AllayBaby Privacy Notice
Last updated: 24 October 2026
This Privacy Notice explains how AllayBaby collects, uses, stores and shares personal information when you use our website, contact us, make a booking, attend a baby massage course or receive lactation and infant-feeding support.
We aim to handle your information respectfully, securely and transparently.
1. Who we are
AllayBaby is the trading name used by:
Jessica Lodge, sole trader; and
Lucy Butler, sole trader.
“We” or “us” shall mean AllayBaby and/or your practitioner(s) as applicable
Email: hello.allaybaby@gmail.com
The individual AllayBaby practitioner providing your service will normally be responsible for the personal information processed in connection with that service.
Where the two AllayBaby practitioners jointly determine how personal information is processed, we will ensure that appropriate arrangements are in place between us.
If you have questions about how your information is handled, please contact us at the above email address.
2. Scope of this policy
This policy explains how we collect, use, share and protect personal data about the parents, carers and babies we support, enquirers, visitors to our website and social media pages, and people who refer clients to us (such as midwives, health visitors and GPs).
3. The personal data we collect
Information about you (the parent or carer):
identity and contact details: name, address, email, telephone number, date of birth;
details of your GP, midwife, health visitor or other healthcare professionals;
appointment, booking and payment details (we do not store full card details, which are handled by our payment provider);
communications with us, including messages, emails and feedback;
website usage data and cookie information (see section 12).
Special category data (health information) about you:
pregnancy, birth and postnatal history, including mode of delivery and complications;
breast and nipple health, feeding history, milk supply and pumping information;
relevant medical conditions, medications, allergies and surgical history;
mental health and wellbeing information you choose to share, such as postnatal anxiety or depression;
clinical notes, assessment findings and care plans we prepare;
photographs or video taken during a consultation, only with your explicit consent.
Information about your baby (including special category data):
name, date of birth, gestational age at birth and NHS number (if provided);
weight, growth, feeding patterns, output and oral assessment findings (including assessment for tongue tie);
relevant medical history, conditions, medication and referrals.
Health data is "special category data" under Article 9 UK GDPR and receives additional protection. We collect only the health information that is relevant to the support we provide.
4. How we collect your data
We collect personal data directly from you (through enquiry and intake forms, consultations in person, at home or by video, and correspondence), from healthcare professionals or others who refer you to us with your agreement, and automatically through our website.
5. How we use your data and our lawful bases
We must have a lawful basis under Article 6 UK GDPR for every use of personal data and, for special category data, an additional condition under Article 9 UK GDPR (and, where required, Schedule 1 DPA 2018).
Where we rely on consent or explicit consent, you may withdraw it at any time by contacting us. This will not affect processing carried out before withdrawal.
6. Children's data
Information about your baby is provided by you as their parent or person with parental responsibility. We use it only to provide care to your baby and you, and handle it with the same safeguards as your own health data.
7. Who we may share your data with
healthcare professionals involved in your or your baby's care (GP, midwife, health visitor, paediatrician, tongue tie practitioner), with your agreement or where permitted by law;
service providers acting as our processors under written contracts, such as practice management and clinical records software, secure email, video consultation platforms, booking and payment providers, IT support and cloud storage providers;
our professional indemnity insurers, accountants and legal advisers;
local authority children's services, police or other agencies where required for safeguarding or by law;
clinical supervisor or peer reviewers, using anonymised information wherever possible.
We do not sell your personal data or use it for any marketing purposes.
8. International transfers
We do not transfer your personal data outside the UK.
9. How long we keep your data
We keep personal data only as long as necessary. Indicatively: clinical records relating to babies and children are retained until the child's 18th birthday or for 8 years after the last contact, whichever is longer; adult clinical records for 8 years after the last contact; marketing data until you unsubscribe.
10. How we protect your data
We use appropriate technical and organisational measures, including encrypted devices, access controls, password and multi-factor authentication, secure communication channels for sharing health information, and staff confidentiality and training. [Given the nature of our processing, we have completed a data protection impact assessment.]
11. Your rights
Under the UK GDPR you have the right to:
access a copy of your personal data;
have inaccurate data corrected;
have your data erased, in certain circumstances (note that we may need to retain clinical records for the periods above);
restrict or object to our processing, in certain circumstances, including objecting at any time to direct marketing;
data portability, where processing is based on consent or contract and carried out by automated means;
withdraw consent at any time where we rely on it.
You may exercise rights on behalf of your baby as the person with parental responsibility. We will respond within one month, which may be extended in certain circumstances. We do not make decisions based solely on automated processing which have legal or similarly significant effects.
12. Cookies
Our website uses cookies. Non-essential cookies are used only with your consent. See squarespace cookie policy for details.
13. Complaints
Please contact us first if you have any concerns.
You also have the right to complain to the Information Commissioner's Office (ICO): www.ico.org.uk, 0303 123 1113.
14. Changes to this policy
We may update this policy from time to time. The current version will always be available on our website and we will notify you of significant changes.