Privacy and Confidentiality Policy
Liz Farrant IBCLC and HSCP
Last updated: 21 September 2026
This Privacy and Confidentiality Policy explains how I collect, use, store and protect your personal information when you access my website, make an enquiry, book a consultation or receive feeding and/or sleep support services from me.
In this policy, “I”, “me” and “my” refer to Liz Farrant, practising as an International Board Certified Lactation Consultant (IBCLC) and Holistic Sleep Coach Practitioner (HSCP).
I am committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
- Who I Am
Data Controller:
Liz Farrant IBCLC and HSCP
Email: feeding@lizfarrant.co.uk
Telephone: 07818 943261
Website: www.lizfarrant.co.uk
As the data controller, I am responsible for deciding how your personal information is collected, stored and used.
- The Information I Collect
To provide safe, effective and personalised feeding and sleep support, I may collect the following information about you and your child.
Personal Information
This may include:
- Your name
- Address
- Telephone number
- Email address
- Date of birth
- Baby’s name and date of birth
- GP details
- Health visitor details
- Emergency contact details where appropriate
Health Information
I may collect information relating to:
- Pregnancy and birth history
- Medical history
- Feeding history
- Infant development
- Sleep patterns
- Current medications
- Allergies
- Relevant family health information
- Any physical or mental health conditions relevant to the support requested
Health information is classed as a special category of personal data and receives additional protection under UK GDPR.
Website Information
When you visit my website, certain information may be collected automatically, including:
- IP address
- Browser type
- Device information
- Website usage statistics
This information helps improve website functionality and user experience.
- Why I Collect Your Information
I collect and process personal information so that I can:
- Respond to enquiries
- Arrange appointments
- Deliver feeding and sleep consultations
- Maintain professional records
- Provide follow-up support
- Communicate with you regarding your care
- Issue invoices and process payments
- Meet professional, legal and insurance requirements
- Safeguard children and vulnerable individuals where necessary
- Lawful Basis for Processing
Under UK GDPR, I process personal information using the following lawful bases:
Contract
Processing is necessary to provide the services you have requested.
Legitimate Interests
Processing is necessary to operate my practice effectively and maintain appropriate records.
Legal Obligation
Processing is required to comply with legal, professional, safeguarding and insurance obligations.
Explicit Consent
Where required, I will ask for your explicit consent before processing special category health information or using specific tools such as Heidi Health.
You may withdraw consent at any time, although this will not affect processing already undertaken lawfully.
- Confidentiality
Confidentiality is extremely important to me.
Information shared during consultations will be treated confidentially and will not be disclosed to third parties without your permission except where:
- Required by law
- Required by a court order
- Necessary to comply with safeguarding obligations
- Necessary to prevent serious risk of harm to you, your child or another person
- Required by my professional indemnity insurers or legal advisors
Where disclosure becomes necessary, I will usually discuss this with you first unless doing so would place someone at risk.
- Use of Heidi Health AI Scribe
To support accurate record keeping and allow me to focus fully on our consultation, I may use Heidi Health, an AI-powered clinical documentation platform.
If Heidi Health is used:
- Consultation conversations may be securely processed through the Heidi platform.
- Heidi generates draft consultation notes.
- All notes are reviewed, checked, amended where necessary and approved by me before becoming part of your clinical record.
- I remain fully responsible for the accuracy and content of all records.
To protect your privacy:
Only your first name and your baby’s first name are entered into Heidi Health. No additional identifying personal information is recorded within the Heidi platform.
Use of Heidi Health is entirely optional.
You will be asked whether you consent to its use during registration. If you choose not to consent, I will make notes manually and your consultation will proceed in exactly the same way.
You may withdraw consent at any point before or during the consultation.
Further information regarding Heidi Health’s privacy and security measures can be found in their own privacy documentation.
- How Your Information Is Stored
I take appropriate security measures to protect your information.
Records may be stored:
- Securely within my encrypted cloud-based systems
- In password-protected electronic files
- In secure practice management systems where applicable
- As scanned copies of handwritten consultation notes
I implement reasonable technical and organisational safeguards to prevent:
- Unauthorised access
- Loss
- Alteration
- Misuse
- Disclosure
No online system can be guaranteed completely secure, but I take all reasonable precautions to safeguard your information.
- How Long Records Are Kept
I retain consultation records for 25 years from the date of the consultation in order to meet professional, legal, safeguarding and insurance requirements relating to services provided to children and families.
When records are no longer required, they will be securely deleted, anonymised, or destroyed.
- Sharing Information
I do not sell or rent personal information to third parties.
Information may only be shared where necessary with:
- Your GP
- Midwife
- Health Visitor
- Paediatrician
- Other healthcare professionals involved in your care
- Professional indemnity insurers
- Legal advisors
- Regulatory authorities
- Safeguarding services
Where possible, your consent will be sought before sharing information unless there is a legal or safeguarding reason preventing this.
- Photography, Images and Videos
You may choose to send photographs or videos to assist assessment and support.
Examples include:
- Feeding positions
- Latch assessment
- Pumping concerns
- Sleep environments
- Infant behaviour
Images and videos shared with me are treated as confidential clinical information and stored securely in accordance with this policy.
If you would prefer to use a more secure method than WhatsApp to send sensitive images or videos, please let me know and we can agree an alternative approach.
- WhatsApp, Email and Electronic Communication
I recognise that many clients find WhatsApp and email convenient methods of communication.
Please be aware that:
Email and WhatsApp are not clinical-grade healthcare systems.
While both have security features, transmission over the internet can never be completely guaranteed.
Any information you send is treated confidentially and handled with appropriate care.
By communicating via these methods, you acknowledge the associated risks.
- Your Rights
Under UK GDPR, you have several rights regarding your personal information.
These include:
- The right to access your information
- The right to request correction of inaccurate information
- The right to request deletion of information where appropriate
- The right to restrict processing
- The right to object to processing
- The right to data portability
- The right to withdraw consent
Some rights may be limited where records are required for legal, safeguarding, insurance or professional purposes.
Requests can be made by contacting:
feeding@lizfarrant.co.uk
- Website Cookies
My website may use cookies and similar technologies to improve functionality and user experience.
Cookies may:
- Help the website function properly
- Remember your preferences
- Monitor website performance
- Provide analytics information
You can manage cookie preferences through your browser settings.
- Data Breaches
In the unlikely event of a personal data breach that presents a risk to your rights and freedoms, I will:
- Investigate the breach promptly
- Take steps to minimise any risk
- Notify the Information Commissioner’s Office (ICO) where required
- Notify affected individuals where legally required
- Changes to This Policy
This policy may be updated from time to time to reflect changes in legal requirements, professional standards or business practices.
The most recent version will always be available on my website.
- Contact Information
If you have any questions regarding this Privacy and Confidentiality Policy or how your personal information is handled, please contact:
Liz Farrant IBCLC and HSCP
feeding@lizfarrant.co.uk
07818 943261
www.lizfarrant.co.uk
Complaints
If you are unhappy with how your personal information has been handled, please contact me first so I have the opportunity to address your concerns.
You also have the right to complain to:
Information Commissioner’s Office (ICO)
Website: https://www.ico.org.uk
Telephone: 0303 123 1113