Your privacy, in plain language

What you send me

The contact form

It asks for:

• your name and email address
• your general location (city or town, so I know whether I can serve you)
• the service you’re interested in (“Not sure yet” is an option)
• how you heard about me (“Somewhere else” is an option)

Everything else is optional:

• a phone number (unless you ask me to call or text)
• the best way to reach you
• a due date or birth date (only for services where it matters, and never for bereavement or abortion support)
• where you plan to give birth (only for birth support and preparation)
• your message

What you write is entirely your choice — please share only what feels comfortable at a first contact.

Other ways you might reach me

• Booking an Introductory Call happens on this site’s own booking calendar. You give your name, email and phone number (so I can call you), the service you’re interested in and, if you like, a short note. That creates an inquiry just like the contact form, and the call time and your phone number are added to my Google calendar.
• Email, phone, text or social media messages are kept in the ordinary way.
• Newsletter and free guides: your email address, first name if you give it, and a record of your consent (see Emails and the newsletter).
• Shop orders: your email address, what you bought, and your download links, so I can deliver and resend your files (see Payments).
• Classes: your name, contact details and what I need to hold your place and send you the class details.
• Photos at a birth, visit or class: if you’re in a photo I take and you aren’t my client, I keep your name, how to reach you if you give it, and your photo choices with the record of the client or class it was for, for as long as I keep that record. Ask me to delete them at any time.
• Gift certificates: if you buy one, I keep your name, contact details and mailing address, the signed gift agreement and the payment, plus what you tell me about the person receiving it (their name, how to reach them and your message) so I can deliver the gift. If you receive a gift, I keep your name and contact details only to deliver and honor it. You can ask me to delete them at any time, and the gift stays available to you. I never tell the buyer about your care.

Technical detail

What the site collects on its own

Technical records. My host, Cloudflare, keeps short-lived records of requests (IP address, browser and device type, the page, the time) to serve pages and block attacks and spam. I don’t use them to build a profile of you.

Visitor numbers. Cloudflare Web Analytics shows me totals: how many people visit, which pages get read, roughly which country visitors come from, what referred them, and which browser and device they used. It sets no cookies, doesn’t follow you to other websites, isn’t connected to any advertising network, and isn’t linked to anything you send me.

How you found the site. When you arrive, your browser keeps a small note of the website that linked to you, any campaign label in that link (for example, one I add to an Instagram post), and the first page you landed on. If you then send the contact form, sign up for emails or buy something, that note goes with it, so I can tell which posts and pages help people find me. It’s deleted when you close the tab.

If I ever add anything that tracks more than this, I’ll update this page before switching it on.

“Do Not Track” and Global Privacy Control. Because the site doesn’t track you across websites or sell or share information for advertising, these browser signals have nothing to switch off here. If your browser sends Global Privacy Control, I treat it as your request to opt out of any sale or sharing, which I never do anyway.

Technical detail

Cookies and your device

This site doesn’t set advertising or analytics cookies. A few things can still be stored in your browser:

• Security. Cloudflare may set a short-lived cookie to tell people apart from automated traffic, and the contact form’s spam check (Cloudflare Turnstile) may use browser storage while it runs.
• Portal sign-in. Signing in to the client portal sets a cookie, managed by Cloudflare Access, that keeps you signed in.
• Services you choose to use. Stripe checkout and social media sites set their own cookies under their own policies.
• FieldNotes with no signal. If you choose to let FieldNotes work with no signal on a phone, your baby’s first name and your FieldNotes settings are kept on that phone until you sign out or turn it off.
• Small notes from this site: cached pages so the site works if your connection drops, the how-you-found-the-site note, a note that stops a shop order being placed twice by accident, and notes that the frog hiding on the site has already said hello or been sent away. Most last only until you close the tab; the note that you’ve seen the newsletter invitation, and the frog’s notes, stay until you clear this site’s data in your browser. In the client portal: your display choices (text size, movement, and light or dark mode), and, in FieldNotes, which baby you last viewed, a running timer, and entries saved while you were offline until they can be sent. These stay on that device until they’re sent or you clear this site’s data.

Clearing your browser’s site data removes all of them.

