Privacy Policy

Last updated: 13 March 2026

1) Who we are (Data Controller)
Karen Moss Health (“we”, “us”, “our”) provides private health visiting services to families in the UK. We are the data controller for the personal data we process through this website and in the course of our services.
Business address: is Citadel House, 58 High Street, Hull, HU11QE
Email: info@karenmosshealth.co.uk
Telephone: +447364215727
ICO Registration Number: ZC100835

If you have any questions about this Privacy Policy or how we handle personal data, please contact us using the details above.

2) The data we collect
a) Data you provide directly
Contact details: name, email address, phone number, postal address.
Booking/enquiry details: reason for contact, preferred dates, service type, freetext messages.
Client records: pregnancy, postnatal details, feeding information, sleep, growth, development, family context, safeguarding concerns, and other relevant health and social care information.
Payment information: billing name, address; we use [payment processor, e.g., Stripe/Square]—we do not store full card details on our systems.
Consent and preferences: consent forms, marketing preferences, privacy choices.
b) Data collected automatically (website/app)
Technical data: IP address, device type, browser type/version, time zone, operating system.
Usage data: page views, clicks, referring/exit pages, session duration.
Cookies and similar tech: see Cookies section below.
c) Special category data
We may process health data and information regarding children’s health and development when necessary for our services. This information receives additional protection under data protection law.

3) Why we use your data (Purposes) and lawful bases
We only use your personal data when the law allows us to. Under the UK GDPR and Data Protection Act 2018, our lawful bases include:

Where we rely on consent, you can withdraw it at any time by contacting us (see Section 1) or using unsubscribe/consent tools provided.

4) Children’s data

We provide services to families with infants and children. We handle children’s personal data with enhanced care and confidentiality and only collect what is necessary to provide safe and effective care. We obtain consent from a parent or legal guardian where required and act in the best interests of the child, including escalating concerns where safeguarding is at stake (see Section 8).

5) How we share personal data

We only share personal data where necessary, proportionate, and lawful: Health professionals and services: GPs, midwives, health visitors, HV services, NHS providers, lactation consultants, perinatal mental health, or local authority services—with your knowledge and where appropriate, or without prior notice only if required to protect a child or vulnerable person from harm. Safeguarding partners: local safeguarding children partnerships, social care, police—where we have a safeguarding duty. Service providers (processors): secure practice management systems, email providers, cloud storage, payment processors, website/IT providers, analytics tools—bound by contracts that protect your data. Legal/Regulatory: HMRC, courts, the ICO, or other authorities where required by law. We do not sell your personal data.

6) International transfers

Some service providers may process data outside the UK. Where that happens, we ensure appropriate safeguards are in place (e.g., UK International Data Transfer Agreement, Addendum, or adequacy regulations) to protect your data.

7) How we keep data secure

We use management software WriteUPP ISO 27001 certified, GDPR compliant platform.

8) Safeguarding, confidentiality, and when we may need to share

We treat your information confidentially. However, where we believe a child or vulnerable adult may be at risk of significant harm, we may share relevant information with safeguarding authorities without consent if necessary to protect them. We will keep disclosures proportionate and record our decisions.

9) Data retention (how long we keep data)

We keep personal data only for as long as necessary for the purposes set out in this policy, including legal, accounting, or reporting requirements. Health records are typically retained for the period recommended by relevant professional and NHS guidance. As a general guide (subject to service type and local rules): Adult client records: at least 8 years after last contact. Children’s records: until the child’s 25th birthday (or 26th if aged 17 at last treatment), or longer if required for safeguarding or legal reasons. Financial records: 6 years plus current tax year.
We will confirm exact retention periods in your service agreement or upon request.

10) Your rights

You have rights under UK data protection law, including: Access to your personal data and copies of records. Rectification of inaccurate or incomplete data. Erasure (“right to be forgotten”) in certain circumstances. Restriction of processing in certain cases. Data portability (for data you provided to us by consent/contract). Object to processing based on legitimate interests or to direct marketing. Withdraw consent where we rely on consent.
To exercise your rights, contact us (Section 1). We may need to verify your identity and will respond within one month (extendable by two further months for complex requests). Some rights may be limited where health, legal obligations, or safeguarding apply.

11) Cookies and analytics

We use cookies to make our site work and to improve your experience. Strictly necessary cookies (always on): enable core functionality such as page navigation and security. Analytics/performance cookies: help us understand site usage and improve content (set only with your consent). Marketing cookies (if used): to deliver relevant content/ads (set only with your consent). Your choices: You can accept, reject, or manage nonessential cookies via our cookie banner. You can also adjust browser settings to block cookies. Blocking some cookies may affect site functionality. Sample cookie banner text: “We use essential cookies to make this site work. With your consent, we also use analytics cookies to understand how you use our site so we can improve it. You can change your choices at any time. See our Privacy Policy.”
Buttons: Accept all | Reject nonessential | Manage settings If you’d like, I can provide a cookie policy page with a full cookie table (name, purpose, duration, provider).

12) Thirdparty links

Our website may include links to thirdparty sites. We are not responsible for their privacy practices. Please review their privacy policies.

13) Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be posted on this page with the “Last updated” date. 15) How to complain If you have concerns about our use of your personal data, please contact us first so we can try to resolve them. You can also complain to the Information Commissioner’s Office (ICO): Website: https://ico.org.uk/concerns Telephone: 0303 123 1113 Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 16) Legal bases and references (plain English) UK GDPR and Data Protection Act 2018 govern how we process personal and special category data in the UK. Health data is processed under Art. 9(2)(h) (health or social care) and, where necessary for protection, under substantial public interest conditions such as safeguarding (DPA 2018, Schedule 1, para 18). You have rights including access, rectification, erasure, restriction, portability, and objection; timelines are set by UK GDPR. International transfers require appropriate safeguards (e.g., UK IDTA).