1. Introduction

CliniLink Academy (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you access or use our website, digital learning platform, courses, communications and related services (together, the “Services”).

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and all other applicable data protection laws. Please read this policy alongside our Terms & Conditions and our Cookie Policy.

2. Who we are — data controller

For the purposes of UK GDPR, the data controller is:

• CliniLink Ltd, trading as CliniLink Academy
• Registered in England and Wales, company number 16243215
• Registered office: Stockport Pyramid, Yew Street, Stockport Trading Estate, Stockport, Cheshire, SK4 2JZ
• ICO registration reference: ZB896601

Our data protection lead is Theresa Ho. For any data protection or privacy enquiry, or to exercise your rights, please contact:

3. Scope of this policy

This policy applies to:

• visitors to our website;
• registered users and learners;
• healthcare professionals enrolling on our educational programmes, including sponsored programmes;
• customers purchasing digital courses or content;
• users accessing content on our learning platform, CliniLink Academy; and
• anyone who contacts us by email, form or support channel.

It applies however you access the Services — desktop, mobile or app.

4. The personal data we collect

4.1 Identity, contact and professional data

• full name;
• email address (including work email where provided);
• professional role and organisation/workplace;
• professional registration body and registration number (used to verify healthcare-professional status where a programme is restricted to HCPs);
• account login credentials.

4.2 Technical and usage data

• IP address, browser type and version, device information;
• login timestamps and session data;
• course progress, assessment results and completion data;
• information collected through cookies and similar technologies (see section 7).

4.3 Transactional data

• purchase and enrolment history and subscription status;
• payment confirmation. Card and payment details are processed securely by our third-party payment providers and are not stored by us.

4.4 Communications and consent data

• emails, support requests, feedback and correspondence;
• your marketing preferences and a record of the consents you have given or withdrawn (including the wording, date and version).

We do not intentionally collect special category data about you. Please do not submit health or other sensitive personal information through free-text fields.

5. How we collect your data

• Directly from you — when you register, enrol, purchase, complete a course, or contact us.
• Automatically — through cookies and similar technologies as you use the Services (see section 7).
• From third parties — for example a programme sponsor, your employer, or an accreditation body, where relevant to your enrolment or certification.

6. Lawful bases for processing

We only process personal data where the law allows. Depending on the activity, our lawful bases are:

• Performance of a contract — to create your account and provide the courses, content and certificates you have requested.
• Legal obligation — to meet regulatory, tax and accounting requirements, and pharmacovigilance obligations (see section 10).
• Legitimate interests — to secure and improve our platform, prevent fraud and misuse, and verify professional eligibility. We balance these interests against your rights.
• Consent — for optional activities such as marketing communications and, where applicable, sharing your data with a programme sponsor. You can withdraw consent at any time.

7. Cookies and similar technologies

We use cookies and similar technologies to operate the website, keep you signed in, remember preferences, measure usage and improve the Services. Non-essential cookies (for example analytics) are set only with your consent, which you give through our cookie banner and can change at any time. Full details of the cookies we use, their purpose and duration are in our Cookie Policy.

8. How we use your data

• creating and managing your account and verifying professional eligibility;
• providing access to courses and materials and recording your progress;
• issuing CPD certificates and, where relevant, sharing completion data with accreditation providers;
• processing enrolments and payments and issuing receipts;
• communicating essential service information (for example enrolment confirmations, course updates and security notices);
• sending marketing communications where you have consented (section 9);
• for sponsored programmes, sharing defined data with the programme sponsor as described in section 10;
• maintaining the security and integrity of the platform and preventing misuse and fraud;
• improving platform performance and user experience;
• meeting our legal, regulatory and pharmacovigilance obligations.

We do not sell your personal data to third parties, and we do not use it for automated decision-making that produces legal or similarly significant effects.

9. Marketing communications

We will only send you marketing emails where you have given your consent, or where otherwise permitted by law. Our marketing and service emails are sent by CliniLink. You can withdraw consent and unsubscribe at any time using the link in any marketing email, or by contacting us. Withdrawing marketing consent will not affect your access to any programme you have enrolled on, and does not stop essential service messages about courses you are taking.

10. Sponsored programmes, third-party sharing and adverse-event reporting

Some of our programmes are commissioned and funded by third-party sponsors (for example pharmaceutical companies) and may contain promotional content. Where you enrol on a sponsored programme:

• We may share defined data with the programme’s sponsor — such as your registration details and your participation and completion data — where you have consented to this at enrolment. We tell you clearly at the point of enrolment who the sponsor is and exactly what will be shared, and you can withdraw that consent at any time.
• Pharmacovigilance (adverse events): if you report a suspected side effect or other safety information relating to a medicine, we are legally required to pass the relevant details to the sponsoring pharmaceutical company and/or the Medicines and Healthcare products Regulatory Agency (MHRA). This processing is necessary to meet a legal obligation and does not rely on, and cannot be withdrawn by, your consent.

11. Healthcare-professional context

Our content is intended for qualified healthcare professionals and others engaged in professional education. Certain programmes are restricted to UK healthcare professionals, and we collect professional registration details to verify eligibility. We do not collect patient-identifiable data through the Services, and any clinical scenarios in our content are fictional and anonymised for education only.

12. Data sharing and our service providers

We share personal data with trusted service providers who process it on our behalf, under written contracts requiring UK GDPR-compliant security and confidentiality. These include:

• our learning-platform hosting and infrastructure providers;
• payment processing — Stripe and Klarna (and other payment providers we may offer at checkout);
• email and communications providers, so we can send service and (where consented) marketing emails as CliniLink;
• website analytics — Google Analytics;
• accreditation providers — where needed to validate your CPD certificate;
• programme sponsors — as described in section 10, where applicable.

We may also disclose personal data where required by law, to enforce our terms, or to protect the rights, safety or property of CliniLink, our users or others.

13. International data transfers

Some of our service providers are located outside the UK (for example in the EEA or the United States). Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, such as: transfer to a country covered by UK adequacy regulations; the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or another lawful transfer mechanism. You can request details of the safeguards we use by contacting us.

14. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy and to meet our legal, regulatory, accounting and CPD-evidence obligations. In particular:

• financial and transaction records are kept for at least six years, to meet HMRC and accounting requirements;
• learning and CPD completion records are kept for as long as needed to evidence your certification and to meet accreditation and legal requirements;
• marketing preferences and consent records are kept until you withdraw consent, and then as a record of that withdrawal;
• other account and correspondence data is kept for as long as your account is active and thereafter only as long as necessary.

When data is no longer required, we securely delete or anonymise it.

15. Data security

We use appropriate technical and organisational measures to protect personal data, including secure hosting, encryption in transit (and at rest where appropriate), access controls on a need-to-know basis, and monitoring for unauthorised activity. No system can be guaranteed completely secure, but we work to protect your data and have procedures to deal with any suspected breach, including notifying the ICO and affected individuals where required.

16. Your rights

Under UK GDPR you have the right to: be informed about how we use your data; access a copy of your personal data; have inaccurate data corrected; have your data erased in certain circumstances; restrict or object to processing, including objecting to direct marketing; data portability; and to withdraw consent at any time where processing is based on consent.

To exercise any right, contact us using the details in section 2. We will respond within one month (extendable by two further months for complex requests, in which case we will tell you). We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.

17. Children

Our Services are intended for professionals and are not directed at children under 18. We do not knowingly collect personal data from children.

18. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it was last revised. Where changes are material, we will take reasonable steps to notify you (for example by email or a notice on the platform) before they take effect.

19. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

20. Contact