Privacy notice

1. Who is responsible for your information

I, Sarah Strasberg, trading as Sarah Strasberg IBCLC, am the data controller for my independent lactation practice. You can contact me at privacy@sarahstrasberg.co.uk or write to me at Sarah Strasberg IBCLC, 5 Brayford Square, London E1 0SG. This is a business correspondence address only; consultations are not held there.

2. Information collected

I may collect your name and contact details; appointment, payment and invoice information; home-visit address; your baby’s date of birth or expected due date; feeding history, health information, medicines and relevant care-team details; consultation notes, care plans and messages; consent choices; and information needed to handle a concern or complaint.

The public website does not contain an intake form and does not collect or store health-intake answers or clinical notes. After an appointment is booked, Calendly automatically emails a link to a separate intake form in Microsoft Forms within my Microsoft 365 work account. Intake responses are submitted to that account and are not submitted to or stored by this public website or Calendly. Clinical records remain in a separate, access-controlled service and database. Only information reasonably needed for booking, safe care, records, payment and legal or professional obligations is collected.

For automatic WhatsApp billing, the public website stores only the opaque Calendly and Stripe identifiers, consultation start time, and payment or subscription status needed to confirm the provisional booking, reconcile weekly billing, and respond to cancellation or rescheduling. It does not store the client’s name, email address, telephone number, payment-card details, intake answers or clinical notes in this booking record.

Website hosting may process essential technical information needed to deliver and secure the site. I use cookie-free, first-party website analytics that records aggregate page-view counts by date, page and referring website domain. It also counts clicks on Calendly booking, contact-page, email and telephone links by date, page and broad destination category. It does not store names, health information, full referring or destination URLs, IP addresses, advertising identifiers or unique visitor identifiers. Aggregated analytics data is kept for up to 13 months. The site does not intentionally use advertising cookies.

3. Why the information is used

Information is used to arrange and provide consultations, understand your goals and relevant history, create and review a care plan, communicate about support, take payment, administer any agreed automatic weekly billing and cancellation, keep appropriate clinical and financial records, safeguard children and adults, meet insurance and legal obligations, and respond to concerns.

4. Lawful basis

For ordinary personal data, processing is generally necessary to take steps at your request and perform the service contract, meet legal obligations, and pursue legitimate interests such as safe practice, record keeping, fraud prevention and defending legal claims.

Health information is special category data. The separate clinical intake process asks for a specific choice about processing relevant health and feeding information for lactation support and clinical records. In limited circumstances, another legal condition may apply, such as protecting vital interests or establishing, exercising or defending legal claims. Consent to hands-on care or information sharing is separate from the data-protection basis.

5. Who information is shared with

Service providers may process the minimum information needed for their role, including Calendly for scheduling and sending the intake-form link, Microsoft Forms within Microsoft 365 for the post-booking intake form, Stripe for initial and automatic weekly payments, Microsoft Teams for virtual appointments, WhatsApp where you choose messaging support, the provider used to host and secure the public website, and the separately controlled provider used for clinical records.

With your permission, I may share relevant information with a GP, midwife, health visitor, paediatrician or another professional involved in care. Information may be shared without permission where law requires it or where this is necessary to respond to a serious safeguarding or vital-interest concern. I do not sell client information.

6. International processing

Some technology providers may process information outside the UK. Where this happens, I will use providers and contractual or legal safeguards intended to protect the information in accordance with UK data-protection law.

7. Security

The public website has no health-intake form or submission endpoint and no interface or cryptographic key capable of decrypting or displaying clinical responses or records. Calendly sends only the link to the separate Microsoft Forms intake form and does not receive the answers. Responses are held within my access-controlled Microsoft 365 work account and do not pass through the public website. Clinical records are kept in a separate access-controlled application and database. Aggregate website analytics are available only through a password-protected dashboard. Sensitive answers are not included in routine email notifications or website analytics.

8. How long information is kept

Client records are kept for five years from the date of the last consultation or other clinical contact where the client is an adult. Where the client is a minor, their records are kept for five years from the date on which they turn 18.

At the end of the applicable period, the records will be securely deleted or anonymised unless a longer period is required by law, an insurer, safeguarding obligations or an ongoing legal claim.

9. Your rights

Depending on the circumstances, you may ask for access to your information, correction, deletion, restriction, portability, or an objection to processing. Where processing relies on consent, you can withdraw that consent for future use. Some rights may be limited where information must be kept for legal, safeguarding or claims purposes.

To exercise a right or ask a privacy question, email privacy@sarahstrasberg.co.uk. You can complain to the Information Commissioner’s Office at ico.org.uk. I would appreciate the opportunity to address your concern first.

10. Other websites and changes

Links to Calendly, Stripe, Microsoft Teams, WhatsApp or other services lead to providers with their own privacy information. This notice will be reviewed when the practice, law or providers change.

See also the Terms of Service.