Privacy Notice

1 Who controls your information

MidwifePlus Ltd is the controller for the personal information it uses to operate these services. Independent organisations reached through directory links control information you give them directly and provide their own privacy notices. Our registration agreement does not make those organisations processors for MidwifePlus.

You may browse public resources without registering. We do not need medical histories to provide directory signposting and do not invite health information through general forms. Do not include patient records or another person’s confidential information.

2 Information and sources

Orders: names, billing and delivery addresses, contact details, purchased items, payment status, refunds and correspondence. Payment providers handle payment credentials; any payment information available to us depends on the payment method and provider. We use only what is needed for the transaction, fraud prevention and accounting.

Contacts and concerns: your name, contact details, messages and information needed to investigate an enquiry, complaint, listing concern or product safety issue. Information comes from you and, where relevant, carriers, payment providers, listed organisations, advisers and authorities.

Organisation applications: representative names, roles and business contact details; organisation identity, services, public profile content; registration, qualification, safeguarding and insurance evidence where proportionate; acceptance records and review decisions. Evidence may come from applicants, public registers, official organisation websites and relevant professional or regulatory bodies. We distinguish public listing information from private evidence.

Available account and saved-item functions: account identifiers, email address, authentication information, saved resources and preferences required for the function you choose. A reference to a function here does not mean you must create an account to browse.

Technical use: device and browser information, IP addresses and security logs; and, where enabled with the required choice mechanism, pages, searches, filters and link interactions. Searches and link choices may reveal sensitive interests, so we must not use them to infer health conditions or create health profiles without an appropriate legal basis and safeguards.

Marketing: subscription contact details, communication preferences and records of consent or a permitted existing-customer opt-in. We may receive publicly available work contact details when maintaining public resource listings; where required we provide privacy information directly.

3 Purposes and lawful bases

Orders, payments, delivery, refunds and requested account functions: performance of a contract with you, or steps you request before entering a contract. Where a corporate customer contracts with us, processing its representative’s information generally relies on our legitimate interests in administering that relationship rather than a contract with the representative personally.

Enquiries, complaints and listing administration: legitimate interests in answering requests, keeping an accurate directory, assessing applicants and resolving concerns; contract where necessary to perform a contract with the individual concerned; legal obligation for processing required by consumer, tax, safety or other applicable law. These bases apply to distinct purposes and are not interchangeable alternatives selected after the event.

Security and prevention of misuse: legitimate interests in protecting users, systems and transactions, and legal obligation where a specific duty applies. We assess necessity and balance our interests against individuals’ rights when relying on ordinary legitimate interests.

Analytics: consent for personal information used in optional device-based analytics under the consent approach described in our Cookie Policy. Necessary operational logs are separately assessed for security or service delivery. Reports given to organisations must be aggregate and must not identify visitors.

Marketing: consent, except where the law permits the existing-customer soft opt-in for our own similar products or services. That exception requires contact details obtained during a sale or negotiations, an opt-out at collection and an easy opt-out in every message. A directory enquiry, account or organisation registration does not automatically authorise marketing.

Legal claims and record keeping: legitimate interests in establishing, exercising or defending claims and legal obligation for applicable statutory records. If sensitive information arrives unexpectedly, we restrict access, assess whether both an ordinary lawful basis and a relevant special-category condition exist, and delete or redact unnecessary information. We do not treat receipt of a message as blanket consent to health-data processing. Any necessary safeguarding disclosure requires a documented lawful basis and, where relevant, additional conditions.

4 Sharing and directory links

We share information only as needed with hosting and website support providers, payment services, delivery companies, email and communication providers, consent or analytics providers, professional advisers, insurers and competent authorities. Processor services must be governed by appropriate contracts. Payment providers, couriers and advisers may act as independent controllers for their own purposes.

Organisation evidence is available only to authorised people who need it for review or related legal and safety purposes; it must not be published as part of the profile. We do not sell personal information.

