Legitimate Interest Assessment
Where we rely on legitimate interest, the law says we have to weigh our interest against your rights. This is that working, published in full.
Last updated: 12 August 2026The short version
Two things we do are not based on your consent: the weekly pregnancy email, and counting how the app is used. For both, the law lets us rely on our own legitimate interest, provided we have honestly checked that it does not trample your rights.
Most companies do that check privately. We have published ours, because a balancing test you are not allowed to read is not much of a reassurance. If you disagree with our reasoning, you can object, and section headed "Your right to object" tells you how.
About this document
This records our analysis under Article 6(1)(f) of the UK GDPR for two processing activities carried out by The Parent Room, operated by WTTW Retail Ltd.
| Detail | Information |
|---|---|
| Assessor | WTTW Retail Ltd, Victoria Works, Woodhead Road, Holmfirth, England, HD9 2PR |
| Company number | 13438144 |
| ICO registration | ZA167524 |
| Version | 2.0, 12 August 2026. Version 1.0 was dated 16 April 2026. |
Two activities are assessed here. Security monitoring and fraud prevention are not assessed separately: they are a recognised legitimate interest that does not usually need a detailed balancing exercise. For completeness, we process IP addresses and sign-in activity for security, limited to what is necessary, kept for ninety days, and expected by anyone using an online service.
Assessment 1: weekly pregnancy emails
Purpose test
A weekly email matched to your stage is a core part of the companion. Each one carries development information for that specific week, practical guidance, and offers from partners we have chosen.
Our interest is in delivering the thing people signed up for, in keeping the companion present across a journey that lasts most of a year, and in supporting a service that is free to use. That is a real and present interest, not a speculative one.
Necessity test
We considered the less intrusive options.
- In-app content only. The content is already in the app. Relying on that alone means the member has to remember to open it. The email is the prompt that arrives at the right week, and without it people miss things that are only relevant for a few days.
- The same email for everyone. A generic email would be less intrusive and also close to useless. Somebody at twelve weeks needs nothing that somebody at thirty-six weeks needs.
- An opt-in tick at registration. We considered it. The emails are a core part of what is being joined, and Regulation 22(3) of PECR exists for precisely this relationship. An extra tick would remove the emails from people who would benefit, without a matching privacy gain.
We are satisfied that no less intrusive method would be equally effective.
Balancing test
What is processed: your name, your email address, and your due date, used to work out which week you are in. The due date is health related. No scan images, no clinical reports and no other special category data go anywhere near these emails.
What you would reasonably expect: you joined a pregnancy companion because you are pregnant. A weekly pregnancy email is the single most predictable thing such a service could send. The registration screen says it is included.
The relationship: this is not cold marketing. Everyone receiving these emails has actively created an account with us, and most are also existing Window to the Womb or firstScan customers.
| Factor | Assessment |
|---|---|
| Volume | One email a week. That matches the natural pace of a pregnancy, not the pace of a marketing calendar. |
| Relevance | Matched to the exact week. It is not generic promotional material. |
| Opting out | A toggle in the profile, and an unsubscribe link in every email. Both immediate, both free. |
| Cost of opting out | None whatsoever. Every feature, all in-app content, scans, rewards and offers stay exactly as they were. |
| Vulnerability | Pregnant people can be a vulnerable group and we have weighed that. The emails are supportive and informational. No countdown timers, no urgency, no pressure language. |
| Risk of distress | The serious one. Pregnancy does not always end well, and a cheerful weekly email after a loss would be cruel. The unsubscribe is immediate and prominent, the app has a pause that silences everything, and closed and memorialised accounts are excluded from all sending at source rather than filtered later. |
| Third parties | An email may carry a partner offer. No personal data reaches that partner because you received the email. Data moves only if you actively claim, and consent separately at that point. |
The PECR soft opt-in
The three conditions in Regulation 22(3) are met for members who came to us as clinic customers: their contact details were obtained in the course of a sale, the content is similar to the pregnancy service they bought, and a simple free means of refusing is offered both at the outset and in every message.
