Privacy Policy

Privacy Policy

Effective Date: 11/02/2026

Jurisdiction: England and Wales

​

1. Who We Are
“Breastfeeding Unlimited” provides:

• Private lactation consultancy delivered by an IBCLC   (International Board Certified Lactation Consultant)
• Postnatal doula support
• OCN Level 6Holistic Sleep Coaching consultations
• Developmental massage education (1:1 and group sessions)

Services are delivered via in-person and virtual consultations.

For the purposes of data protection law, the data controller is:

Hazel Meyer

breastfeedingunlimited@gmail.com 07970 745 485

ICO Registration Number:  ZA389096

Website: https://www.breastfeeding-unlimited.co.uk

2. Scope and Legal Basis
We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

Lawful bases (Article 6):

• Performance of a contract (to deliver booked services)
• Legitimate interests (service quality, safety, supervision and record keeping)

Where we rely on legitimate interests, we ensure that such interests are balanced against your rights and freedoms.

• Legal  obligation (accounting and tax compliance)
• Consent  (optional communications and media use)

Special category data (Article 9):

As part of providing lactation support, sleep coaching and developmental guidance, we may process health-related information concerning parents and infants.

Processing is based on:

• Article  9(2)(h) – provision of health or social care
• Explicit consent (where required, particularly for media or optional disclosures)

We maintain an Appropriate Policy Document as required under Schedule 1 of the Data Protection Act 2018 for the processing of special category data.

3. Data We Collect

We may collect and process the following categories of personal data:

Identity and Contact Data

• Name
• Email address
• Telephone number / WhatsApp handle
• Postal address
• Emergency contact details

Booking and Payment Data

• Appointment date/time
• Service type
• Invoice details
• Payment  confirmations

Consultation and Service Records

Information you provide in connection with:

• Pregnancy and birth history
• Infant feeding history and assessments
• Medications, allergies and relevant medical factors
• Sleep routines, sleep logs and behavioural      information
• Developmental observations
• Postnatal wellbeing disclosures
• Care plans and follow-up notes
• Photos or videos you choose to share for latch, positioning, sleep or developmental review (optional)

Group Session Records (Developmental Massage)

• Attendance registers
• Consent forms
• Incident reports (if applicable)

Communications Data

• Emails
• Website contact form submissions
• WhatsApp or SMS messages
• Feedback and testimonials (published only with  consent)

Website Usage Data

• Basic analytics data
• Cookies (see Cookies section)
• 
  

4. Purpose of Processing

We process personal data to:

• Schedule and deliver consultations and classes
• Provide lactation, postnatal, sleep and developmental support
• Maintain  accurate clinical and service records
• Respond to enquiries
• Provide follow-up support
• Manage invoices, accounts and tax obligations
• Monitor  service quality, supervision and risk management
• To comply with safeguarding and professional obligations where concerns arise.
• Comply  with legal or professional obligations

We do not sell personal data or use it for targeted advertising.

5. Children’s Information

We process information relating to infants and children only as provided by a parent or legal guardian.

We do not communicate directly with children online. All decisions, bookings and consents are provided by the adult client.

6. Sharing Your Data (Processors/Recipients)

We use trusted service providers (data processors) who act on our instructions and are bound by contractual confidentiality and security obligations. These may include:

• Practice  management software (e.g. Cliniko)
• AI-assisted note systems (e.g. Heidi) 

Where AI-assisted note systems are used, they are employed solely to support documentation. All notes are reviewed and finalised by the practitioner. No automated decision-making or profiling takes place.

• Email and cloud storage providers (e.g. Google, One Drive)
• Messaging services (e.g. WhatsApp)
• Accounting and invoicing software
• Website  hosting and analytics providers
• Video platforms for virtual consultations
• Email marketing platforms (e.g. Mailchimp, where consent is given)
• We may disclose information without consent where required by law or where      necessary to protect the vital interests of a child or vulnerable person.

We only share information where necessary for service delivery or legal compliance.

We use trusted service providers (processors) who act on our instructions and are bound by contracts, confidentiality and security obligations, e.g.:
• Email and cloud storage (e.g Microsoft/Google)
• Website hosting/analytics
• Messaging providers (WhatsApp) for client communications
• Accounting/invoicing tools
• Video platforms for virtual consultations

International transfers: 

Where data is transferred outside the UK (e.g., to the EEA or USA), we ensure appropriate safeguards (Standard Contractual Clauses with the UK Addendum or adequacy decisions).

7. Retention

We retain personal data only as long as necessary.

• Consultation  and coaching records: 7 years from last contact.
• Records relating to a child: until the child’s 21st birthday, or 7 years from last contact (whichever is later).
• Group session attendance and incident records: up to 6 years (or longer if  required by insurer).
• Enquiries  not leading to care: 12 months.
• Invoices and tax records: 6 years plus the current financial year.
• Media (photos/videos) shared for clinical purposes: retained within the clinical  record and deleted when no longer required or upon request where legally  permissible.
• Marketing  data: retained while consent remains valid.
• 
  

Further details are set out in our internal Data Retention & Deletion Policy.

8. Your Rights
Under UK GDPR, you have the right to:

• Access your data
• Request correction
• Request erasure (where legally applicable)
• Restrict processing
• Object to processing
• Request  data portability

Where processing relies on consent, you may withdraw consent at any time.

We may require proof of identity before fulfilling requests

Contact: breastfeedingunlimited@gmail.com. You can also complain to the ICO: www.ico.org.uk.

​  

9. Cookies and Analytics
Our website may use essential cookies for security and functionality, and optional analytics cookies to understand site usage. Where required, we will request consent for non‑essential cookies via a banner. You can change your preferences at any time in your browser or our cookie tool.

​10. Security
We implement appropriate technical and organisational measures, including:

• Encrypted systems where available
• Secure cloud storage
• Access controls and password protection
• Two-factor authentication where available
• Device  security and automatic locking

No system is completely secure; residual risk remains.

​11. Communications
WhatsApp support is available as described in our Terms. Messaging is intended for brief guidance (non‑urgent). For emergencies, contact NHS 111 or 999.

Clients are informed that messaging platforms are not a substitute for emergency medical care and may not be fully secure.

​12. Changes to this Policy
We may update this Policy; material changes will be notified on the website or by email where appropriate.