Effective date: 22 July 2026

This Privacy Policy explains how Winnie'z Care, based in Cairo, Egypt (“Winnie’z,” “we,” “us,” or “our”) collects, uses, shares, stores, and protects personal data through the Winnie’z websites, applications, portals, and related services (collectively, the “Platform”).

We recognize that the Platform may contain sensitive information about children and their support journeys. We design access around roles and responsibilities so that each authorized person sees the information appropriate to their work or relationship with the child.

1. Who Is Responsible for Personal Data?

The organization responsible for deciding why and how personal data is processed can vary depending on the service relationship.

Winnie’z may act as a data controller when we determine the purposes and methods of processing, such as managing our website, accounts, security, support, and direct customer relationships.

Winnie’z may act as a data processor when a school, provider, support organization, or other customer controls the relevant records and instructs us to process them. In that situation, the customer’s privacy notice and agreement with the family or user may also apply. We may forward a privacy request to that organization when it is responsible for responding.

For questions about the applicable role, contact the Winniez Care Privacy Team at hi@winniez.net.

2. Personal Data We May Collect

Depending on your role and use of the Platform, we may process:

Account and identity information

Names, contact details, account identifiers, role, organization, professional information, profile settings, authentication records, and communication preferences.

Child and family information

Child and guardian names, age or date of birth, family relationships, contact information, school or provider relationships, intake information, relevant background, and permissions.

Sensitive support information

Assessments, developmental information, objectives, support plans, observations, weekly summaries, case reports, progress signals, incident reports, provider ratings, meeting notes, and other information entered by authorized users.

Some of this information may qualify as sensitive personal data under applicable law and receives additional protection.

Provider, school, supervision, and training information

Schedules, attendance, caseloads, assigned children, performance information, supervision visits, report status, tasks, training modules, observation logs, shadowing activities, achievements, and professional communications.

Messages and support communications

Messages between authorized users, meeting information, requests sent to our support team, feedback, and records of how we respond.

Device and technical information

IP address, device and browser type, operating system, login time, approximate location derived from network information, diagnostic data, audit logs, security events, cookies, and similar technologies.

We ask users not to enter information that is unnecessary for the relevant support or operational purpose.

3. How We Collect Personal Data

We may collect personal data:

• Directly from you when you register, communicate, or use the Platform

• From a parent, guardian, family member, provider, school, supervisor, administrator, trainee, or authorized organization

• Through assessments, observations, reports, meetings, messages, attendance, and other Platform activities

• Automatically from devices and Platform interactions

• From service providers that support authentication, hosting, communications, security, and customer support

4. Why We Use Personal Data

We process personal data to:

• Create accounts and assign role-appropriate access

• Connect authorized families, providers, schools, supervisors, quality teams, administrators, and trainees

• Organize assessments, objectives, plans, observations, reports, meetings, attendance, and progress information

• Deliver updates and messages to the appropriate users

• Support provider matching, supervision, quality review, and operational follow-through

• Deliver and monitor training tasks, modules, logs, and achievements

• Respond to support requests and improve usability

• Protect children, users, organizations, and the Platform

• Detect unauthorized access, misuse, fraud, and security incidents

• Maintain audit records and Platform reliability

• Comply with legal, regulatory, safeguarding, and contractual obligations

• Analyze aggregated or de-identified information to understand and improve the Platform

We do not sell children’s personal data or use sensitive support information for third-party advertising.

5. Legal Grounds for Processing

Depending on the context and applicable law, processing may be based on:

• Your consent or the valid consent of a parent, guardian, or authorized representative, including explicit consent where required for sensitive personal data

• Performance of a contract or steps requested before entering a contract

• Compliance with legal, regulatory, professional, or safeguarding obligations

• Legitimate interests in operating, securing, improving, and supporting the Platform, where those interests do not override the rights of the individual

• Protection of a person’s vital interests where legally permitted

• Another lawful ground available to the responsible customer organization

Where consent is the legal basis, it may be withdrawn for future processing, subject to legal, contractual, safeguarding, and record-keeping requirements.

6. Children’s and Sensitive Personal Data

We process children’s information only for legitimate, specified purposes and through authorized adults or organizations. Where the law requires consent or authorization from a parent, guardian, or other representative, the responsible organization must obtain and document it before submitting the information.

The Platform is not intended for children to create independent public accounts or disclose information without appropriate adult or organizational authorization.

