Privacy notice

CareLearn is an online training service for adult social care providers in the UK. CareLearn is run by CareLearn Ltd, a company registered in England and Wales (company number 00000000), registered office 123 Demo Street, London. We are registered with the Information Commissioner’s Office (ICO), registration number ZA000000.

For any question about this notice or your information, email privacy@carelearnapp.com.

Who decides how your information is used depends on why we hold it.

• If you are a care worker or manager using CareLearn through your employer, your employer (the care provider) decides what training you do and what records to keep. Your employer is the controller of your training information and we process it for them, under our agreement with them. Questions about your training records are best sent to your employer first, and we will help them answer.
• For the person who signs their organisation up, for people who contact us, and for anyone who checks a certificate, we are the controller.

When an organisation signs up

• Your full name, work email address and a password (we store only a secure, scrambled version).
• Your organisation’s name and type of service, and, if you give them, its address and CQC location ID.

When a manager adds staff

• Each person’s full name, and either their email address or a username.
• Their job role, start date and whether they are a learner or a manager.

When someone does their training

• Which courses they have been given, deadlines, and when they start and finish.
• Their progress through each module, quick check scores, and final assessment answers and scores.
• Certificates, which show the person’s name, the course, their score and the dates the certificate was issued and expires.

When you use the service

• A record of important actions, such as adding or archiving a member of staff, issuing a certificate, or our support team viewing an account to help. This keeps accounts secure and accountable.
• Technical information our hosting providers log automatically, such as IP addresses, to keep the service secure.

When you contact us

• Your name, email address, the topic you chose and your message.

We do not ask for health information or other special category information about staff, and the service is not designed to hold information about the people your organisation cares for. Please do not enter it.

Every certificate has a unique number. Anyone with that number can use our verify page to see whether the certificate is genuine and in date. To protect privacy, the check shows only the holder’s first name and the first letter of their surname, the course, and the issue and expiry dates.

We do not sell personal information or use it for advertising.

• Your employer. Managers in your organisation can see the training records of their staff.
• Service providers who help us run CareLearn, under contracts that require them to protect it. Our database and sign-in service is Supabase, which stores CareLearn data in Ireland, in the European Union. Account emails are sent through the same service. Our website is hosted by Vercel, whose servers handle each page request and may be in the European Union or the United States.
• Our support team, who may view an account to help with a problem. Each time this happens it is recorded.
• Authorities, if the law requires us to.

This means some information is processed outside the UK. Transfers to Ireland and the rest of the European Union are covered by the UK’s adequacy regulations, which recognise that EU law protects personal information to the same standard. For any transfer to the United States, we rely on the UK–US data bridge or the International Data Transfer Agreement, as UK law requires.

• Training records and certificates are kept while the organisation’s account is open, so they stay available as evidence and certificates can still be checked.
• When a member of staff leaves and is archived, they can no longer sign in, but their records are kept as evidence of the training they completed. We delete archived staff records 6 years after they leave.
• When an organisation’s account is closed, we delete its information 90 days later.
• We keep contact form messages for as long as we need to deal with your enquiry and any follow-up.

• Information is sent over encrypted connections and stored in secure data centres in Ireland.
• Access is limited by role: care workers see only their own training, and managers see only their own organisation.
• Passwords are never stored in a readable form. Temporary passwords are shown once and not kept.
• Important actions, including any support access, are recorded.

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you
• ask us to correct information that is wrong
• ask us to delete information, or to limit how we use it
• object to how we use information based on legitimate interests
• ask for information you gave us in a format you can take elsewhere

Email privacy@carelearnapp.com to use any of these rights. If your information is held for your employer, we will pass your request to them and help them respond. We will reply within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

We use only the cookies needed to keep you signed in. We do not use advertising or tracking cookies. See our cookie notice for details.

We will update this notice when the way we use information changes, and change the date at the top. If a change affects you significantly, we will let your organisation know.