Privacy Policy

In brief: what you need to know

• We only collect personal data we genuinely need to run our services and communicate with you.
• If you are a therapy client, your health information is treated as confidential and handled with strict security safeguards.
• We use some AI and automated tools for business administration. These are never used to make decisions about your care.
• You have rights over your data, including the right to access, correct, or request deletion of your information.
• You have the right to complain to us directly about how we handle your personal data. We will acknowledge your complaint within 30 days.
• You can also complain to the Information Commissioner's Office (ICO) at any time.

1. Who We Are

Miracle Moon Limited is the data controller for personal data collected through our website, email communications, and marketing activities.

Miracle Moon Limited trades under the name Miracle Moon and operates the Miracle Moon website, social media channels, email list, professional training, and associated content and resources.

Company number: 14393753
ICO Registration number: ZB626177

Data controller contact:
Dr Frankie Harrison, Director
Email: hello@miraclemoon.co.uk
Website: www.miraclemoon.co.uk

2. What Personal Data We Collect

a) Website visitors

• IP address and browser metadata (collected automatically by our hosting provider, Webflow)
• Pages visited and time on site (if you accept analytics cookies)
• Name, email address, and message content (if you submit a contact form)

b) Email subscribers and community members

• Name and email address
• Email engagement data (opens, clicks) processed by Klaviyo
• Any information you voluntarily share in replies or form submissions

c) Professional training participants

• Name, job title, and professional registration details
• Contact and payment information
• Attendance and completion records

d) Business contacts and partners

• Name, organisation, and contact details shared with us directly

3. Lawful Basis for Processing

Processing activity	Lawful basis
Managing email list and newsletters	Consent - you opt in and can unsubscribe at any time
Responding to enquiries	Legitimate interests - you initiated contact and would expect a reply
Delivering professional training	Contract - necessary to provide the training you have booked
Processing payments	Contract and legal obligation
Website analytics (if accepted)	Consent - via cookie banner
Business administration	Legitimate interests - running the business efficiently
Social media and content	Legitimate interests - promoting our services and providing information

4. How We Use Personal Data

• To send newsletters, resources, and updates to people who have opted in
• To respond to enquiries and provide information about our services
• To deliver and administer professional training programmes
• To process payments and issue invoices
• To understand how our website is used and improve it
• To meet our legal and professional obligations

5. Third-Party Systems and Data Processors

a) Webflow (website hosting)

Our website is hosted on Webflow. Webflow processes visitor IP addresses and page requests as part of delivering the website.

b) Klaviyo (email marketing)

We use Klaviyo to manage our email list and send newsletters and resources. Klaviyo processes subscriber names, email addresses, and engagement data on our behalf. Klaviyo may process data in the United States under appropriate transfer mechanisms.

c) Stripe (payments)

We use Stripe to process payments for training and other products. Stripe handles payment card data directly and we do not store card details ourselves. Stripe's own privacy policy applies to payment data.

d) Zoom (meetings and calls)

We use Zoom for team meetings, supervision, associate check-ins, and some professional calls. Zoom's AI note-taking feature may be used in these meetings. This feature is never used in client therapy sessions without explicit consent.

If Zoom's AI note-taking is active in a meeting you attend, you will be notified at the start of the call. You can ask for it to be turned off at any time.

e) Claude (AI assistant - business administration only)

We use Claude, an AI assistant developed by Anthropic, for business administration tasks such as drafting content, structuring documents, and operational planning. Claude is used for internal business purposes only and is not used in client-facing clinical work or to make any decisions about individuals.

We take care not to input identifiable personal data into Claude. Any information used is anonymised or generalised where possible.

f) Circle (community platform)

If you are a member of The NICU Space community, that platform is operated separately by The NICU Space CIC. Please refer to The NICU Space CIC Privacy Policy for information about how your data is handled there.

6. Who We Share Data With

We share personal data only when necessary and with a lawful basis. This may include:

• Data processors listed above, under data processing agreements
• Professional advisers such as accountants, where necessary and under confidentiality obligations
• Regulatory or statutory bodies where required by law

7. International Data Transfers

Some of our service providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place:

• Klaviyo: United States, under appropriate transfer mechanisms
• Zoom: United States, under Standard Contractual Clauses
• Anthropic (Claude): United States, under Standard Contractual Clauses

8. Data Retention

Data type	Retention period
Email subscriber data	Until you unsubscribe, then deleted within 30 days
Contact form submissions	Deleted within 6 months of the enquiry being resolved
Training records	7 years, for professional and legal compliance
Financial records	6 years, in line with HMRC requirements
Website analytics	14 months (Google Analytics default)

9. Cookies

Types of cookies

• Essential cookies: required for website functionality
• Analytics cookies (optional): used to understand how people use our website

We only set analytics cookies if you accept them through our cookie banner.

Managing cookies

You can accept or reject analytics cookies via our cookie banner when you first visit the site. You can update your preferences at any time using the Cookie Settings link in the website footer.

10. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: request a copy of your personal data
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your data
• Right to restriction: request that we limit how we process your data
• Right to object: object to processing based on legitimate interests
• Right to data portability: receive your data in a portable format
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time

To exercise any of these rights, email us at hello@miraclemoon.co.uk. We will respond within one month.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

12. Your Right to Complain

If you have concerns about how we handle your personal data, you have the right to complain to us directly. Please email hello@miraclemoon.co.uk and we will acknowledge your complaint within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO) at any time:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Changes to This Policy

We may update this policy from time to time. The current version will always be on our website with the effective date shown at the top.