Confidentiality, Privacy & Social Media

Confidentiality, Privacy & Social Media Policy

Léa Morris Postnatal Doula

1. About This Policy

Your privacy matters to me. As a postnatal doula, I may be trusted with personal and sensitive information about you, your baby and your family.

This policy explains how I protect your confidentiality, handle your personal information, and approach photographs, testimonials and social media.

I am responsible for deciding how and why your personal information is used in connection with my services.

2. Confidentiality

Information you share with me will be treated as confidential and handled with discretion and respect.

I will not:

Discuss your personal circumstances with friends, family or other clients.
Identify you as a client publicly without your permission.
Share private conversations or messages.
Share photographs of you, your baby or your home without appropriate permission.
Share your information with professionals or services unless there is a lawful and appropriate reason to do so.

I will treat information about your family and anything I see or hear in your home with discretion and respect.

When confidentiality may be limited

Confidentiality may need to be limited where:

There is a safeguarding concern about the safety or wellbeing of a child or adult.
Someone is at risk of serious or immediate harm.
I am legally required to share information.
Sharing information is necessary and lawful to help protect someone from serious harm.
There is another lawful basis for sharing the information.

Where it is safe and appropriate to do so, I will explain what needs to be shared and why. I will aim to share only information that is relevant and necessary.

Further information is provided in my Safeguarding Policy.

3. Personal Information I Collect

Depending on the support you request, I may collect:

Your name and contact details.
Your address.
Information needed to arrange and provide your doula support.
Your baby’s name and date of birth, where relevant.
Information you choose to share about your postnatal experience, health, wellbeing or feeding.
Notes relating to your support and visits.
Payment and business records.
Information relating to safeguarding concerns, where necessary.

I only collect information that I reasonably need to provide my services, communicate with you, manage my business, meet legal requirements or respond appropriately to safeguarding concerns.

I will not collect more personal information than is reasonably necessary for these purposes.

4. How I Use and Store Your Information

I may use your information to:

Respond to enquiries.
Arrange and provide doula support.
Communicate with you.
Keep appropriate client records.
Provide relevant resources and signposting.
Process payments.
Meet legal, insurance and safeguarding responsibilities.
Deal with complaints, queries or concerns about my services.

Your information may be stored using:

Password-protected devices, including my laptop, iPad and mobile phone.
Google services, including Google Docs and Gmail.
WhatsApp, where you chose to communicate with me using WhatsApp
Wix website and website forms.
Payment providers connected to my Wix website, including PayPal, where applicable.
Lloyds, where payment information is required to process or receive payments into my bank account.
A locked file box for any paper records that need to be stored.

I will take reasonable and appropriate steps to keep your information secure and prevent unauthorised access, loss, misuse or inappropriate disclosure.

I will not sell your personal information or use it for another business’s marketing.

5. Lawful Basis for Using Your Information

I will only collect and use your personal information where I have a lawful basis to do so under UK data protection law.

Depending on the circumstances, this may include:

Service agreement: where information is necessary to arrange and provide my doula services.
Legitimate interests: where necessary to respond to enquiries, communicate with clients and manage and administer my business, where these interests are not overridden by your rights and interests.
Legal obligation: where I am required to keep or provide information to meet legal or regulatory requirements, such as financial records.
Consent: where I ask for your permission for a specific use of your information, such as promotional photographs, videos or testimonials.

Some information you may choose to share with me, such as information about your health, wellbeing or feeding, may be considered special category data under UK data protection law.

I will only process special category data where I have both an appropriate lawful basis under UK GDPR and an appropriate condition for processing special category data.

Where I rely on your consent, you can withdraw your consent at any time. Withdrawing consent will not affect processing that has already taken place lawfully before your consent was withdrawn.

6. Who I May Share Information With

Your information will only be shared where there is a lawful and appropriate reason to do so.

This may include:

Wix – for website services, website forms and booking or payment services.
Google – for email and document storage through Gmail and Google Docs.
WhatsApp – where you chose to communicate with me using WhatsApp. WhatsApp may process personal information in accordance with its own privacy practices and terms.
PayPal – where payments are made through PayPal.
Lloyds – where payment information is required to process or receive payments into my bank account.
Healthcare professionals or other services – where you have given appropriate permission, or where there is another lawful reason to share the information.
Safeguarding services or relevant authorities – where there is a safeguarding concern and sharing information is necessary and lawful.
Other authorities or organisations – where I am legally required to provide information.

I will share only information that is relevant and necessary for the specific purpose.

Some of the service providers I use may process or store personal information outside the UK. Where this occurs, I will ensure that any required safeguards are in place in accordance with applicable UK data protection law. Further information about international transfers may be available in the relevant provider’s privacy notice.