We apply additional safeguards to sensitive information, including role-based permissions, access logging, confidentiality requirements, and restrictions on unnecessary disclosure. Users should include only information that is relevant, accurate, respectful, and proportionate.

7. How Role-Based Access Works

Access depends on the user’s assigned role, organization, relationship to the child, and current responsibilities.

For example:

• Families may see their child’s authorized journey, goals, updates, summaries, reports, meetings, and messages

• Assigned providers may record observations, notes, objectives, schedules, and reports for their cases

• School users may receive operational visibility such as attendance, check-ins, alerts, and report status without automatically receiving every confidential support detail

• Supervisors and quality teams may review assigned portfolios, reports, performance, progress signals, and cases requiring attention

• Trainees may access assigned modules, tasks, observation activities, achievements, and supervisor communication

Users must not share information with people outside the authorized role or support relationship.

8. When We Share Personal Data

We may share personal data only as reasonably necessary with:

• Authorized families and members of the assigned support team

• Schools, providers, supervisors, quality teams, administrators, and trainees according to their permissions

• The customer organization responsible for the relevant account or records

• Service providers supporting hosting, storage, authentication, communications, analytics, security, customer support, and technical operations

• Professional advisers, auditors, insurers, or transaction advisers under confidentiality obligations

• Courts, regulators, law-enforcement bodies, safeguarding authorities, or other parties where disclosure is required or permitted by law

• A successor organization in a merger, acquisition, restructuring, or transfer, subject to appropriate confidentiality and legal safeguards

Service providers may use personal data only for the contracted purpose and under appropriate data-protection and security obligations.

9. International Data Transfers

Some service providers or technical systems may process data outside Egypt. Where personal data is transferred internationally, Winnie’z and the responsible customer will use the approvals, contractual safeguards, security measures, and transfer mechanisms required by Egypt’s Personal Data Protection Law, its Executive Regulations, and other applicable law.

10. Data Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and as required by applicable law, customer agreements, safeguarding responsibilities, dispute-resolution needs, and professional record-keeping obligations.

Retention may vary according to the type of record, the child’s relationship with the organization, the user’s role, and the responsible customer’s instructions. When information is no longer required, it is deleted, anonymized, or securely isolated unless continued storage is legally required.

11. Security

We use organizational and technical safeguards designed to protect personal data, including role-based access, authentication controls, audit logging, encryption where appropriate, backups, monitoring, access reviews, and confidentiality requirements.

No digital service can guarantee absolute security. Users also have an important role: protect credentials and devices, use only authorized accounts, review permissions, and report suspected unauthorized access promptly.

If a personal-data breach occurs, we will investigate, contain, document, and provide notifications to affected organizations, individuals, or authorities where required by applicable law.

12. Your Privacy Rights

Subject to applicable law and relevant exemptions, an individual or authorized representative may have the right to:

• Be informed about the processing of personal data

• Request access to personal data

• Request correction or completion of inaccurate information

• Request deletion where continued processing is not legally required

• Request restriction or object to certain processing

• Withdraw consent where consent is the legal basis

• Request transfer or a usable copy where applicable

• Be informed of certain personal-data breaches

• Complain to the responsible organization or competent authority

To make a request, contact the Winniez Care Privacy Team at hi@winniez.net. We may need to verify identity and authority before responding.

When Winnie’z processes information on behalf of a school, provider, or customer organization, we may send the request to that organization for instruction or response.

13. Cookies and Similar Technologies

We may use essential cookies and similar technologies for authentication, security, session continuity, preferences, and Platform operation. With any consent required by law, we may also use analytics technologies to understand performance and improve the user experience.

Non-essential cookies should be described in a separate cookie notice or preference center before they are activated. Browser settings may also allow users to control cookies, although disabling essential cookies can affect Platform functionality.

14. Automated Signals and Human Review

The Platform may organize information or display progress, performance, overdue-task, attendance, or case-status signals based on information entered by users. These signals are intended to support human review and coordination.

Winnie’z does not intend these signals to replace professional, safeguarding, educational, employment, or family judgment. Users should review the underlying context before making a significant decision.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, technology, Platform features, service providers, or our operations. We will post the updated version and revise the effective date. If a change materially affects how personal data is handled, we will provide additional notice where appropriate.

16. Contact and Complaints

For privacy questions, requests, or complaints, contact:

Winniez Care
Cairo, Egypt
Privacy contact: Winniez Care Privacy Team
Email: hi@winniez.net

You may also have the right to complain to the competent Egyptian personal-data protection authority once the applicable contact channel and procedure are confirmed by legal counsel.