Privacy & Cookie Policy

Effective Date: October 28th, 2026

1. Who I am

I'm Emma Pickett, an International Board Certified Lactation Consultant (IBCLC) working in London N6 and online. I'm responsible for any personal information you share with me, which makes me the "data controller" under UK data protection law.

This policy explains what information I collect, why, who I share it with, how long I keep it and your rights. It covers this website and my services, including consultations, weaning support, A Walk in the Woods, training and the Makes Milk podcast.

Contact me about anything in this policy:

2. What information I collect

I only collect what I need to support you. Most of it comes from you directly.

Website visitors

Squarespace, which hosts this site, collects your device and browser type, your approximate location from your IP address, the pages you view and your cookie choices. Analytics information is only collected if you click Accept (see section 8).

People who contact me

If you contact me by email, the contact form, text, WhatsApp or Instagram message, I keep your name, contact details, your message and anything you tell me about your feeding situation.

Clients

If you book a consultation, antenatal support, weaning support or A Walk in the Woods, I collect the following from you in sessions, forms and messages:

  • your name, contact details and postcode

  • your baby's or child's name and date of birth

  • health information about you and your child, such as birth, feeding history, weight, medical conditions and medicines

  • photos and videos of feeds you send me

  • my session notes

  • your GP or health visitor details, if you give them

  • payment records

Training attendees and organisers

Your name, email address, organisation and role, from the booking form (Jotform) or by email.

Podcast guests

Your name, contact details, the recording and anything you choose to share on air, from you by email and in the recording.

Information about children

When you tell me about your baby or child, I treat that information with the same care and confidentiality as your own. This website isn't aimed at children.

Free groups

Bookings for the Haringey groups at Hornsey Central and Highgate are made through Eventbrite and managed by Haringey Breastfeeding Support, which is responsible for that booking information. I do not record attendees at my Muswell Hill group for those breastfeeding beyond 11 months.

3. How I use your information and why I'm allowed to

Here's what I use your information for, and the legal basis for each use:

  • Replying to your enquiry and arranging a booking: legitimate interests (answering people who contact me) or steps before a contract.

  • Providing consultations, follow-up support, antenatal and weaning packages: contract (the service you've booked).

  • Recording and using health information about you and your child: your explicit consent, which I ask for before or at your first session.

  • Keeping payment and accounting records: legal obligation (HMRC record-keeping rules).

  • Website analytics: your consent, given through the cookie banner.

  • Organising and delivering training: contract, or legitimate interests where an organisation books on your behalf.

  • Recording and publishing podcast episodes: your consent, agreed before recording.

  • Acting on a serious safeguarding concern: vital interests, or safeguarding children and people at risk (substantial public interest).

You can withdraw consent at any time by contacting me. This won't affect anything I did before you withdrew it. If you withdraw consent to my holding health information while I'm supporting you, I may not be able to continue. I may also need to keep existing notes as a record of the care I gave (see section 6).

I don't sell your information, use it for advertising or make automated decisions about you. I'll only add you to a mailing list if you ask to be added.

4. Confidentiality and when I share information

What you tell me in a consultation is confidential. As an IBCLC, I follow the IBLCE Code of Professional Conduct, which requires me to protect your privacy.

I only share your information:

  • With your permission. For example, with your GP, health visitor, midwife or a tongue-tie practitioner when that would help your care.

  • To protect someone from serious harm. If I believe you, your child or someone else is at serious risk, I may contact the relevant services. Where it's safe to, I'll talk to you first.

  • When the law requires it. For example, a court order.

  • For professional supervision. I may discuss a situation with a supervisor or colleague, without details that could identify you.

I never use your story, photos or videos in my books, blog, podcast, social media or training unless you've agreed, or the details are changed so you can't be identified.

I only record video consultations if we've both agreed to it, and I tell you where the recording is kept.

5. Services I use, and data sent outside the UK

I use a small number of trusted services to run my practice. They process information on my behalf and may only use it to provide their service to me.

  • Squarespace: hosting this website, the contact form, website analytics and the cookie banner.

  • Google (Gmail): email.

  • WhatsApp: messages, photos and videos between sessions. Messages are end-to-end encrypted.

  • Zoom: video consultations and training sessions.

  • Jotform: training sign-up forms [and the background form before video calls, if you use it].

  • Buzzsprout: hosting the Makes Milk podcast and the player on my podcast page.

  • Emily Crosby Media: producing the Makes Milk podcast, including editing guests' recordings.

  • Zencastr: arranging and recording podcast interviews.

