Legal
WeWomen beta privacy policy
Last updated: 9 November 2026
This English version is a translation provided for convenience. In case of discrepancy, the Spanish version prevails.
This policy explains how the personal data of the people taking part in the WeWomen beta (the “Beta Version” and the “Participant”) is processed. It expands on clause 13 of the Beta Version Terms and Conditions, which the Participant accepts when activating her access. In case of discrepancy, the Terms and Conditions prevail.
1. Data controller
BAUBER.XYZ, S.L., tax ID (NIF) B93944700, registered office at Rambla del Poblenou, 38, 08005 Barcelona, Spain, which provides the WeWomen service (“WeWomen”). Contact email: hola@wewomen.health.
WeWomen’s business is expected to be contributed to a newly incorporated company, which will become the data controller. WeWomen will inform the Participant by email at least thirty days in advance, under the terms of clause 1 of the Terms and Conditions.
2. What data is processed
Account data. Email address, user identifier and password, which is stored encrypted and never in plain text.
Content provided by the Participant. Chat conversations, the files she attaches, the documents she uploads and the information extracted from them, diary notes and consultation transcripts.
Data from connected devices. If the Participant connects Apple Health, Health Connect or a wearable, such as the Oura ring, the sleep, activity, heart rate, temperature, cycle and similar data they provide. WeWomen only reads this data: it does not write to these services, disclose the data to third parties or use it for advertising.
Derived information. The facts, episodes and patterns the system extracts from the above in order to remember them, always with an indication of their source.
Healthcare professional’s data. If the Participant transcribes a consultation, the transcript also contains the voice and data of the professional seeing her.
Questionnaire answers. Processed under a code, without the Participant’s name or email.
Technical and usage data. Access logs, error reports and usage statistics, such as which screens are opened or what kind of actions are taken. These statistics do not include the content of queries or any health data and are linked to a pseudonym, not to the account.
Notification data. The device identifier needed to send notifications, only if the Participant agrees to receive them.
No payment or payment data is requested during the Beta Version.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Managing participation in the Beta Version and providing the service. | Performance of the Terms and Conditions (art. 6(1)(b) GDPR). |
| Processing health information to answer the Participant’s questions and build her history. | Explicit consent (art. 9(2)(a) GDPR), collected through a specific checkbox, separate from acceptance of the Terms and Conditions. |
| Analysing questionnaires and feedback to improve the product. | Consent (art. 6(1)(a) GDPR). |
| Keeping in the Participant’s history a transcript that contains the healthcare professional’s data. | Legitimate interest (art. 6(1)(f) GDPR), with the permission the Participant must obtain from the professional before transcribing. |
| Keeping the service secure and stable and fixing errors. | Legitimate interest (art. 6(1)(f) GDPR). |
| Producing usage statistics without content or health data. | Legitimate interest (art. 6(1)(f) GDPR). In the web app, consent to cookies (art. 6(1)(a) GDPR), which can be withdrawn from the Profile. |
| Sending periodic notifications and tips. | Consent (art. 6(1)(a) GDPR), which can be turned off at any time from the Profile. |
| Complying with WeWomen’s legal obligations. | Legal obligation (art. 6(1)(c) GDPR). |
WeWomen does not use the data for advertising, does not sell it and does not use it to train artificial intelligence models, nor does it allow its providers to do so. WeWomen does not make automated decisions with legal or similarly significant effects on the Participant.
4. Recipients
WeWomen works with providers that process data on its behalf and following its instructions, under a data processing agreement (art. 28 GDPR).
- Hosting and database. Google Cloud (Firebase).
- Language models. Google (Gemini, Vertex AI).
- Consultation transcription. Listen.Doctor.
- Email communications. Google (Google Workspace).
Data is not disclosed to third parties except where required by law or in the transfer described in section 1 (art. 21 of the Spanish Data Protection Act, LOPDGDD). WeWomen does not sell data or disclose it to employers, insurers or advertisers. When a company offers WeWomen to its staff, it will never receive individual data about the Participant. WeWomen will only provide data to the authorities in response to a valid legal request, will review each request and will inform the Participant unless the law prevents it.
5. Where the data is processed
Data is stored in Google Cloud, in the europe-west4 region (Netherlands), within the European Economic Area. Processing by the language models may take place in data centres outside the European Economic Area. In that case, the transfer is covered by the safeguards in Chapter V of the GDPR, such as the European Commission’s standard contractual clauses signed with Google. The Participant may request a copy of these safeguards by writing to hola@wewomen.health.
6. How long the data is kept
Data is kept for as long as the Participant keeps her account. The Participant may delete specific documents, notes or consultations at any time, and the information extracted from each one is deleted with it. The audio of voice notes and consultations is deleted as soon as it has been transcribed.
If the Participant asks for her account to be deleted, or if the Beta Version ends without a public version, the data will be deleted within a maximum of 30 days, except data that must be kept by law, which will be blocked for the legal period.
7. Security
WeWomen applies appropriate technical and organisational measures, such as encryption of data in transit and at rest, per-account access control, recording the source of each piece of data and data minimisation in technical logs. If a security breach posed a high risk to the Participant, WeWomen would inform her and notify the Spanish Data Protection Agency as required by law.
8. The Participant’s rights
The Participant may exercise her rights of access, rectification, erasure, objection, restriction and portability, and withdraw her consents at any time, without affecting the lawfulness of prior processing. She can do so from the Consents section of the app or by writing to hola@wewomen.health. If she withdraws consent for health data, WeWomen will no longer be able to provide the service and will delete that data within the period set out in section 6.
The Participant may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
9. Research with anonymised data
If WeWomen wished to use anonymised data for research purposes, it will ask the Participant for specific, separate and optional consent. Refusing will not affect her participation in the Beta Version.
10. Minors
The Beta Version is intended exclusively for people over 18.
11. Changes to this policy
WeWomen may modify this policy while the Beta Version is available and will communicate relevant changes by email before they apply. If the Participant does not agree, she may leave the Beta Version at any time.