Last updated: May 6, 2026
This English version is a non-binding convenience translation of the German privacy policy. The German version is the legally binding version. If this translation differs from the German version, the German version prevails to the extent permitted by mandatory law.
This privacy policy explains how HebaMama processes personal data when you use the website, registration, login functions, Mama and Maia dashboards, search, request, course, booking, document and security functions. HebaMama is a platform for arranging and organising contacts between Mamas and midwives. The platform is not an emergency or acute care service.
The controller responsible for data processing is:
HebaMama UG (haftungsbeschränkt)
Mondstraße 28
81543 Munich
Germany
Email: info@hebamama.com
Privacy requests may be sent to the email address above. If a data protection officer is required by law or appointed, the relevant contact details will be added to this policy.
This policy applies to all web functions provided by HebaMama, in particular public pages, registration, login, email verification, password and email change, Mama profiles, Maia profiles, Mama requests, Maia courses, course bookings, daily info emails, document uploads, admin checks, support and security functions.
We process personal data only where this is necessary to provide, secure, administer and improve the platform, or where there is a legal obligation, consent or legitimate interest.
Where Mamas or midwives voluntarily provide information relating to health data, pregnancy, birth, postpartum care, breastfeeding, child data or similarly sensitive information, special categories of personal data within the meaning of Article 9 GDPR may be affected. Processing takes place only to provide the expressly requested platform functions and, where required, on the basis of explicit consent pursuant to Article 9(2)(a) GDPR. Consent may be withdrawn at any time with effect for the future. Withdrawal may mean that individual platform functions can no longer be provided.
The website is operated on servers of Hetzner Online GmbH. The servers are located within the European Union. Server and proxy log files are processed for the technical delivery of the website and to secure operations.
In particular, the following data may be processed:
The purpose of processing is to provide the website, analyse errors, detect misuse and attacks and ensure availability. The legal basis is Article 6(1)(f) GDPR. Server log files are generally stored only for as long as required for these purposes; the current operational standard period is no more than 14 days, unless a security review or legal obligation requires longer storage.
When registering and managing a user account, we process in particular:
Email addresses, names and further profile content are stored encrypted according to the technical protection concept; an additional hash of the email address is used for unique login and lookup. Passwords are stored using a password hashing procedure. Verification and reset tokens are stored only as hashes and are time-limited. The current validity periods are 15 minutes for email verification and password reset links and 5 minutes for OTP codes for account changes and admin login. Access tokens are time-limited; refresh tokens are technically limited to 7 days and are additionally restricted by the configured inactivity timeout.
The purpose is to create, secure and manage the account. The legal basis is Article 6(1)(b) GDPR; for security and abuse protection additionally Article 6(1)(f) GDPR.
If you use the platform as a Mama, we process the profile and contact data you enter, in particular:
This data is used so that midwives can review suitable requests, contact you and organise services or courses. If you enter child data, you confirm that you are authorised to provide this data. The legal basis is Article 6(1)(b) GDPR; for special categories of personal data additionally Article 9(2)(a) GDPR where consent is required.
If you use the platform as a Maia or midwife, we process in particular:
Documents are scanned server-side for malware and then stored encrypted. Identity documents and professional documents serve in particular to review and approve the midwife profile. Treatment contract and information material may be shown to Mamas if there is authorised access under the platform model, for example after an accepted request or course booking. Identity documents and professional diplomas/certificates are not made available for download to Mamas.
The legal basis is Article 6(1)(b) GDPR; for review, security and abuse prevention additionally Article 6(1)(f) GDPR.
For Mama requests, midwife services, courses and bookings, we process in particular:
Open Mama requests may be shown to midwives within the search and filter logic. If a midwife enables the daily info email, open Mama requests in the saved search radius may also be summarised once per day in a tabular email. This info email does not include the Mama's email address or phone number. As soon as a request is accepted, a course booking is created or treatment is initiated, the required contact, profile, request and course data may become visible between the respective participating Mamas and midwives. The purpose is matching, organisation, communication, performance and documentation of the requested services. The legal basis is Article 6(1)(b) GDPR; for documentation, security and abuse prevention additionally Article 6(1)(f) GDPR.
For radius search, HebaMama processes addresses, postal codes, search radii and geocoordinates derived from them. During search, temporary search values such as radius and postal code may also be stored in the session without changing the permanently stored profile.
For address search and geocoding, the platform uses Nominatim based on OpenStreetMap. The entered address or postal code, technical request data and an application-related User-Agent are transmitted to the Nominatim service. We do not transmit names, passwords or profile texts to Nominatim. However, if an address is a private address, the address itself may already be personal data.
Maps are displayed using OpenStreetMap tiles. When loading a map, your browser may transmit technical data such as IP address, browser information, referrer and the requested map tiles to OpenStreetMap servers. The legal basis for geocoding and map display is Article 6(1)(b) GDPR where this is required for the requested search and display, and Article 6(1)(f) GDPR for a user-friendly and secure platform display.