Client portal and service records

If you become a client, I keep the records I need to support you well and show what was agreed. Depending on your services, that can include:

• Contact details, and people you’ve named as part of your support
• Your inquiry and the services you’re interested in
• Intake and other forms, with any files attached
• Bookings, appointments and the stage your support is at
• Agreements, acknowledgments and electronic signatures
• Messages between us, including emails to my business address
• Session notes, and my own working notes and tasks
• Documents you upload and resources I share with you
• Invoices, payments and refunds
• A profile photo, only if you add one
• Notification settings, if you turn notifications on
• Feedback, and any permission you give to share it
• Security records of sign-ins, changes to records, and each time anyone opens health information
• If you use FieldNotes: what you choose to keep there, such as feeds, diapers and pumping; contractions and movements in pregnancy; sleep, tummy time, temperatures and when medicine was given; growth measurements and milestone answers; your milk stash; your own recovery notes, journal and check-ins; your lists, reminders and visitor and meal plans; a symptom log for your baby; and any photos you add to your photo journal, with their dates and captions. It also holds your baby’s name, birth date or due date, weeks of pregnancy at birth, and how they’re fed

Notes I write about our visits (what we talked about, the support I gave, and any referrals) are kept with your client record, encrypted, and seen only by me. You can ask for a copy.

The portal and my client records run on Cloudflare’s platform (database, file storage, sign-in and security tools). You sign in with a one-time code sent to your email, so there is no password for me to store, and each client can see only their own records.

Emails to my business address from a client are copied into that client’s message history so nothing gets lost. Attachments aren’t copied, and email from anyone who isn’t a client or contact isn’t stored.

If you message @myceliabirthco on Instagram, I read and reply in the Instagram app, and my business system can show the conversation too. Those messages stay on Instagram: my system doesn’t keep a copy, so Instagram’s privacy policy covers them.

When something I send is opened. For agreements, documents and forms I send you through the portal, I can see whether and when the link was opened, so I know whether you’ve had a chance to look. This applies only to things sent to you as a client, never to website visitors or the newsletter.

Electronic signatures are recorded with the date and time, your IP address, and your browser and device type, stored with the signed document for as long as I keep it. This shows who signed and when.

FieldNotes. FieldNotes includes Logs, where you track feeds, diapers and sleep. Your logs are private to you. If you switch on sharing, I can see your feeds, diapers and pumping, and you can switch it off at any time. Sharing never shows me your pregnancy log, care log, symptom log, recovery notes, journal, lists or photos. I can’t see your photo journal at all. Where a photo was taken is removed before it’s stored. Only you can open, download or delete your photos. Each time I open a shared log, it’s recorded, and you can see when I last looked. I also see anything you choose to send me: a check-in, a journal entry you send, or a summary you add to a message. If you share your log and something you enter may need attention, I get a notification that says only that, never what you wrote.

Adding appointments to your own calendar gives you a private link; your calendar provider (such as Google or Apple) then receives those appointment details. Anyone with the link can see them, so keep it to yourself — I can switch it off and issue a new one at any time.

Why I use your information

• Replying to your inquiry
• Checking a service is available and a good fit
• Scheduling and providing support
• Keeping client and business records
• Preparing agreements and forms
• Communicating with you
• Sending resources you asked for
• Processing and recording payments
• Running and securing the site and portal
• Preventing spam, abuse and fraud
• Meeting legal, tax, insurance and professional obligations
• Sending the newsletter, only if you signed up

Nothing else, and never to target advertising.

Service providers

Who else can see your information

A small number of outside services help run the business, and each receives only what it needs:

• Cloudflare — hosts the website and portal, stores client records and files, and runs portal sign-in, the spam check and visitor statistics.
• Resend — delivers the contact form to me and sends my emails to you: confirmations, updates, portal notices and download links.
• Google Workspace — my business email, calendar, video calls (Google Meet) and my business phone number. Appointments go on my calendar with a neutral title such as “Mycelia appointment”, the time, and the place or video link — never your name or what the visit is for.
• Stripe — processes shop payments and client invoices.
• Meta (Instagram) — lets my business system show Instagram messages and post statistics. Messages aren’t copied or stored.
• Your browser’s notification service (Apple, Google, Microsoft or Mozilla) — delivers portal notifications if you turn them on. A notification says something is waiting, never what was written.

These providers work under their own terms and privacy policies, and may use limited data for their own purposes such as security and fraud prevention. When you use one directly — Stripe checkout or a social media site — their policies apply to what you give them. If I use AI writing tools for blog, newsletter or social media drafts, they never receive client records, health information, inquiries or subscriber details.

Your care team, family or anyone else you name: only with your written permission on a Release of Information, which you can withdraw at any time.

I may share information where the law requires it, such as a lawful court order, or where it’s genuinely necessary to protect someone’s safety. I would tell you unless I was prohibited from doing so. I have never sold personal information and I never will.

