic doesn’t use it to train its AI.
- Google or Apple deliver alerts to your phone (a short message such as “Sam started the seizure timer”).
- Resend sends the email that confirms your address, the weekly report if you turn it on, the Little Cat Pro emails to the parent who pays (the confirmation, the reminder before a free trial ends, the reminders before a yearly renewal and every 6 months on a monthly plan), and the warnings before an unused diary is deleted (which name the diary).
- Stripe takes the payment if you buy Little Cat Pro. It gets your name, email, card and billing details, never anything from the diary.
- It only goes further if you send it: a care-team link, a calendar feed, a PDF or a backup you share yourself.
The details are below.
Who is responsible for your data
Little Cat is provided by Ebor Labs Ltd, Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole BH16 6FA, United Kingdom. Ebor Labs Ltd is the data controller and is registered with the Information Commissioner’s Office (registration ZC274576).
To ask a question, get a copy of your data, or make a request about it, email littlecat@eborlabs.com or write to Ebor Labs Ltd at the address above. We aim to reply within one month.
What we store
- Your account: your name, email address and password (stored only as a secure hash), or a passkey if you turn on fingerprint or Face ID. The passkey itself stays on your phone.
- Your child’s diary: what you and the people you invite enter: seizures, sleep, feeds, nappies, medicines and doses, temperatures, appointments, notes, vaccinations, growth, and the profile (name, date of birth, NHS number, conditions, allergies, rescue plan, contacts).
- Files you add: photos, videos and documents such as clinic letters. Location data is removed from photos before upload; short videos that aren’t re-compressed can keep the location the camera recorded.
- Seizures timed but not logged yet: when the seizure timer is stopped and someone starts it again before that seizure is logged (on a view-only phone, say), the earlier timing is kept on our servers with its start and end, who timed and stopped it, and when it was kept, so it isn’t lost. Only your family can see it. It stays until a parent or carer logs it (it then becomes the seizure entry) or discards it, and is deleted with the diary.
- This phone’s notification address, if you turn on notifications, so reminders and seizure-timer alerts can reach it.
- How much AI your family uses, if you have Little Cat Pro: how many AI actions each person and diary used each day, and for each one the type of feature and how many words (tokens) the AI read and wrote. Never what was asked or answered. This keeps the daily and monthly fair-use limits, and lets us check the price against what the AI costs.
- Your Little Cat Pro subscription, if you have one: the plan, whether it’s running, when it started and next renews, who pays, and when we last sent them a renewal reminder (so the reminders the law asks for go at the right time, once). Never card details, which stay with Stripe.
- Feedback and complaints you send from More › Settings: your message, with your name, email address and app version, so we can reply; where it has got to (received, replied, closed, and the outcome); whether you told us you were happy with our response, and any comment you added; and our own notes on how we dealt with it. When we reply or close it we email you to ask if you’re happy. You can see your messages and their progress in the same place. Kept 2 years.
We don’t use advertising, analytics or tracking, and we never sell or share your data for marketing.
Why we use it
Only to run the diary for your family: to show it on everyone’s phones, sync it, send the reminders and alerts you ask for, and make the summaries and documents you choose to create. Under UK GDPR, the lawful basis is providing the service you asked for (Article 6(1)(b)). Your child’s health information is special category data, used with your explicit consent (Article 9(2)(a)). A parent gives it by ticking a separate statement when they start the diary (it is recorded with the date and the exact wording), and can withdraw it at any time by deleting the diary.
Who can see it
The people your family invites, each with their own account and a role: parent, carer, nursery or childminder (the last 24 hours of everyday care, the child’s emergency details and their medicines), or view only (reads the diary and can start and stop the seizure timer, but can’t log). Access is enforced by the database, not just the app. A parent can remove anyone at any time.
Things a parent can choose to turn on, each of which shares some information beyond those accounts:
- Care-team links: anyone with the link (no account needed) can see a read-only summary for the period chosen: your child’s name, date of birth, NHS number, conditions, allergies, rescue plan, medicines and clinical entries (seizures, doses, results and so on). Links expire, and a parent can turn one off at any time.
- Calendar feeds: your calendar app (for example Apple or Google Calendar) fetches and keeps the appointments: their titles, places and times.
- The weekly email: sent to your email address with your child’s name and that week’s counts (seizures, rescue medicine, missed doses, lost skills), so your email provider holds it.
- The emergency card on the lock screen: anyone holding the phone can see the rescue plan, medicines, allergies and NHS number without unlocking the diary.
