Privacy Policy – Cradled by Grace

Introduction

Cradled by Grace ("we", "us", or "our") is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who We Are

Business Name: Cradled by Grace

Website: https://cradledbygrace.co.uk

Email: hello@cradledbygrace.co.uk

Cradled by Grace provides birth doula services, antenatal education, nutrition support and related maternity services.

What Personal Data We Collect

Depending on the services you receive, we may collect:

Names and contact details
Postal addresses
Health information, including medical history, dietary requirements, allergies and health conditions
Estimated due date during pregnancy
Health and safety information
Access to maternity or hospital notes where you have explicitly consented
Records of meetings and consultations
Call recordings (where applicable)
Website usage information (including cookies and user journeys)
Photographs or videos (where consent has been provided)
Information relating to complaints or feedback

We may also process the following special category personal data where necessary:

Health information
Genetic information
Religious or philosophical beliefs
Information relating to sex life
Sexual orientation

Why We Collect Personal Data

We use personal information to:

Provide doula, antenatal and nutrition services
Deliver customer support and ongoing care
Manage customer accounts and bookings
Send service updates and marketing communications (where appropriate)
Maintain records for professional practice
Comply with legal and regulatory obligations
Defend legal claims where necessary
Prevent fraud or misuse
Carry out research or archiving where appropriate and lawful

Lawful Bases for Processing

We process personal data using one or more of the following lawful bases:

Consent – where you have given us permission.
Contract – where processing is necessary to provide the services you have requested.
Legitimate Interests – where processing is necessary to provide safe, effective and high-quality care and support.
Vital Interests – where processing is necessary to protect someone's life or prevent serious harm.

Where special category data is processed, we rely upon the relevant UK GDPR conditions, including explicit consent and, where appropriate, health or vital interests provisions.

Legitimate Interests

Where we rely upon legitimate interests, this is to ensure we have the information necessary to advocate effectively for our clients and to help ensure they remain safe, supported and well cared for throughout pregnancy, birth and the postnatal period.

We only collect information that is relevant to delivering our services, and we balance our interests against the rights and freedoms of individuals. Appropriate safeguards are implemented to ensure personal information remains confidential and secure.

Children's Data

Although our services relate to pregnancy and families, we do not knowingly collect personal information directly from children.

Where We Obtain Personal Data

We obtain personal information from:

Individuals directly
Third parties where appropriate

This may include information provided by:

Birth partners
Next of kin
Family members where authorised by the client

Where hospital or maternity records are accessed, this will only occur with the client's explicit consent.

Sub-Processors and Systems

We use trusted third-party providers to help deliver our services, including:

Wix – website hosting, contact forms and website management
Calendly – appointment scheduling
Xero – accounting, invoicing and financial record keeping

These providers act as data processors and only process information on our behalf.

Sharing Personal Data

We may share personal information where necessary with:

Healthcare providers
Emergency services
Safeguarding organisations
Relevant regulatory authorities
Publicly on our website or social media where you have given explicit consent (for example testimonials or photographs)

We will only share information where there is a lawful basis to do so.

Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including meeting legal, regulatory, insurance and professional obligations. Information is securely deleted or anonymised once it is no longer required.

International Transfers

We do not routinely transfer personal data outside the United Kingdom.

Some of our service providers, such as Wix, may process or store limited personal data outside the UK. Where international transfers occur, we ensure appropriate safeguards are in place, including UK adequacy regulations, Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or other legally recognised transfer mechanisms, to protect your personal

information.