Payments

Card payments for the shop and for client invoices are processed by Stripe, under its own privacy and security practices. I never see or store your full card number. I keep the record of the payment: the invoice or order, amount, date, status (paid, refunded and so on), refund details, Stripe’s reference numbers, and the email address it’s connected to. If you pay another way, I record the same kind of information.

If I send you a discount code, I keep the code in scrambled form, the email address it was sent to, when it expires, and the invoice or shop order it was used on.

Emails and the newsletter

Signing up means an email when a new blog post is published plus a monthly newsletter. A free guide comes with newsletter emails only if you also check that box. I keep your email address, your first name if you give it, where you signed up, and the exact consent wording you agreed to and when — that record shows you asked to hear from me.

No open or click tracking. I only see whether an email was sent or failed to send, not whether you opened it or what you clicked.

A record of every email. My system keeps a short record of each email it sends: what kind of email it was (an invoice, an appointment reminder, a portal notice), who it went to, the subject, when, and whether it was delivered or failed. For emails that never carry anything personal, such as “something is waiting in your portal”, it also keeps the words. For anything else it keeps no copy of what the email said. Messages I write to you from your portal are kept in your message history instead.

Timing. I can choose to have some automatic emails wait for a set time or until morning, so they don’t arrive in the middle of the night. While one waits, its copy is held encrypted, and it’s deleted as soon as the email goes. Legal notices, signed copies, receipts and safety messages always go right away.

The record still never shows whether you opened an email or what you clicked.

Unsubscribing with the link in any newsletter stops future newsletters right away (one already being sent at that moment may still arrive), or email me and I’ll take you off promptly. It doesn’t stop emails you need for something you’ve asked for, such as appointment confirmations, portal notices, invoices or download links.

Scheduling links. When I email you about an appointment, the email may include a private link to book, move or cancel it without signing in. Anyone with that link can use it, so please don’t forward it. Each link works only for that appointment and stops working a day after it, or once it’s used. Reminder emails include a link to stop them.

FieldNotes invitation. If FieldNotes is part of your care, I may email you to say it’s ready, either myself or automatically shortly after your first visit, unless you’ve already turned it on. That’s an email about your care, not marketing, so it comes whether or not you’re on the newsletter. Like every portal email, it never includes your baby’s name or any health details.

Birthday notes. On your child’s birthday I may send a short note. You can switch it off in Settings or from the email.

How long I keep things

Only as long as there’s a reason to. That depends on why it was collected, whether we still work together, what we agreed in writing, tax and accounting rules, insurance requirements, how long a legal claim could be made, and security needs.

Inquiries that don’t become work

Deleted automatically three years after you last got in touch. If you reach out again, the three years start over.

Client records and messages

Kept while we work together, then for seven years after our last work together, including who referred you. If we work together again, the seven years start over. After that, deleted.

Agreements and signatures

Kept with your client record for seven years after our last work together, or longer only if an agreement could still need to be relied on.

Payment and tax records

Kept for seven years, which covers tax and accounting rules.

Files you upload

Kept with your client record, or deleted sooner if we agree they’re no longer needed.

Photos you send me

Photos texted to my business number are deleted once I’ve seen them (texts pass through Google Voice, under Google’s terms). Photos uploaded to the client portal are kept until the date you chose, or until you delete them.

FieldNotes

Kept while your portal account is open. You can download everything in it at any time. Before your portal closes, I’ll give you 30 days’ notice to do that; 30 days after it closes, your log is deleted, photos included. Contractions and movements are deleted 90 days after you tell FieldNotes your baby has arrived, and milk stash bags you’ve used or thrown out are cleared 30 days later. You can delete any of it yourself sooner.

Portal account and photo

The account stays open while we work together and is switched off when no longer needed. Your photo is deleted when you remove it or your access ends.

Newsletter records

Kept while you’re subscribed. After you unsubscribe, I keep your address and the consent and unsubscribe record so I never email you by mistake.

Gift certificates

The gift, its payment, any refunds and the signed agreement are kept while any value is left, then for seven years with payment and tax records. The recipient’s contact details are kept only while the gift has value, and deleted whenever they ask; the gift still works. A gift that was signed but never paid is deleted after 30 days.

Photo choices if you aren’t my client

Kept with the record of the client or class they were for, for as long as I keep that record. Ask me to delete them at any time.

Feedback and permission to share it

Kept, with any change of mind, as the record of what you agreed to and when.

The record of emails I send

Kept with your client record, and deleted with it. A record of an email to someone who isn’t a client is deleted after three years, or seven for receipts and refunds, which are payment records. An email waiting to be sent is held encrypted, and that copy is deleted as soon as it goes. A draft email I haven’t sent is kept with your record, or for three years if it isn’t addressed to a client.