Where it is kept, and who processes it for us
| Service | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions. Encrypted in transit and at rest. | London, UK |
| Netlify | Serves the app’s own files to your phone. It doesn’t receive diary data. | Global network |
| Anthropic (Claude) | Only for families with Little Cat Pro, and only on phones where AI features are on (they’re on for the parent who starts Pro, as the offer says; everyone else in the family is asked on their own phone, and anyone can turn them off in Settings). Nothing is sent until you use a feature: the assistant, in the “Ask or tell” box on Today and in Help › Ask (your question and the earlier turns of that chat; and, only when your question is about the diary, the last 90 days of entries with your child’s name, date of birth, conditions and medicines. How-do-I questions are answered from the app’s help guide without reading the diary, and nursery and view-only accounts never have the diary sent), reading photos, letters and medicine labels with “Read it for me” (a copy of the file; in Records this happens when you add a photo, screenshot or PDF while its “Read it for me” switch is on, which starts off on each phone, and videos are never sent), saying what happened in the “Ask or tell” box (your words; the box decides on the phone whether you asked or told, and asks you if unsure), diary summaries (the entries for that period with your child’s name, date of birth, conditions and medicines), and, for one family only (the app owner’s; it isn’t offered to anyone else) and if a parent turns it on, Claude’s opinion on a test or report (the report or its file, earlier tests, medicines and recent seizures). Not used to train AI. | May be processed in the US, under Anthropic’s data processing terms with standard contractual clauses for international transfers |
| Your phone’s speech service (Google or Apple) | Only if you speak into “say what happened”: your phone turns speech into text before it reaches the app. | Google or Apple |
| Resend | Sends the email that confirms your address when you sign up, the weekly report email if you turn it on in Settings, the Little Cat Pro emails to the parent who pays (the confirmation, 3 days before a free trial ends, about 14 days before a yearly renewal, and every 6 months on a monthly plan, which give the price and, every 6 months, what was paid and how many AI actions the family used), and the warnings to every parent before an unused diary is deleted (these name the diary). | EU/US |
| Stripe | Only if you buy Little Cat Pro: takes the payment. Stripe receives your name, email address, card and billing details such as your billing address (we never see the card number), and a reference to your diary and to your account as the parent paying, never anything written in it. | UK/EU/US, under Stripe’s data processing terms |
| Your phone’s push service (Google or Apple) | Delivers notifications to your phone. Notification text can include your child’s name and the reminder. | Google or Apple |
A copy of the diary is also kept on each phone so the app works without a signal. With Little Cat Pro, the last-24-hours summary written on a phone is kept on that phone until the end of the day (so it isn’t written twice), and is removed when you sign out. Supabase keeps daily database backups for 7 days, and server logs for a short time, for recovery and security. Photos, videos and documents are also copied, encrypted, to a separate Supabase backup in London that only Little Cat's server can read; when a file or diary is deleted, its backup copy is removed 14 days later.
How long we keep it
For as long as your family uses the diary. Deleted photos, videos and documents are removed for good after 30 days. Deleted diary entries are hidden (so they can be restored) until the diary itself is deleted. When the last parent deletes their account, the whole diary, its files and its notification addresses are deleted. A nursery or childminder account only ever sees the last 24 hours. Diaries nobody uses: if nobody in the family opens Little Cat for 2 years, the diary is deleted with its photos, videos and documents. Before that we warn every parent by email, and every family phone with an alert, 30 days and again 7 days before. Opening the app on any family phone keeps it. Diaries with Little Cat Pro running are not deleted this way. Cancelling Little Cat Pro deletes nothing: the diary, files and summaries stay, the AI features stop, and the diary’s storage goes back from 20 GB to 2 GB (if it’s over, nothing is deleted; new files just can’t be added). AI usage counts are kept 40 days, and the per-action records 13 months. Payment records (amounts, dates and the email used, never diary content) are kept by Ebor Labs and Stripe for 6 years because UK tax law requires it, even after the diary is deleted.
Your choices and rights
- See and download everything: More › For the doctor › Full backup: the whole diary (every child, entry, medicine, comment and change) as one file, and the photos, videos and letters as a second download.
- Correct anything: open the entry and change it.
- Turn off AI features on any phone: More › Settings.
- Delete your account: More › Settings › Delete my account. If you’re the only parent, the whole diary is deleted with it.
- You can also ask for access, correction or deletion, object to how your data is used, or complain to the Information Commissioner’s Office (ico.org.uk).
Children
Little Cat is for parents and the adults who care for a child. The child’s information is entered by those adults. The app isn’t meant to be used by children.
Medical information
Little Cat is not a medical device, and its health advice has not been reviewed by a clinician. You use it at your own risk. It’s a diary. It doesn’t diagnose and it never works out doses. For one family only (the app owner’s; it isn’t offered to anyone else), a parent can turn on Claude’s opinion on test results and reports; it is always labelled as an AI’s opinion, not a doctor’s, and never suggests doses or treatment. Its health advice is taken from nhs.uk (and, only where nhs.uk has nothing, other UK sources), with a link to the page under each piece of advice. In an emergency, call 999.
Changes
If this policy changes, the date at the top changes and the app’s “What’s new” says so.