Privacy Policy – Birth Rebel Ltd

Who we are and our contact details

We are Birth Rebel Ltd, a company registered in England and Wales (company number 16449005), with our registered office at 84 Salehurst Road, London, SE4 1AW, United Kingdom.

We operate a maternity care marketplace that connects parents with independent, non-medical maternity and postnatal caregivers. We facilitate matching, communication, session booking, and payments through our platform.

If you have any questions about this policy or how we use your data, you can contact us at hello@birthrebel.com.

Birth Rebel Ltd is the data controller for the purposes of UK data protection law.

Compliance

We process personal data in accordance with all applicable UK data protection and privacy legislation, including:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• The Privacy and Electronic Communications Regulations 2003 (as amended)

We only process personal data where it is necessary, proportionate, and for the purposes set out in this policy. We use appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

What information we collect, use, and why

We collect and use personal information to:

1. provide our services
2. operate and manage your account
3. send service-related updates or marketing communications (where permitted)
4. respond to queries, complaints, or claims

This may include:

Parents and users

• Full name
• Email address
• Date of birth
• Gender (optional)
• Information you choose to share about pregnancy, birth, or postnatal topics
• Location data (general area only)
• IP address and device information
• Which organisation referred you to us, if you came through a referral link or leaflet (for example, a Family Hub)

Caregivers

• Title
• Qualifications and training
• Professional profile information
• Availability and service details

Payments

• Banking and payment details (processed securely by Stripe – we do not store full card details)

Special category data

Some of the information you choose to share with us may be classed as special category data under UK GDPR. This includes information relating to pregnancy, postnatal recovery, or other health-related topics, as well as diversity and identity information such as ethnic background, religion or faith, gender identity, sexual orientation, and disability or long-term health conditions.

We only collect this information where it is necessary to provide our services. For parents, this may include health or pregnancy-related information you share to help us match you with the right caregiver. For caregivers, this includes both health-related practice information and the optional diversity and identity information you provide during onboarding.

We rely on your explicit consent under Article 9(2)(a) of the UK GDPR for all special category data. This consent is obtained via a dedicated opt-in at the point of collection and is separate from your acceptance of our general terms.

You can withdraw your consent at any time by contacting us at hello@birthrebel.com. Withdrawal will not affect the lawfulness of any processing carried out before you withdrew consent.

Lawful bases and your data protection rights

Under UK data protection law, we must have a lawful basis for using your personal information. The lawful basis we rely on may affect which rights apply in each situation. In some cases, all of your rights will apply, and in others, certain rights may be limited or not relevant.

Your rights include:

• Right of access – request a copy of your data
• Right to rectification – correct inaccurate or incomplete data
• Right to erasure – request deletion in certain circumstances
• Right to restriction – limit how we use your data
• Right to object – object to certain uses of your data
• Right to data portability – receive or transfer your data
• Right to withdraw consent – where we rely on consent

We will respond to valid requests within one month.

To exercise any of these rights, contact us at hello@birthrebel.com.

Our lawful bases for using your data

We rely on the following lawful bases:

Contract

We use your data to enter into and perform our contract with you, including providing services, managing bookings, and processing payments.

Legal obligation

We may use your data to comply with legal and regulatory requirements.

Consent

Where required (for example, for marketing or special category data), we rely on your consent. You may withdraw this at any time.

Legitimate interests

We may use your data where necessary for our legitimate interests, provided these do not override your rights. For example, to improve our platform, prevent fraud, send important service-related updates, and understand which organisations refer families to us so we can report back to them. You have the right to object to this processing.

Where we get your information from

We collect personal data:

• Directly from you
• From your use of our platform
• From publicly available sources (e.g., professional listings for caregivers)
• From the referral link or leaflet you used to reach us, which tells us which organisation referred you

How long we keep your information

We retain personal data only for as long as necessary to:

• Provide our services
• Meet legal obligations
• Resolve disputes
• Enforce agreements

Typically:

• Account and transaction records: 6 years after account closure
• Communications and usage records: up to 2 years after last interaction
• Booked calls and who joined them: for paid sessions, 6 years after the session; for free intro calls, 12 months after the call

If we no longer need your data, we will delete or anonymise it.

Data storage, transfers and security

Your data is stored on secure servers within the UK and EEA.

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent protections.

We use encryption, access controls, and secure authentication methods to protect your information.

Who we share your information with

Our service providers (data processors)

We use trusted third-party providers to help us operate our platform, including:

• Upwork – platform development and technical services
• Supabase – database, authentication, and data storage
• Stripe – payments
• Klaviyo – email communications
• Cal.com – scheduling and video sessions
• Deformity – AI-powered form builder for parent onboarding and data collection
• Signable – e-signatures
• Cloudflare – web security and hosting
• PostHog – analytics
• Google Workspace – internal communications
• Daily – video calls between families and caregivers
• Google – calendar connection for caregivers who choose it (busy times, and adding Birth Rebel calls to their calendar)
• Microsoft, for caregivers who choose to connect an Outlook or Microsoft 365 calendar (to see when they're busy and add Birth Rebel calls to their calendar).
• Resend – booking emails and calendar invites
• Vonage – appointment reminder texts

Each provider is bound by a Data Processing Agreement.

Referring organisations

If an organisation such as a Family Hub referred you, we may tell them how many families they referred and how many went on to be matched with a caregiver. We only share totals, never your name or any other details about you.

Marketplace sharing

If you are a parent, we will share relevant information with the caregiver you choose or approve, to enable delivery of services.

If you are a caregiver, we will share relevant information with parents who have chosen or been matched with you.

Calendars and video calls

Video calls

Calls between families and caregivers happen on Birth Rebel, using Daily. Calls are not recorded or transcribed. Daily handles the call's sound and video while it's happening, and doesn't keep them. We keep a record of who joined each call, when, and for how long, so that we know calls are taking place. Your first name is shown to the other person on the call. Daily also processes technical details needed to connect the call, such as your IP address and the device and browser you use. Calls are routed through servers in the UK or EU where possible. Daily is based in the US, and transfers are protected by UK data protection safeguards.

Caregivers' calendars

Caregivers connect a calendar so that families are only offered times when the caregiver is free. A caregiver can connect Google Calendar, Microsoft Outlook or Microsoft 365, or a private calendar link from another calendar service.

• We only use when the caregiver is busy (start and end times). We never read or keep the titles, descriptions, locations or guests of their own appointments.
• With the caregiver's permission, we add each Birth Rebel call to the calendar they choose, with the family's first name and a link to their dashboard, and move or remove it when the call changes. We don't add the family's contact details.
• Calendar sign-in details and private calendar links are stored encrypted and are only used by our servers.
• A caregiver can disconnect a calendar at any time from their calendar settings. We then delete the stored sign-in details and, for Google, withdraw our access. For Microsoft, deleting the stored sign-in details ends our access, and the caregiver can also remove Birth Rebel in their Microsoft account settings.

Google user data

Birth Rebel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we don't use Google calendar data for advertising, we don't sell it, we don't let people read it except where the caregiver asks us to or the law requires it, and we don't use it to train artificial intelligence models.

Cookies and analytics

We use cookies and similar technologies to operate our platform, understand usage, and improve our services. Some cookies are essential, while others (such as analytics) require your consent.

For more information, please see our Cookie Policy.

Children's data

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from children. If we become aware that we have done so, we will delete it promptly.

Automated decision-making

We do not use automated decision-making or profiling that has legal or similarly significant effects. If this changes, we will update this policy.

How to complain

If you have concerns about how we use your data, contact us at hello@birthrebel.com.

You also have the right to complain to the ICO: