Survey Privacy Policy

SURVEY PRIVACY POLICY

The Infant Feeding Index Survey located at https://survey.infantfeedingindex.com

Effective date: 23rd June 2026 Last updated: 23rd June 2026

Welcome

This Survey Privacy Policy explains how the Trustee for 4 Good Unit Trust (ABN 85 145 868 031) trading as The Thompson Method ("we", "us", "our") handles information collected through the Infant Feeding Index survey at survey.infantfeedingindex.com (also reachable via the technical alias survey.thethompsonmethod.com).

We can be reached at privacy@infantfeedingindex.com, or by post at PO Box 13, Rainbow Beach QLD 4581, Australia.

It should be read together with our Survey Terms of Participation.

In short: The survey is anonymous. We don't ask for your name, your email, your IP address, or any other identifier. We don't load any marketing pixels or third-party trackers on the survey pages. The only things we know about you are your country and state (which we ask in the survey itself) and whatever you choose to share in your responses. Cloudflare Turnstile runs invisibly in the background to confirm you're a human, not a bot. After you submit, you'll be redirected to our thank-you page on infantfeedingindex.com, which is a separate site governed by a separate Privacy Policy. What happens on the survey stays in the survey.

1. What this policy covers

This policy covers the Infant Feeding Index survey itself - what happens between the moment you arrive at survey.infantfeedingindex.com (or survey.thethompsonmethod.com) and the moment you press Submit.

It does not cover:

• the Infant Feeding Index landing page at infantfeedingindex.com, the thank-you page after submission, or the optional email opt-in - those are covered by our separate Privacy Policy and Terms of Use;

• the other services run by The Thompson Method (such as My Milk Map and Go Slow Baby), each of which has its own privacy policy.

2. How privacy works in the survey

When you click through to the survey, you become anonymous. From that moment:

• we do not ask for your name, email, address, phone number, or any other direct identifier;

• we do not capture or store your IP address while you complete or submit the survey;

• we do not load any marketing pixels, social-media trackers, or third-party analytics on the survey pages;

• the only things we know about you are your country and state (which we ask you in the survey itself) and whatever you choose to share in the responses.

There is no technical link between you as an individual and the data you submit. We could not re-identify you even if we wanted to, and even if we were legally compelled to.

3. What we collect

In the survey, we collect only what you choose to enter:

• your country and state (asked directly, not derived from IP);

• your age range and demographic context relevant to the Index;

• your pregnancy, birth and infant feeding experience - feeding intentions, feeding outcomes, the support you did or didn't receive, and the systemic factors that shaped your journey;

• any free-text responses you choose to write.

We encrypt free-text responses but ask that you please don't enter your full name, your child's full name, addresses, phone numbers, or other identifying details into free-text fields.

Bot protection. The survey pages use Cloudflare Turnstile (in invisible mode) to verify that submissions come from genuine humans, not automated bots. Turnstile runs in the background as you complete the survey; it does not track you across other websites and does not store cookies on your device. The processing is governed by the Cloudflare Turnstile Privacy Addendum.

4. Why we collect it, and our legal basis

We collect anonymous survey responses to:

• build the Infant Feeding Index dataset and produce aggregated, statistical findings from it;

• share or license those aggregated findings with the partners listed in Section 5;

• improve the survey instrument and the Index methodology over time.

For participants in the EEA, UK, and other jurisdictions with comparable laws, the legal basis is explicit consent - you consent before starting the survey, and that consent authorises us to collect and use the responses for the Index.

Because we deliberately collect the survey anonymously and never link it to a person, the survey responses themselves are not "personal data" in the legal sense - there is no individual we could connect them to. The legal basis above relates to the consent we ask for before you start the survey. After collection, the dataset is held as aggregated, de-identified research data.

5. Who we share data with - and who we will never share with

Service providers we rely on

No service provider receives raw survey responses linked to identifiers - because no such linkage exists.

Partners we share aggregated, de-identified Index data with

We may share, license, or publish aggregated, de-identified Index findings with:

• governments and public health agencies - to inform policy, services and funding;

• hospitals and health systems - to improve maternal care and feeding outcomes;

• academic researchers - to support published work on maternal and infant health;

• private health insurers - to inform coverage, prevention and member-support programs;

• the general public - through Index reports, articles, dashboards, and journalistic publications

In every case, the data shared is aggregated and de-identified. We do not transfer raw response-level data outside our own systems.

Who we will never share with

• Pharmaceutical companies and infant formula manufacturers, and any commercial entity whose products or interests could conflict with the wellbeing of mothers and infants in this dataset. Whether the data is aggregated or not, we will not license, sell or share Index data with these recipients.

• Advertisers, data brokers or ad-tech platforms. The survey pages run no advertising or marketing trackers of any kind, and your survey responses are never sent to advertising platforms.

• AI model trainers (ours or third parties). Index survey responses will never be used to train AI models.

Other limited disclosures

We may disclose information where we are required to by law, in response to a valid legal process, or in connection with a business restructure or sale - in which case this policy continues to apply, and the architectural commitments in Section 2 (in particular, the absence of any link between you and your survey responses) come with it.

6. How long we keep things

Survey responses: individual response records are retained for 3 years from submission, after which they are deleted. Aggregated, statistical findings derived from those responses are retained indefinitely as the Index dataset. Because we never collect any identifier from you during the survey, there is no way for you (or for us, or for anyone else) to locate, withdraw, or delete your specific responses - this absence of any link is the privacy mechanism, and you consent to it before starting the survey.

