Legal

Privacy and cookies

Last updated: 5 October 2026

[DRAFT: to be reviewed by Ayara and its legal adviser before launch. Text in square brackets needs confirming.]

Who we are

Ayara (“we”, “us”) provides virtual maternity support in the UK. The data controller for this website and our services is Arava Group Ltd (company number 16951177, registered office Flat 177, Denton Malden Crescent, London NW1 8BP), trading as Ayara. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO NUMBER].

Questions about your data: email [email protected]. [Name of the person responsible for data protection, if appointed.]

What we collect

When you contact us (contact form, email, WhatsApp, intro call): your name, contact details, your stage of pregnancy or parenthood, and anything you choose to tell us.
When you become a member: your name, email, billing details (handled by Stripe; we never see your full card number), and your membership history.
When you use our care services: the health information you share with your midwife team, such as your pregnancy, birth, feeding and wellbeing. This is special category data under UK GDPR and we protect it accordingly.
When you browse this website: basic technical information needed to deliver pages securely, and, only if you accept analytics cookies, how you use the site.

Why we use it, and our legal basis

To reply to your enquiry: our legitimate interests in responding to you.
To provide your membership and care: performance of our contract with you, and for health information, the provision of health care (UK GDPR Article 9(2)(h)) [CONFIRM with legal adviser; explicit consent may be required for some processing].
To take payment and keep financial records: contract and legal obligation.
To understand and improve the website (analytics): your consent, which you can withdraw at any time.
To keep you safe: we may share information with the NHS or emergency services if we believe you or your baby are at serious risk.

Who we share it with

We use trusted providers who process data on our behalf under contract:

Stripe (payments and membership billing)
Calendly (booking calls)
WhatsApp, operated by Meta (messaging, if you choose to contact us there)
Zoho (email)
Cloudflare (website hosting and security)
Resend (delivering contact-form messages to our inbox)
Google Analytics (only if you accept analytics cookies)
[Video consultation platform, clinical records system and any other providers]

Some of these providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. We never sell your data.

How long we keep it

Enquiries: [12 months] after our last contact. Membership and payment records: [6 years] for tax and accounting. Care records: [period in line with NHS and professional record-keeping guidance, for example 25 years for maternity records]. [CONFIRM retention periods.]

Your rights

You can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time. Email [email protected] and we’ll respond within one month. If you’re unhappy with how we handle your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113.

Cookies

Cookies are small files stored on your device. We use:

Strictly necessary: a record of your cookie choice, kept in your browser. Always on.
Analytics (optional): Google Analytics cookies (_ga, _ga_*) that tell us which pages are visited, so we can improve the site. They are only set if you click Accept, and expire after up to 2 years.

You can change your choice at any time with the “Cookie settings” link at the bottom of every page, or by clearing cookies in your browser. Payment pages (Stripe) and booking pages (Calendly) are run by those providers and set their own cookies.

Changes

We’ll update this page if our practices change and show the date of the latest version at the top.