Privacy Policy – Birth Rebel Ltd

Who we are and our contact details

We are Birth Rebel Ltd, a company registered in England and Wales (company number 16449005), with our registered office at 84 Salehurst Road, London, SE4 1AW, United Kingdom.

We operate a maternity care marketplace that connects parents with independent, non-medical maternity and postnatal caregivers. We facilitate matching, communication, session booking, and payments through our platform.

If you have any questions about this policy or how we use your data, you can contact us at hello@birthrebel.com.

Birth Rebel Ltd is the data controller for the purposes of UK data protection law.

Compliance

We process personal data in accordance with all applicable UK data protection and privacy legislation, including:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• The Privacy and Electronic Communications Regulations 2003 (as amended)

We only process personal data where it is necessary, proportionate, and for the purposes set out in this policy. We use appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

What information we collect, use, and why

We collect and use personal information to:

1. provide our services
2. operate and manage your account
3. send service-related updates or marketing communications (where permitted)
4. respond to queries, complaints, or claims

This may include:

Parents and users

• Full name
• Email address
• Date of birth
• Gender (optional)
• Information you choose to share about pregnancy, birth, or postnatal topics
• Location data (general area only)
• IP address and device information

Caregivers

• Title
• Qualifications and training
• Professional profile information
• Availability and service details

Payments

• Banking and payment details (processed securely by Stripe – we do not store full card details)

Special category data

Some of the information you choose to share with us may be classed as special category data under UK GDPR. This includes information relating to pregnancy, postnatal recovery, or other health-related topics, as well as diversity and identity information such as ethnic background, religion or faith, gender identity, sexual orientation, and disability or long-term health conditions.

We only collect this information where it is necessary to provide our services. For parents, this may include health or pregnancy-related information you share to help us match you with the right caregiver. For caregivers, this includes both health-related practice information and the optional diversity and identity information you provide during onboarding.

We rely on your explicit consent under Article 9(2)(a) of the UK GDPR for all special category data. This consent is obtained via a dedicated opt-in at the point of collection and is separate from your acceptance of our general terms.

You can withdraw your consent at any time by contacting us at hello@birthrebel.com. Withdrawal will not affect the lawfulness of any processing carried out before you withdrew consent.

Lawful bases and your data protection rights

Under UK data protection law, we must have a lawful basis for using your personal information. The lawful basis we rely on may affect which rights apply in each situation. In some cases, all of your rights will apply, and in others, certain rights may be limited or not relevant.

Your rights include:

• Right of access – request a copy of your data
• Right to rectification – correct inaccurate or incomplete data
• Right to erasure – request deletion in certain circumstances
• Right to restriction – limit how we use your data
• Right to object – object to certain uses of your data
• Right to data portability – receive or transfer your data
• Right to withdraw consent – where we rely on consent

We will respond to valid requests within one month.

To exercise any of these rights, contact us at hello@birthrebel.com.

Our lawful bases for using your data

We rely on the following lawful bases:

Contract

We use your data to enter into and perform our contract with you, including providing services, managing bookings, and processing payments.

Legal obligation

We may use your data to comply with legal and regulatory requirements.

Consent

Where required (for example, for marketing or special category data), we rely on your consent. You may withdraw this at any time.

Legitimate interests

We may use your data where necessary for our legitimate interests, provided these do not override your rights. For example, to improve our platform, prevent fraud, and send important service-related updates. You have the right to object to this processing.

Where we get your information from

We collect personal data:

• Directly from you
• From your use of our platform
• From publicly available sources (e.g., professional listings for caregivers)

How long we keep your information

We retain personal data only for as long as necessary to:

• Provide our services
• Meet legal obligations
• Resolve disputes
• Enforce agreements

Typically:

• Account and transaction records: 6 years after account closure
• Communications and usage records: up to 2 years after last interaction

If we no longer need your data, we will delete or anonymise it.

Data storage, transfers and security

Your data is stored on secure servers within the UK and EEA.

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent protections.

We use encryption, access controls, and secure authentication methods to protect your information.

Who we share your information with

Our service providers (data processors)

We use trusted third-party providers to help us operate our platform, including:

• Upwork – platform development and technical services
• Supabase – database, authentication, and data storage
• Stripe – payments
• Klaviyo – email communications
• Cal.com – scheduling and video sessions
• Deformity – AI-powered form builder for parent onboarding and data collection
• Signable – e-signatures
• Cloudflare – web security and hosting
• PostHog – analytics
• Google Workspace – internal communications

Each provider is bound by a Data Processing Agreement.

Marketplace sharing

If you are a parent, we will share relevant information with the caregiver you choose or approve, to enable delivery of services.

If you are a caregiver, we will share relevant information with parents who have chosen or been matched with you.

Cookies and analytics

We use cookies and similar technologies to operate our platform, understand usage, and improve our services. Some cookies are essential, while others (such as analytics) require your consent.

For more information, please see our Cookie Policy.

Children's data

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from children. If we become aware that we have done so, we will delete it promptly.

Automated decision-making

We do not use automated decision-making or profiling that has legal or similarly significant effects. If this changes, we will update this policy.

How to complain

If you have concerns about how we use your data, contact us at hello@birthrebel.com.

You also have the right to complain to the ICO: