Privacy Policy

Privacy Policy

Last updated: 28 April 2026

1. Introduction

This Privacy Policy explains how Blossoming Buddies Ltd collects, uses, stores, and protects personal data when people use the Blossoming Buddies childcare platform.

Blossoming Buddies is used by childcare providers, staff, parents, and guardians to support daily care logging, observations, EYFS tracking, safeguarding records, parent communication, photos, media sharing, reports, and summaries.

For the purposes of UK data protection law, Blossoming Buddies Ltd is the data controller for the personal data we process for our own business and platform purposes. In many childcare records, the childcare provider may also be a controller for the information they decide to collect, record, and share through the service.

Our website is https://blossomingbuddies.com. You can contact us at hello@blossomingbuddies.com.

2. Data we collect

We collect and process different types of information depending on your role and how the service is used.

Account data may include names, email addresses, roles, setting membership, login details, authentication records, account status, invite details, and preferences.

Child data may include a child name, date of birth, profile information, attendance records, meals, naps, toileting, medication notes, allergies, dietary needs, medical information, emergency contacts, authorised collectors, collection passwords, developmental observations, EYFS information, summaries, reports, accident records, incident records, safeguarding notes, and consent settings.

Messages may include messages between staff and parents, setting updates, reminders, communication records, timestamps, sender details, and delivery information.

Photos and media may include child photos, observation images, profile photos, captions, upload metadata, consent-controlled visibility settings, and storage references.

Usage and device data may include device type, operating system, app version, IP address, log data, sync status, crash information, authentication events, approximate usage times, and security audit information.

3. How data is used

We use personal data to:

• provide and operate the Blossoming Buddies service;
• create and manage accounts;
• support role-based access for staff and parents;
• record daily care, attendance, observations, accidents, incidents, and safeguarding information;
• support parent communication and messaging;
• manage photos and consent-controlled sharing;
• prepare reports, summaries, and EYFS-related records;
• support offline-first sync and data recovery;
• maintain audit logs and record integrity;
• secure the service and prevent unauthorised access;
• respond to support requests;
• comply with legal, safeguarding, regulatory, and accounting obligations;
• improve reliability, performance, and usability.

4. Child data protections

Child data is sensitive and is treated with particular care.

Access to child data is limited by role, setting membership, and parent-child links. Parents and guardians should only see information about children they are authorised to access. Staff access is controlled by the childcare provider and should reflect each person's role and responsibilities.

Photos are stored in private storage and are shared according to consent and access settings. Observations may be reviewed or moderated by authorised staff before parents can see them.

Safeguarding, accident, incident, attendance, pickup verification, and similar records may be retained for long periods to protect children, support legal duties, and preserve record integrity.

5. AI usage

Blossoming Buddies may include assistive AI features to help staff draft, organise, or review observations, summaries, EYFS wording, and reports.

AI is assistive only. Suggestions may be inaccurate, incomplete, inappropriate, or unsuitable for a particular child or situation.

Staff must review and approve any AI assisted wording before it is used, saved, or shared with parents.

AI features do not provide legal, medical, educational, safeguarding, or professional advice. Blossoming Buddies does not use AI to make automated decisions about children, staff, parents, safeguarding, admissions, care, or compliance.

6. Legal bases under UK GDPR

We rely on different legal bases depending on the purpose of processing.

Contract: to provide the service, manage accounts, deliver features, support users, and communicate about the platform.

Legal obligation: to support records and processes that may be needed for childcare, safeguarding, accounting, tax, regulatory, or legal requirements.

Legitimate interest: to keep the service secure, maintain audit logs, prevent misuse, improve reliability, support childcare administration, and protect children, users, settings, and our business.

Consent: where consent is required, such as some photo and media sharing choices or optional communications. Consent can usually be withdrawn, but withdrawing consent does not affect processing that has already taken place or records we must retain for legal, safeguarding, or legitimate purposes.

7. Data sharing

Within a setting, child data may be shared with authorised owners, admins, practitioners, and other staff where needed for childcare, safeguarding, communication, reporting, or setting administration.

Parents and guardians may see information about their linked child or children, subject to access controls, consent settings, moderation, and setting configuration.

We use trusted service providers to host, store, secure, support, and operate the service. These may include cloud hosting, database, storage, authentication, messaging, analytics, monitoring, support, and payment providers. Service providers must process data only for agreed purposes and with appropriate safeguards.

We may share information where required by law, regulation, court order, safeguarding concern, law enforcement request, regulator request, or to protect children, users, settings, our rights, or service security.

8. Data retention

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer period is required for legal, safeguarding, regulatory, audit, accounting, dispute, or legitimate childcare reasons.

Account records are usually kept while the account is active and for a reasonable period afterwards.

Routine operational records may be retained according to setting needs, legal requirements, and platform backup schedules.

Safeguarding, accident, incident, attendance, pickup verification, and child welfare records may be retained long-term because they can be needed for statutory duties, insurance, complaints, safeguarding reviews, legal claims, or regulatory enquiries.

Some records may be soft-deleted, archived, or hidden from normal app views while still being retained for audit, safeguarding, or legal reasons.

9. Security measures

We use technical and organisational measures designed to protect personal data, including role-based access, authentication, private storage for child photos and media, audit logging, access controls, encrypted transport, backup processes, monitoring, and offline-first sync safeguards.

No system can be guaranteed completely secure. Users must keep login details and devices secure and report suspected unauthorised access promptly.

10. User rights under UK GDPR

Depending on the circumstances, you may have rights to:

• access your personal data;
• correct inaccurate personal data;
• request deletion of personal data;
• restrict processing;
• object to processing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to the UK Information Commissioner's Office.

Some rights may be limited where data must be retained for safeguarding, legal, regulatory, audit, or legitimate childcare reasons.

To exercise your rights, contact hello@blossomingbuddies.com. Parents may also need to contact their childcare provider where the provider controls the relevant childcare record.

11. Data transfers

We may use service providers that process data outside the UK. Where this happens, we use appropriate safeguards required by UK data protection law, such as adequacy regulations, approved contractual protections, or other lawful transfer mechanisms.

12. Updates to this policy

We may update this Privacy Policy from time to time. If we make important changes, we may notify users in the app, by email, or by another appropriate method. You may be asked to review and accept updated legal documents before continuing to use the service.

13. Contact

Blossoming Buddies Ltd

Email: hello@blossomingbuddies.com

Website: https://blossomingbuddies.com

If you are unhappy with how your data is handled, you can contact us first so we can try to help. You also have the right to complain to the UK Information Commissioner's Office.