Notifications

Notifications on your portal and phone are kept for 90 days, then deleted.

Security records

Kept so I can see who signed in and what was changed, and when. The record of each time anyone opened health information, such as FieldNotes, intake and form answers, visit notes, messages, files and agreements, is kept for six years, then deleted, even if your other records are deleted sooner. Other security records aren’t deleted automatically. Providers keep their own technical records under their own policies.

Your choices and privacy requests

Wherever you live, and whether or not the law requires it of me, you can:

• ask what I hold about you, and for a copy
• ask who I’ve shared it with
• ask me to correct or delete it
• withdraw consent to the newsletter or any other optional use
• ask me to stop contacting you
• raise any concern about how your information was handled

How to ask: email contact@myceliabirth.com. Before sharing or changing personal information, I may need to confirm it’s you, usually by replying from the email address I already have. I won’t ask why, and it will never affect the care you receive. I’ll reply within 45 days. If I can’t do what you asked, I’ll explain why, and you can ask me to look at it again.

Instagram messages: my system doesn’t keep copies of Instagram messages; to remove a conversation, delete it in Instagram. For anything else I hold, email me as above.

Time to change your mind. When you delete something in the portal, or ask me to delete your records, it’s hidden right away and kept safely for 30 days so it can be restored if you change your mind. After 30 days it’s deleted for good. If you’d like it gone sooner, tell me and I’ll confirm that’s what you want before I delete it right away.

Once something is deleted for good, a copy can stay in my host’s automatic backups for up to 30 days, and then it’s gone from those too.

If you’re a member of a family’s FieldNotes, you can make these requests about what I hold about you, too. Leaving, or being removed, deletes your email address and name 30 days later. The entries you added stay part of the family’s records, shown as added by “a past member”.

Security

The site and portal are served only over encrypted connections, forms are checked for spam, the portal requires signing in, and each client sees only their own records. Access to the systems that hold client records is limited to me. My accounts use strong, unique passwords and two-factor authentication. In FieldNotes, written notes, medicine names, the reminders you write, check-ins, journal entries, symptom entries and photo captions are encrypted before they’re stored, and my visit notes are encrypted too. Photos are kept in private storage, and the portal gives no one but you a way to open them. No system is perfectly secure, and I won’t claim otherwise. If I learn that your information has been exposed, I’ll tell you without unreasonable delay, and within 30 days at most, or sooner if the law where you live requires it. I’ll explain what happened, what you can do, and what I’m doing about it, and I’ll tell any regulator the law requires me to.

If you are outside the United States

Mycelia Birth Co. is a US business. I offer virtual support to families in other countries, and sometimes travel to support a family in person. My providers are US companies, and they may store and process your information in the United States and in other countries where they operate. The protections there may differ from those where you live. Where the law asks for a safeguard for that transfer, I rely on the ones my providers offer, such as the EU–US Data Privacy Framework (and its UK and Swiss extensions) and the European Commission’s standard contractual clauses.

Depending on where you live, laws such as the UK GDPR or the EU GDPR may give you specific rights. Where they apply: Mycelia Birth Co. is the controller of your information (contact@myceliabirth.com). I use it to take the steps you ask for and to carry out our agreement; with your consent, which you can withdraw at any time (the newsletter, for example); for my legitimate interests in running and securing the business; and to meet legal obligations such as tax. Health information is a special category under these laws, and I use it only with your explicit consent, which you give in your intake and service agreement and can withdraw at any time (withdrawing doesn’t undo what was done before, and I may then be unable to keep supporting you). You can ask to access, correct or delete your information, restrict or object to its use, or receive it in a portable form, and you can complain to the data protection authority where you live.

Children

This website and my services are meant for adults — the people who contact me and sign agreements are parents, expecting parents and their support people. The site isn’t directed at children under 13, and I don’t knowingly collect information from them. Because my work is with families, I do receive information about babies and children, such as a birth date or feeding details; it’s part of your record and handled like everything else here.

FieldNotes is the one place a teenager can take part: a family can add a member aged 13 to 17, such as an older sibling or a babysitter, only with consent from that member’s own parent or guardian, and with limited access (see Client portal and service records). No one under 13 can be a member. If I learn that someone under 13 has been added, I’ll remove them and delete what I hold about them.

Changes to this policy

If I change how I handle your information, I’ll update this page and the date at the top. If a change is significant — a new service that receives your data, or measurement beyond what’s described here — I’ll say so plainly rather than quietly revising the text.