Privacy Policy

Joyce Wamboi is a KNDI Licensed Clinical Nutritionist and Autism Feeding Specialist based in Kenya, offering remote consultations globally. For the purposes of the Kenya Data Protection Act 2019 and the EU/UK General Data Protection Regulation (GDPR), Joyce Wamboi is the sole data controller of the information described below.

We only collect what you choose to give us:

• Waitlist form:your email address (required) and optionally your WhatsApp number, your child’s age, and a short note about the feeding challenge you want help with.
• Consultation booking: when you book a session via the Cal.com embed, Cal.com collects your name, email, time-zone, and any notes you add.
• Direct messages: anything you write to us by WhatsApp or email — including any details about your child you choose to share.
• Aggregate analytics: Plausible Analytics records page views and referral sources in aggregate. No cookies are set and no personally identifying information is collected.

We do not collect special-category data (health, biometric, etc.) through the website. If you share clinical details during a consultation, those are handled under Joyce Wamboi’s professional record-keeping obligations.

We rely on the following lawful bases (Kenya DPA 2019 §30; GDPR Article 6):

• Consent — for the waitlist, the free guide, and follow-up emails about consultations you have asked about. You can withdraw consent at any time by emailing hello@autismnutrition.org.
• Performance of a contract — for delivering a consultation you have booked and paid for.
• Legitimate interests — for basic security and spam protection (Cloudflare Turnstile), and for keeping aggregate analytics to improve the site.
• Legal obligation — where we are required to keep records, for example for tax purposes.

We use what you share to:

• Send you the resource or guide you asked for.
• Notify Joyce Wamboi of your enquiry so she can respond personally.
• Follow up — only about the consultation, waitlist, or topic you contacted us about.
• Deliver and confirm consultation bookings.
• Understand, in aggregate, which pages help families and which do not.

We do not sell, rent, or share your information with third parties for their marketing.

We use the following service providers to run the site. Each is a processor handling your data on our instructions:

• Resend (United States) — delivers waitlist confirmation emails and forwards your enquiry to Joyce Wamboi. Receives the contents of your form submission and your email address.
• Cal.com (United States / European Union) — handles consultation booking. Stores your name, email, time-zone, and any booking notes.
• Plausible Analytics (European Union) — measures aggregate site usage. Sets no cookies and stores no personally identifying information.
• Cloudflare Turnstile (global) — anti-bot protection on the waitlist form. Does not set tracking cookies and does not profile users across sites.
• Vercel (United States) — hosts the website and processes standard HTTP request logs for security and availability.

This site does not set any marketing or analytics cookies. Plausible measures traffic without cookies, and we do not use Meta Pixel, Google Analytics, or similar advertising trackers. If we ever add a non-essential cookie in the future, we will ask for your consent first via an on-page banner.

• Waitlist contacts: kept until you unsubscribe, or after 24 months of inactivity — whichever comes first.
• Booking records: retained for 7 years in line with Kenya Revenue Authority bookkeeping requirements.
• Clinical notes from consultations: retained for the period required by Joyce Wamboi’s professional obligations as a KNDI-licensed nutritionist.
• Aggregate analytics: retained indefinitely; they contain no personally identifying information.
• Direct messages: kept while the conversation is relevant to your care, then deleted on request or during routine cleanup.

Some of our processors (Resend, Cal.com, Vercel) are based outside Kenya and outside the European Economic Area. Where data leaves these jurisdictions, the transfer is covered by the processor’s published Standard Contractual Clauses or Data Privacy Framework certification.

We work with families of autistic children. Information about a child is always submitted on the child’s behalf by a parent or caregiver. We collect the minimum needed to support you, never share it with third parties for marketing, and you can ask for it to be deleted at any time.

Under the Kenya DPA 2019 and the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct anything that is wrong or out of date (rectification).
• Ask for your data to be deleted (the “right to be forgotten”), subject to legal retention requirements.
• Withdraw consent you have previously given.
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, or with your local EU/UK supervisory authority.

Email hello@autismnutrition.org with the request. We aim to respond within 30 days. There is no charge for a first request in any 12-month period.

Connections to the site use HTTPS. Our processor accounts use strong, unique passwords and multi-factor authentication where available. Access to your information is limited to Joyce Wamboi and is granted on a least-privilege basis. No system is perfectly secure, but we take reasonable steps to protect what you share.

If we make a material change to how we handle your information, we will update the “Last updated” date at the top of this page and, where appropriate, notify waitlist subscribers by email. Older versions are available on request.