Trust
Security and data protection
How we protect what you send us — and what we deliberately never ask for. Last updated 2026-10-02.
Data minimisation first
The most reliable control is not collecting the data. Our forms are designed around that principle rather than around what would be convenient for us.
What we collect
Name, contact details, ZIP code, and what your inquiry is about. On the patient form, that answer can reveal the kind of fertility care you are looking for.
What we ask you not to send
Medical records, diagnoses, symptoms, imaging, genetic results, or insurance identifiers. We do not need them and we do not want them in an inbox.
What we never do
Sell your information, share it with employers or clinics without your separate written consent, or set advertising and tracking cookies.
Controls on this website
- HTTPS everywhere, with HTTP Strict Transport Security enforced
- Security headers including nosniff, frame protection, and a strict referrer policy
- A restrictive permissions policy disabling camera, microphone, and geolocation
- Cloudflare Turnstile and a hidden honeypot field on forms to separate people from bots, without advertising cookies
- Server-side validation of every form submission, not only in the browser
- Encryption in transit over HTTPS, and at rest by default in the AWS database that stores submissions
Operational practice
- Website hosted with Amazon Web Services and served through Cloudflare
- Submissions stored in an AWS database and delivered by email to the MyBabyBridge team
- Inquiries kept as long as needed to respond and follow up
- Deletion on request once we confirm the request comes from you, unless the law requires us to keep something
Reporting a vulnerability
If you believe you have found a security issue, email hello@mybabybridge.com with enough detail to reproduce it. We will look into it.
We ask that you do not access, modify, or remove data belonging to anyone else, do not degrade the service for others, and give us a reasonable opportunity to remediate before public disclosure.
Common questions
- Do you hold health information?
- We do not ask for medical records, diagnoses, symptoms, or test results, and we ask people not to send them through this website. An inquiry can still say something about your health, though: the patient form asks what you are looking for, such as a fertility assessment or a semen analysis. That question is optional, and you can choose “Prefer not to say”. Some state laws treat information like this as consumer health or sensitive data.
- Are you HIPAA covered?
- This website is not a vehicle for protected health information, and we do not claim a covered-entity or business-associate status that our current activities do not require. If a future service involves protected health information, the applicable obligations would be established in writing before that service launched.
- Where is data stored?
- Form submissions are stored with Amazon Web Services and delivered by email to the MyBabyBridge team. Submissions travel over HTTPS, and the AWS database that stores them encrypts data at rest by default. The website is served through Cloudflare, so form submissions pass through Cloudflare on their way to AWS.
- Do you share data with employers or clinics?
- No. Submissions are not shared with employers, clinics, or vendors without the individual's separate written consent. Employer conversations do not require, and do not receive, employee-level information.
- Do you track visitors?
- Minimally, and without cookies. We use Cloudflare Web Analytics, which sets no cookies and builds no profile, plus a small set of first-party events such as page viewed and form completed. Those events contain no name, email address, IP address, device identifier, or form content.
- How do I report a security issue?
- Email hello@mybabybridge.com with the details and how to reproduce the issue. We will acknowledge it, investigate, and tell you what we found. Please give us a reasonable opportunity to fix an issue before disclosing it publicly, and do not access, modify, or exfiltrate anyone else's data while testing.
See also the privacy notice and the terms of use.
Evaluating us for your workforce?
Ask us anything about how information is handled before you share a single employee record — because you should not need to share one.