Backups: routine encrypted backups are retained on a 7-day rolling cycle (matching the survey database's Aurora backup retention window).

Records we are legally required to keep: retained for the period the law requires.

7. Where your data is stored, and international transfers

We operate from Australia, but the survey's primary infrastructure (AWS) is hosted in the United States (US East 1, Virginia). The survey also uses Cloudflare's global network for bot protection (Turnstile), which may process limited technical signals at edge locations worldwide. No personal data or survey content is sent in the Cloudflare verification call - only a token used to confirm you are a human; see the Cloudflare Turnstile Privacy Addendum linked in Section 3.

Because the survey is open to participants worldwide, your data may cross national borders during the technical handling described above. When that happens, we apply appropriate safeguards:

• EEA / UK participants: we rely on the European Commission's Standard Contractual Clauses (or the UK equivalent) and conduct transfer impact assessments where required.

• Canadian participants: transfers are governed by our contracts with service providers consistent with PIPEDA.

• US participants: we apply contractual and technical safeguards equivalent to those above. If you reside in Washington or Nevada, you may have additional rights under state consumer health data laws.

• Australian participants: transfers are made consistent with Australian Privacy Principle 8.

You can contact us at privacy@infantfeedingindex.com for further detail on the safeguards that apply to your situation.

8. Your rights

The survey is anonymous. We hold no record of you as an individual and no way to find your responses. The strongest possible privacy position - that we cannot identify you - also means there is no individual record for you to access, correct, or delete after submission. This is intentional, and we explain it before you consent so you can make an informed choice.

If you opted in to receive updates on our thank-you page after submission, your rights as a subscriber are described in our separate Privacy Policy - note that those rights are entirely independent of the survey, because the two are not connected.

9. Children

The survey is for adult participants only. You must be at least 18 to take part. We do not knowingly collect personal information from anyone under 18 through the survey.

The survey asks you to reflect on your child's feeding experience. The data captured about your child is minimal - we do not ask for your child's name, full address, or other identifiers, and we ask that you do not enter such information into free-text fields.

10. AI and automated decision-making

We do not use survey responses to:

• make automated decisions about you;

• profile you as an individual;

• generate personalised recommendations to you; or

• train any third-party AI model.

Internal analytical models that surface systemic patterns operate only on the aggregated, de-identified Index dataset, never on individual records.

11. Sensitive content and support

The survey covers areas that can be emotionally heavy - including feeding difficulty, lack of support, postnatal mental health, and loss. If a question prompts distress, please pause, or stop entirely. Some support services that may help:

• Australia: Lifeline 13 11 14 · Beyond Blue 1300 22 4636 · PANDA 1300 726 306

• United Kingdom: Samaritans 116 123

• United States: 988 Suicide & Crisis Lifeline (call or text 988)

• Canada: Talk Suicide Canada 1-833-456-4566

In any country, in immediate danger, please contact your local emergency services.

12. Security

We apply technical and organisational measures to protect the survey, including:

• encryption of data in transit (TLS) and at rest;

• architectural separation between the survey system and any other system we operate (including the email/marketing system that powers our thank-you page subscriptions) - none share identifiers, join keys, or timestamp linkages;

• no IP logging on the survey pages - IP addresses are not captured or stored during survey completion or submission. The Cloudflare Turnstile verification call passes a bot-check token only, not your IP or any survey content;

• bot protection - Cloudflare Turnstile (invisible mode) on the survey pages, to reduce the risk of automated submissions or abuse;

• access controls based on least privilege;

• logging and monitoring of administrative access;

• vulnerability scanning and security testing on a regular cycle;

• staff confidentiality obligations.

No system is perfectly secure. If a personal data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and other supervisory authorities where required by law.

To report a suspected security issue, email security@infantfeedingindex.com.

13. Complaints

If you have a concern about how the survey or its data is handled, please contact us first at privacy@infantfeedingindex.com. We will acknowledge within 7 days and aim to resolve within 30 days. If you're not satisfied with our response, you can complain to your local privacy regulator:

• Australia: Office of the Australian Information Commissioner - www.oaic.gov.au

• United Kingdom: Information Commissioner's Office - ico.org.uk

• European Economic Area: your country's data protection authority (list at edpb.europa.eu)

• Canada: Office of the Privacy Commissioner - priv.gc.ca

• United States: your state attorney general's office; for Washington residents, see also the Washington AG.

14. Changes to this policy

We may update this policy from time to time. We review it at least once a year. If we make material changes - particularly changes that affect how survey data is shared, who it is shared with, or how the survey is technically operated - we will publish the updated version on this page. Because survey responses are anonymous and we cannot reach respondents directly, material changes to data use apply only to responses submitted after the change takes effect, never retrospectively to data already in the dataset.

15. Contact us

the Trustee for 4 Good Unit Trust (trading as The Thompson Method) PO Box 13, Rainbow Beach QLD 4581, Australia Privacy: privacy@infantfeedingindex.com General: hello@infantfeedingindex.com Security: security@infantfeedingindex.com

Thank you for trusting us with your story. The architectural promise that we cannot identify you is the most valuable thing the Index holds.

© 2026 the Trustee for 4 Good Unit Trust. All rights reserved.