[NEEDS DAN: since registration opened to everyone, some members will never have bought anything from us, so the soft opt-in cannot cover them. Decide whether those members should be defaulted to on under legitimate interest alone, or asked to opt in. This is the one place where opening registration to the public has changed the legal analysis, and it should be settled before the beta.]
Safeguards
- Clear information at registration that weekly updates are included
- A toggle in the profile, always reachable
- An unsubscribe link in every email, effective immediately
- No penalty of any kind for opting out
- One email a week, no more
- No scan images or clinical reports in any email
- Nothing shared with a partner without a separate, specific consent
- Paused, closed and memorialised accounts excluded at source
Outcome
Legitimate interest is an appropriate basis for this processing
The processing delivers a core part of the service, the relationship is direct and active, the content is highly relevant, and opting out is immediate and costless. Your rights do not override our interest. For members who came from a clinic booking, the PECR soft opt-in applies as well.
Assessment 2: app engagement analytics
Purpose test
We count how the app is used so we can see which parts help, where people get stuck, and whether a change made things better or worse. Our interest is in maintaining and improving a service people lean on during a demanding year of their lives.
Necessity test
- Feedback alone gives a partial and skewed picture. Most people never report anything, they simply stop opening the app.
- Server logs alone do not show which screen someone reached, or which feature they never found.
We are satisfied the processing is necessary and that no less intrusive method gives equivalent insight.
Balancing test
The decisive point here is the design, not the policy. The app has two analytics lanes and they cannot be crossed.
| Factor | Assessment |
|---|---|
| What is processed | A fixed, closed list of app-level events: the app opening, movement between the main screens, a game opened or played, a share, a wave, an invite started, a notification opened. Counts, true or false values and screen names, with a device and app-instance identifier. |
| What is never processed | Anything health shaped. Weeks, stages, dates, symptoms, scans, baby data and everything logged in the journey go to our own servers only, and have no code path to any third party. This is enforced by the type system, so a new health event cannot be added to the wrong lane by mistake. |
| Reasonable expectations | People expect an app to count how it is used. They do not expect a pregnancy app to tell Google they are pregnant, and we do not. |
| Impact | Low. The data is used in aggregate to decide what to build and fix. No decision is made about any individual from it. |
| Special category data | None reaches the third-party lane, by construction rather than by promise. |
| Advertising | None. The app declares no tracking to Apple, carries no advertising identifier and lists no tracking domains. |
| International transfers | Firebase Analytics is operated by Google. See section 11 of the privacy policy. |
Safeguards
- Two structurally separate lanes, with the health lane unable to reach any third party
- A closed event list, so nothing can be added casually
- No health context in any third-party event, ever
- Aggregate use for product decisions, never individual profiling
- The design is described plainly in the privacy policy rather than buried
Outcome
Legitimate interest is an appropriate basis for this processing
The events carry no health context, the impact on any individual is low, the expectation is ordinary, and the processing is necessary to keep the service working well. Your rights do not override our interest.
Review
We will review this assessment at least once every twelve months, whenever we materially change either activity, if a member complains or objects, and if the ICO publishes new guidance on soft opt-in, legitimate interest or pregnancy data.
| Version | Date | Summary |
|---|---|---|
| 1.0 | 16 April 2026 | Initial assessment, covering weekly pregnancy emails and web analytics |
| 2.0 | 12 August 2026 | Rewritten for the mobile app. Assessment 2 replaced to describe the two-lane analytics design. Open question added about members who never bought from us. |
Your right to object
Article 21 gives you the right to object to processing based on legitimate interest. If you object we stop, unless we can show compelling grounds that override your interests, and for the weekly emails we would not try.
For the emails you do not need to object formally at all. Switch them off in your profile or use the unsubscribe link. It is quicker and it takes effect at once.
For anything else, or if you want to challenge the reasoning on this page:
- Email: [email protected]
- Post: Data Protection, WTTW Retail Ltd, Victoria Works, Woodhead Road, Holmfirth, England, HD9 2PR
See also our privacy policy and our terms of use.