HebaMama sends transactional emails, in particular for registration, email verification, password reset, account changes, admin OTP, legal information, system-related notices and, where enabled by the midwife, the daily info email about open Mama requests in the saved search radius. For this purpose, we process email address, name, language, email content, sending time and technical delivery data.
Emails are sent via Mailjet by Sinch, an email delivery and SMTP service for transactional emails. In particular, recipient address, sender data, subject, message content, PDF attachments where applicable, and technical sending, delivery and error data are transmitted to Mailjet. This may also include events such as bounce, blocked or spam complaint signals where this is required for secure delivery, error analysis and suppression of undeliverable recipient addresses. Mailjet is used only for transactional platform emails, not for advertising tracking.
The legal basis is Article 6(1)(b) GDPR for contract- and account-related emails and Article 6(1)(f) GDPR for security, system and deliverability notices. Where required, contractual data processing terms pursuant to Article 28 GDPR are in place with Mailjet. According to Mailjet's security and privacy information, data is stored in data centres in Frankfurt (Germany) and Saint-Ghislain (Belgium).
To protect registration and login functions against automated abuse, HebaMama may use hCaptcha. The provider is Intuition Machines, Inc., USA. When hCaptcha is loaded and solved, technical data such as IP address, browser and device information, interaction data, referrer and the result of the challenge may be transmitted to hCaptcha.
The purpose is to distinguish human use from automated attacks and to protect user accounts and infrastructure. The legal basis is Article 6(1)(f) GDPR. Where hCaptcha requires consent, Article 6(1)(a) GDPR is the legal basis.
HebaMama uses technically necessary cookies and session data. These include in particular:
Authentication cookies are set as HTTP-only and SameSite=Lax; in appropriately configured environments they are also set as Secure cookies. Technically necessary cookies and session values are required to provide the expressly requested platform functions, protect logins, prevent CSRF attacks and remember language settings. The legal basis is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. Access to terminal equipment is used for strictly necessary functions pursuant to Section 25(2) TDDDG without separate cookie consent.
HebaMama currently does not use web analytics, marketing or tracking cookies.
For platform administration, authorised admins may access and edit data where this is necessary for review, approval, support, abuse prevention, legal enforcement or technical troubleshooting. When approving or rejecting midwife profiles, review decisions, admin ID, comments and timestamps may be stored in audit logs.
The legal basis is Article 6(1)(b) GDPR where processing is required to provide the platform, Article 6(1)(f) GDPR for security, support and documentation interests and Article 6(1)(c) GDPR where legal obligations are involved.
Personal data is disclosed only where this is required for platform functions, technical provision, security, legal obligations or enforcement of rights.
Where required, data processing agreements pursuant to Article 28 GDPR are concluded with processors.
In principle, we operate the core platform within the European Union. According to Mailjet's security and privacy information, email delivery is processed via data centres in Frankfurt (Germany) and Saint-Ghislain (Belgium). When emails are delivered to recipient mailboxes, a transfer to servers outside the European Union or the European Economic Area may nevertheless occur if the relevant recipient mailbox or mail service is operated there. For individual services, in particular hCaptcha, OpenStreetMap/Nominatim or in the context of individual support, operations or security processes of service providers, a third-country connection cannot be fully excluded. Where required, such transfers are based on an adequacy decision, EU Standard Contractual Clauses or other appropriate safeguards pursuant to Articles 44 et seq. GDPR.
We store personal data only for as long as required for the respective purposes or for as long as statutory retention, documentation or limitation periods apply.
HebaMama uses technical and organisational measures to protect personal data. These include in particular HTTPS, security headers, CSRF protection, HTTP-only cookies, role-based access controls, inactivity timeouts, hashing of passwords and tokens, encryption of sensitive profile data and documents, virus scans for uploads, access restrictions for admin functions, logging of security-relevant events and regular backups.
Subject to the GDPR, you have in particular the following rights:
To exercise your rights, you may contact info@hebamama.com. To process your request, it may be necessary to verify your identity.
If we process data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. If we process data on the basis of consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority may in particular be the authority of your place of residence, place of work or the place of the alleged infringement. For Bavaria, this is usually the Bavarian State Office for Data Protection Supervision, unless another authority is competent.
The provision of certain data is required for registration, login, profile completeness, search, matching, requests, course bookings or document review. Without this data, individual functions cannot be used or can be used only in a limited way. Voluntary information is required only if you want to use the associated function.
HebaMama does not make solely automated decisions with legal effect or similarly significant effects within the meaning of Article 22 GDPR. Search and table views may be filtered and sorted by criteria such as radius, location, status, time, profile or course characteristics. Admin approvals are not carried out solely automatically.
We may update this privacy policy if technical functions, legal requirements, service providers or processing activities change. The current version is available on the website.
Download Privacy Policy (PDF)