We do not send identifiable parent enquiries or contact details to listed organisations as part of directory signposting. Clicking a provider link opens its own contact route; that provider may receive information through your browser or your direct interaction. External services have their own privacy practices. Where we record link activity, any organisation-facing report must prevent identification, including through small counts or combinations of data.

Before introducing on-platform provider messaging or identifiable referrals, we must assess lawful bases, sensitive-data risks and controller roles and provide updated information before collection.

5 Overseas processing

Service providers may involve hosting or access outside the UK. A restricted transfer may take place only where an appropriate UK adequacy regulation, approved transfer safeguard or other lawful transfer route applies. Where required, we assess the protection in the destination and implement supplementary safeguards.

You may request information about relevant overseas recipients, destinations and the applicable safeguard, including a copy or explanation of it, at admin@midwifeplus.com. We may redact confidential material while explaining the protection. This general wording does not substitute for providing the specific transfer information required for the services actually used.

6 Retention and deletion

We retain information only for its purpose, applicable legal duties and reasonably foreseeable disputes. Accounting and transaction records are retained for the applicable statutory accounting and tax period, assessed by reference to the financial year concerned. We do not use the date of an order as a universal statutory retention start date.

Routine enquiries are retained until resolved and for a proportionate period needed for follow-up or disputes. Complaints, safety and legal records may need longer retention because of the seriousness of the issue, relevant limitation periods or an active investigation. We keep only the information necessary for that purpose.

Private applicant evidence is retained while needed for verification and proportionate review. After rejection, expiry or delisting, we assess appeal, legal and safety needs, delete unnecessary underlying documents and retain only justified decision and contractual records. Account closure ends ordinary account use; necessary transaction or legal records remain separately restricted.

Marketing information is used until withdrawal or objection, subject to any other lawful purpose. We retain a minimal suppression record to avoid sending unwanted marketing. Cookie choices and related records are kept for the period disclosed in the cookie controls and as reasonably needed to demonstrate compliance.

We review retention when matters close and when records are no longer required. Deletion or anonymisation must also reach processors; backup copies are restricted and expire through controlled backup cycles. A specific legal hold may temporarily prevent deletion. Ask us for the retention criteria or applicable period for your record.

7 Your rights and choices

Depending on the processing and legal conditions, you may request access, correction, erasure, restriction or portability. You may object to processing based on legitimate interests on grounds relating to your situation. Such objections are assessed under the applicable legal test; they are not an unconditional right to stop all processing. The right to object to direct marketing is absolute.

Withdraw consent at any time through the relevant control or admin@midwifeplus.com. Withdrawal does not affect earlier lawful processing. We normally respond to rights requests without undue delay and within one month, subject to lawful extensions, exceptions and any lawful pause for necessary clarification. We will explain any extension or refusal. Identity checks must be proportionate; requests are normally free.

Information necessary for an order or a required verification check may be needed to fulfil that request. Without it we may be unable to deliver, refund, maintain an account or assess a listing. Optional marketing and analytics choices do not determine access to ordinary shopping or public directory browsing.

We do not authorise solely automated decisions producing legal or similarly significant effects under this notice. Any such feature requires a separate assessment and the required explanation, safeguards and rights before use.

8 Security children and complaints

We apply security appropriate to the risks, restrict access and require suitable handling by service providers. No online service can promise absolute security. Our service is directed at adults and is not designed for children to submit personal information. If children’s information is supplied incidentally, we minimise it and assess any additional protection needed.

Raise privacy complaints at admin@midwifeplus.com or our postal address. We aim to acknowledge within five working days and in all cases within the applicable 30-day acknowledgement period, investigate without undue delay, keep you informed and communicate the outcome. Complaints and rights requests have separate legal time limits.

You may complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or 0303 123 1113. We encourage you to contact us, but this does not remove your right to approach the ICO or seek a legal remedy.

We review this notice when processing changes. Material changes will be explained before new processing begins where required. The version published with a review date identifies the notice then in use.