  • Instagram (Meta): direct messages, if you contact me there.

  • Bank transfers and PayPal: taking payment for sessions. Your bank and PayPal also handle your payment details under their own privacy policies.

Data sent outside the UK

Several of these providers are based in the US or store data outside the UK. When information goes to the US, it's protected either by the UK–US "data bridge" (the UK Extension to the EU–US Data Privacy Framework), where the provider is certified, or by the UK's standard data transfer contract terms included in the provider's agreement. For other countries, I rely on UK adequacy regulations or the same contract terms.

6. How long I keep your information and how I protect it

I keep information only as long as I need it, then delete or securely destroy it.

  • Client records and session notes (including health information): until your child's 25th birthday, or 8 years after our last contact if no child is involved.

  • Photos and videos of feeds: deleted immediately after review.

  • Zoom recordings (only if agreed): deleted on request.

  • Payment and accounting records: at least 5 years after the 31 January tax return deadline for that year, as HMRC requires.

  • Training attendee details: not kept as standard. They may be kept by a separate training host.

  • Website analytics cookies: up to 400 days (see section 8).

Keeping your information safe

My devices are password-protected and encrypted. My accounts use two-step verification. Any paper notes are kept securely. I don't share my work devices with anyone else.

If a data breach is likely to put you at risk, I'll report it to the Information Commissioner's Office (ICO) within 72 hours. If the risk to you is high, I'll tell you directly.

7. Your rights and how to complain

You have the right to:

  • Access: get a copy of the information I hold about you.

  • Correction: ask me to correct anything that's wrong or incomplete.

  • Deletion: ask me to delete your information, unless I need to keep it, for example for tax records.

  • Restriction: ask me to limit how I use your information.

  • Objection: object to my using your information where I rely on legitimate interests.

  • Portability: receive information you gave me in a format you can pass on.

  • Withdraw consent: at any time, including for cookies.

To use any of these rights, email me using the details in section 1. It's free, and I'll reply within one month.

If you're unhappy

Please tell me first so I can try to put it right. I'll acknowledge your complaint within 30 days and let you know the outcome without unnecessary delay.

You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

8. Cookies

This site uses essential cookies for everyone. It only adds analytics cookies if you click Accept on the cookie banner. I don't use advertising or marketing cookies.

Cookies are small files a website stores in your browser. "Local storage" works in a similar way.

Essential cookies (always active)

These are needed for the site to work, so they don't need your consent. All are set by Squarespace.

  • crumb: keeps the site and its forms secure. Lasts until you close your browser.

  • ss_performanceCookiesAllowed: remembers your choice about analytics cookies. Lasts 30 days.

  • ss_marketingCookiesAllowed: remembers your choice about marketing cookies. Lasts 30 days.

  • test (local storage): checks your browser can store data. Lasts until cleared.

  • squarespace-video-player-options (local storage): remembers video and audio player settings, such as volume. Lasts until cleared.

Analytics cookies (only with your consent)

These are set by Squarespace only if you click Accept.

  • ss_cvr: counts unique visitors to the site. Lasts 400 days.

  • ss_cvt: records the length of your visit. Lasts about 30 minutes.

I use Squarespace's analytics to see which pages and blog posts people find useful. The reports show totals, not individual visitors.

Third-party content

Some pages load content from other services. They don't set cookies on this site, but they do receive your IP address and basic browser information:

  • Podcast player: the player on the Makes Milk page is provided by Buzzsprout.

  • Fonts: the site's fonts come from Adobe Fonts (Adobe privacy policy).

  • Other embeds: if a blog post includes a video or post from another service, such as YouTube or Instagram, that service may set its own cookies when you play or view it.

Links to other websites

This site links to other websites, such as Amazon, Jessica Kingsley Publishers, Waterstones, Apple Podcasts, Spotify, Instagram and Eventbrite. They have their own privacy and cookie policies, which apply once you leave this site. If you buy through the link in my podcast shownotes, the retailer may use a cookie to record that you came from my site, and I may earn a small commission at no extra cost to you.

Changing your cookie choices

You can change your choice at any time by clicking "Cookie preferences" in the footer or by clearing this site's cookies in your browser, which brings the banner back. You can also block cookies in your browser settings. Blocking the essential cookie may stop parts of the site, such as the contact form, from working.

9. Changes to this policy

I'll update this policy when the way I use information changes, and the date below will show when. If a change affects how I use information you've already given me, I'll tell you directly.

Last updated: 28 October 2026. This version replaces the policy dated 5 July 2023.