7. How Long I Keep Your Information

I will not keep your personal information indefinitely. I will only keep information for as long as it is necessary for the purpose it was collected, or where I have a legal, insurance or safeguarding reason to retain it.

My intended retention periods are:

Enquiries: Up to 12 months after our last contact if you do not become a client.
Client records and notes: Up to 3 years after the end of my service or last contact.
Service Agreements: Up to 3 years after the end of the service.
Financial records: Kept for the period required by HMRC and other applicable legal requirements.
Safeguarding records: Kept for as long as necessary and/or as legally required.

When information is no longer needed, it will be securely deleted, destroyed or anonymised, unless there is a legal, insurance or safeguarding reason to retain it for longer.

8. Your Data Protection Rights

Under UK data protection law, you may have rights including the right to:

Ask what personal information I hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of your information in certain circumstances.
Request restriction of how your information is used in certain circumstances.
Object to certain uses of your information.
Withdraw consent where I am relying on your consent.
Request a copy of your personal information in certain circumstances.

Not all rights apply in every situation, and there may be legal reasons why I cannot comply with a particular request.

To make a request or ask a question about your personal information, please contact:

Name: Léa Morris

Business: Léa Morris Postnatal Doula

Email: leamorrisdoula@gmail.com

Telephone: +447888472653

I may need to verify your identity before providing information or responding to a request.

9. Photographs and Videos

I will not take or use photographs or videos of you, your baby or your home for promotional purposes without your explicit permission.

Permission will never be assumed simply because a photograph or video was taken during a visit.

You can say no, and this will not affect the support you receive.

Where you have given permission for photographs or videos to be used for promotional purposes, you can withdraw your permission for future use by contacting me.

10. Social Media

I may use social media, including Instagram, to share information about my work and postnatal support.

I will never:

Identify you as a client without permission.
Share your name, photograph or personal story without permission.
Post photographs taken inside your home without permission.
Share private messages or conversations.
Discuss identifiable client situations online.
Share details about your health, birth, feeding or family circumstances in a way that could identify you.

You are never expected to follow or interact with my social media accounts in order to receive support.

I will maintain professional boundaries online just as I do during in-person support.

11. Testimonials

I may ask you whether you would like to provide a testimonial about my service.

A private message or kind comment sent to me does not automatically give me permission to publish it.

I will ask for your explicit permission before publishing a testimonial and will agree with you how it will be identified, for example:

Anonymously.
First name only.
Another agreed form of identification.

You can choose not to provide a testimonial, and this will not affect the support you receive.

12. Safeguarding and Legal Requirements

Nothing in this policy prevents me from taking appropriate action where there is a safeguarding concern, serious risk of harm or legal obligation.

If I believe a child or adult may be at risk of harm, I may need to share relevant information with an appropriate professional, safeguarding service or authority without your permission where this is permitted or required by law.

Where safe and appropriate, I will explain what information needs to be shared and why.

I will follow the principles set out in my Safeguarding Policy.

13. Data Breach Procedure

I take the security of personal information seriously. If I become aware of a personal data breach, I will take prompt and appropriate steps to contain the breach, assess the risk and reduce the likelihood of harm.

A personal data breach may include personal information being accidentally lost, deleted, disclosed to the wrong person, accessed without permission, stolen or otherwise compromised. This could include a lost or stolen device, an email sent to the wrong recipient, unauthorised access to client records, or the loss of paper records.

If a breach occurs, I will:

Take immediate steps to contain and minimise the breach, where possible.
Identify what personal information has been affected and whose information may be involved.
Assess the likelihood and severity of any risk to the individuals affected.
Keep a written record of the breach, including what happened, the information affected, the action taken and the outcome.
Where required, notify the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to result in a risk to individuals’ rights and freedoms.
Where a breach is likely to result in a high risk to the rights and freedoms of individuals, notify the affected individuals without undue delay where required by UK data protection law.
Cooperate with any relevant organisations, service providers or authorities where necessary to investigate or manage the breach.
Take reasonable steps to prevent the same or a similar breach from happening again.

Not every personal data breach needs to be reported to the ICO or to the people affected. I will assess each breach based on the circumstances and the level of risk involved.

If you believe your personal information may have been accidentally disclosed, lost, accessed or otherwise compromised in connection with my services, please contact me as soon as possible using the contact details in this policy.

I will document personal data breaches even where they do not need to be reported to the ICO, in accordance with UK data protection requirements.

14. Concerns About Privacy

If you have a concern about how I have handled your personal information, please contact me first:

Name: Léa Morris

Business: Léa Morris Postnatal Doula

Email: leamorrisdoula@gmail.com

Telephone: +447888472653

I will take your concern seriously and aim to resolve it fairly and promptly.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator, if you are unhappy with how I have handled your personal information.

You can find information about making a complaint on the ICO website.

Policy effective from: 04/09/2026
Policy review date: 04/09/2027