Privacy Policy & Data Protection Notice

Data Controller: The Baby Element Limited (Company Registered in England & Wales)
ICO Registration Number: ZB695276
Data Protection Lead: Nikki Mather (IBCLC, Doula)
Contact Email: nikki@thebabyelement.co.uk

At The Baby Element Limited, we respect your privacy and are committed to protecting and preserving the personal and medical data of you, your infant, and your family.

All our services operate strictly on an explicit opt-in basis. We do not utilise implied consent (such as assuming consent merely by browsing our website). You maintain full control over your personal data and may withdraw consent for optional processing at any time.

This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and NHS record-keeping governance standards.

We collect personal information directly from you when you submit booking forms, complete health history intakes, or engage in clinical consultations.

A. General Personal Data (Article 6 UK GDPR)

• What we collect: Names, postal addresses, email addresses, phone numbers, emergency contact details, and fee payment details.
• Legal Basis: Performance of a Contract (to provide infant feeding, doula, or clinical care) and Legitimate Interests (for business administration and legal record keeping).

B. Special Category Health Data (Article 9 UK GDPR)

• What we collect: Ante/postnatal records, infant health and feeding histories, oral function assessments, birth history, medical notes, and related maternal/infant clinical details.
• Legal Basis: Explicit Consent (Article 9(2)(a)) and Provision of Health or Social Care (Article 9(2)(h)) as an International Board Certified Lactation Consultant (IBCLC) and full-spectrum doula practice.

We hold your data securely to the highest clinical standards:

• Practice Management & Clinical Notes: We utilise Practice Better, a secure, GDPR-compliant platform specifically designed for health records, intake forms, clinical charting, and digital consent tracking.
• Website Enquiries & Forms: Information submitted via website contact or booking forms is processed through encrypted web services and routed directly into our secure systems.
• Communication Data: Direct electronic communications (emails, clinical follow-ups) are strictly confidential and restricted to authorised care providers.

Because we care for both parents and infants, our data retention periods align strictly with NHS Records Management Code of Practice standards for clinical and maternal records:

• Infant & Children’s Records: Clinical notes, oral function assessments, and care plans concerning infants are retained until the child reaches their 25th birthday (or 26th birthday if the child was 17 at the conclusion of care).
• Maternal & Adult Records: Clinical notes relating to adult care or doula support are retained for 8 years following the conclusion of care.
• General Enquiries & Administrative Data: Enquiries that do not proceed to clinical care are retained for 1 year prior to secure deletion.

We do not use essential or non-essential tracking cookies without your active, opt-in consent:

• Cookies: When you visit our website, non-essential cookies (such as analytics cookies) are blocked until you explicitly grant consent via our cookie banner. You can adjust or withdraw cookie consent at any time via your browser settings.
• Analytics: Where consented to, anonymised analytics (e.g., Google Analytics) collect aggregated usage metrics (pages viewed, session duration, device type) to help us improve website functionality. No clinical or personally identifiable data is shared with analytics providers.

We never sell, trade, or rent your personal data to third parties for marketing purposes.

We only disclose data to third parties under the following conditions:

• Clinical Referrals & Continuity of Care: With your explicit consent, we may communicate with your GP, health visitor, midwife, or NHS clinical team.
• Third-Party Service Processors: Secure platforms that enable our operations (e.g., Practice Better for client records, secure web hosting) operating under strict Data Processing Agreements.
• Legal & Safeguarding Requirements: Where required by law, court order, or overriding legal obligations regarding safeguarding or child protection.

Under UK GDPR, you have the following rights regarding your personal and clinical data:

• Right of Access (Subject Access Request): Request a copy of the clinical notes and personal data we hold about you or your child.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure / Restriction: Request deletion or restriction of data (subject to statutory healthcare record retention rules).
• Right to Withdraw Consent: Withdraw opt-in consent for non-essential processing (e.g., newsletters or marketing communications) at any time.

To exercise any of these rights, please email Nikki Mather at nikki@thebabyelement.co.uk.

We strive to handle all personal and clinical data with the utmost integrity. If you have concerns about how your data is handled:

• Direct Complaint: Email nikki@thebabyelement.co.uk with the subject line “Data Protection Complaint”. We will acknowledge your request within 5 working days and provide a full resolution outcome within one calendar month.
• Regulatory Escalation: If you remain unsatisfied, you have the right to lodge a complaint directly with the UK supervisory body:
  • Information Commissioner’s Office (ICO)
  • Website: ico.org.uk
  • Telephone: 0303 123 1113
  • The Baby Element Limited ICO Registration Number: ZB695276