When you use Calm Parents and Babies you trust me with your information. This privacy policy explains what data is collected, why I collect it, and what I do with it.

Rachel Hosker assumes the function of data controller and supervises the compliance with General Data Protection Regulation (GDPR) within the business. 

Calm Parents and Babies holds personal data as part of conducting a professional service. Data collected is as follows: general administrative records and financial records.

• Calm Parents and Babies may hold information regarding attendance reports and accident report forms.

• A financial record pertains to all financial information concerning the practice, e.g. invoices, receipts, information for Revenue. Calm Parents and Babies may hold data in relation to: on-line purchasing history, card payments, bank details, receipts and invoices. Information will include name of bill payer, client name, address and record of invoices and payments made.

Personal data will be provided by the client, or in the case of a child (under 1 year), their parent(s)/guardian(s). This information will be collected as part of the booking consent form prior to, or on the date of first contact. 

I use the information I collect to maintain the general running of the business, such as running my booking system, keeping my accounts and updating you of any changes in policies or fees. 

• The retention periods are the suggested time periods for which the records should be held based on the organisation’s needs, legal and/or fiscal precedence or historical purposes. Following the retention deadline, all data will be destroyed under confidential means.

• Calm Parents and Babies keeps electronic records of financial data from those who use my services. 
• Section 886 of the Direct Tax Acts states that the Revenue Commissioners require records to be retained for a minimum period of six years after the completion of the transactions, acts or operations to which they relate. These requirements apply to manual and electronic records equally.
• Financial Data is kept for 6 years to adhere to Revenue guidelines.
• Financial Data (including non-payment of bills) can be given to Revenue at Revenue’s request.

• Contact Data is kept for 6 years to allow processing of Financial Data if required.  (This may be retained for longer for safety, legal request, or child protection reasons.)

• If under investigation or if litigation is likely, files must be held in original form indefinitely, otherwise files are held for the minimum periods set out above. 

I do not share any personal information with companies, organisations and individuals outside Calm Parents and Babies unless one of the following circumstances apply: 

• I will only share your Personal Identifying Information (PII) to third parties when I have express written permission by letter or email to do so. I require opt-in consent for the sharing of any sensitive information.
• Third parties may include: GPs, Midwives or Health Visitors.

• I will share personal information with companies or organisations outside of Calm Parents and Babies if disclosure of the information is reasonably necessary to:
• Meet any applicable law, regulation, legal process or enforceable governmental request.
• Meet the requirements of the Children First Act 2015.
• To protect against harm to the rights, property or safety of Calm Parents and Babies, my service users, or the public as required or permitted by law. 

• Calm Parents and Babies is required to share Financial data with their accountant and details can be shared if required.

The following third parties are engaged for processing data:

1. Accountant: Financial data for processing financial accounts
2. Storage systems; Contact data for details of clients booked onto Calm Parent and Babies workshops

Prior to the first workshop a copy of the data protection policy will be provided by email to clients along with a client contract.  A consent form will need to be signed by the client prior to commencing the service. Copies of the signed consent forms and client contract will be given to both parties. 

Should a client wish to withdraw their consent for data to be processed, they can do so by contacting Calm Parents and Babies. 

In accordance with the General Data Protection Regulation (GDPR), I will endeavour to protect your personal data in a number of ways:

• All data collected by me will be collected solely for the purposes set out at 1 above and will be collected for specified, explicit and legitimate purposes.  The data will not be processed any further in a manner that is incompatible with those purposes save in the special circumstances referred to in section 5.1. Furthermore, all data collected by me will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is collected which include the delivery of antenatal parent workshops, IAIM baby massage workshops and postnatal support workshops.

• Data will only be shared and transmitted, be it on paper or electronically as is required, and as set out in section 3.

• When it is required and by limiting its accessibility to any other third parties.

• Data will be kept until the family cease accessing support from Calm Parents and Babies. Where data is required to be held by me for longer than a period of 3 months, I will put in place appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These may include measures such as the encryption of electronic devices, pseudonymisation of personal data, and/or safe and secure storage facilities for electronic records. 

• which in this case is until the family have ceased attending Calm Parents and Babies Workshops, except for circumstances in which retention of data is required in circumstances set out at part 1.1 above or in certain specific circumstances as set out at Article 23(1) of the GDPR.

• This could include the use of confidential shredding facilities or, if requested by the individual, the return of personal records to the individual.

• Adults have the right to request data held on them as per article 15 of GDPR. A request must be made in writing. Further information regarding accessing your personal data are available in the document ‘Rights of Individuals under the General Data Protection Regulation’, downloadable from: www.gdprandyou.ie

• For children under the age of 16, data access requests are made by their guardians. When a child turns 16, then they may make a request for their personal data. However, this is subject to adherence with the Children First Act. 

Calm Parents and Babies, as with most providers of healthcare services is aware of the need for privacy. As such, I aim to practice privacy by design as a default approach, and only obtain and retain the information needed to provide you with the best possible service. 

All data used by Calm Parents and Babies including personal data may be retained in any of the following formats:

1.  Electronic Data

2.  Physical Files

The type of format for storing the data is decided based on the format the data exists in.

I will then use the electronic data system to scan all physical notes on to this system in a timely manner

• Calm Parents and Babies understands that the personal data used in order to provide a service belongs to the individuals involved. The following outlines the steps which Calm Parents and Babies uses to ensure that the data is kept safe.

• All electronic data is contained in the following system; Air Table. It uses two-factor authentication login and encrypted data replication across different servers to keep your records safe.

• Microsoft Outlook
  This system is physically located in United Kingdom
• This system provider is aware of their requirements for GDPR compliance
• This system has a Live Update for security enabled.
• All persons working in Build My Words have read/write/delete access to records.
• All persons require a Log on and Password in order to access the records.

• Microsoft Word
  This system is physically located in the United Kingdom
• This system provider is aware of their requirements for GDPR compliance.
• The system has an internal administrator / Database owner.
• This system does not have a Live Update for security enabled.
• All persons working in Calm Parents and Babies have read/write/delete access to records.
• All persons require a Log on and Password in order to access the records.

• All physical data is located in: 
• This system is physically located  securely at Ringway, Waverton Chester CH3 7NP
• Only Rachel Hosker working in Calm Parents and Babies has access to these records.
• These records are kept in a metal box secured with a lock and key.

• Calm Parents and Babies understands that requirements for electronic and physical storage may change with time and the state of the art. As such, the data controller in Calm Parents and Babies reviews the electronic and physical storage options available every year.

8.2.2

• All physical devices used by persons working in Calm Parents and Babies which may contain any identifiable PII are not enabled with loss theft tracking and remote wipe abilities.

8.2.3

• All persons working in Calm Parents and Babies are aware and refresh the requirements for good data hygiene every 6 months. This briefing compliance is monitored by Calm Parents and Babies and includes, but is not limited to:
•  Awareness of client conversations in unsecure locations.
•  Enabling auto-lock on devices when leaving them unattended.
•  Use of non-identifiable note taking options (initials, not names).
• The awareness of Calm Parent and Babies procedure should a possible data breach occur, either through malicious (theft) or accident (loss) of devices or physical files. 

Date of document: 30/07/2026

Review Date: 30/07/27