Who we are
Clarivive MedInsight Ltd provides health and social care training services, including online learning, face-to-face training, webinars, in-house employer training and blended learning.
For the purposes of this Privacy Policy, “applicable data protection law” includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and, where applicable, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), together with any subsequent amendments or replacement legislation, Clarivive MedInsight Ltd will normally act as the data controller for personal information collected directly through our website, booking systems, learner accounts, training activities and business communications. This means that we determine why and how that personal information is used.
In some circumstances, such as employer-funded or commissioned training, the employer or commissioning organisation may also act as a controller or may provide personal information to us for the purpose of delivering the agreed training service.
Information we may collect
We may collect personal information directly from you, from your employer or booking organisation, through our website and Learning Management System, from payment and communication providers, or through your participation in our training services.
The personal information we may collect includes:
Name
Email address
Telephone number
Postal or billing address where required
Organisation or employer details
Job title or professional role where provided
Learner account and login information
Learner identification number or booking reference
Course enrolment and registration records
Attendance and non-attendance records
Course progress and completion information
Assessment records
Certificate details and certificate-verification information
Learning Management System activity and access records
Internal LMS messages and support communications
Booking, invoice, transaction and payment information
Enquiry, correspondence and customer-support records
Complaint, appeal, refund or cancellation information
Accessibility and reasonable-adjustment information where provided
Marketing preferences and communication choices
Website usage, device, browser, IP address and cookie information
Records relating to technical problems, suspected misuse or security incidents
Any supporting documents voluntarily submitted in connection with a request, complaint, appeal or reasonable adjustment
We aim to collect only personal information that is adequate, relevant and reasonably necessary for the purpose for which it is being used. The UK GDPR requires organisations to avoid collecting more personal information than they need.
Please do not provide unnecessary medical, financial, identity or other sensitive information unless we have specifically requested it for a legitimate purpose.
How we use your information
We may use personal information to:
Create, verify and manage learner accounts
Register learners for courses
Provide access to online learning and LMS functions
Deliver face-to-face, webinar, in-house or blended training
Communicate course dates, joining instructions and service updates
Record attendance, non-attendance and course participation
Monitor course progress and completion
Administer assessments, reassessments and practical observations
Issue, manage, correct, revoke and verify certificates
Respond to enquiries and provide learner or customer support
Process bookings, invoices, payments, refunds and cancellations
Administer employer-funded or group bookings
Manage reasonable-adjustment and accessibility requests
Investigate complaints, appeals, malpractice concerns or service disputes
Maintain learner, training, assessment and quality-assurance records
Carry out internal quality assurance, audit, moderation and standardisation
Improve course content, delivery systems and customer experience
Send service-related communications
Send marketing communications where permitted
Prevent fraud, unauthorised access, misuse and security threats
Maintain the security, performance and integrity of our website and LMS
Obtain professional, legal, accounting or insurance advice
Meet legal, tax, accounting, regulatory, contractual and governance obligations
Establish, exercise or defend legal claims
We will not use personal information for a materially different and incompatible purpose without considering whether further information, consent or another lawful basis is required.
Lawful basis for using personal information
We must have a lawful basis before using personal information. The basis used will depend on the specific purpose and circumstances. Organisations must tell individuals which lawful basis applies to their processing.
We may rely on the following lawful bases:
Contract
We may use personal information where processing is necessary to take steps at your request before entering into a contract or to perform a training, booking or service contract with you.
This may include registering you for a course, giving you LMS access, delivering training, administering assessments, issuing certificates, processing payments and providing course-related support.
Legal obligation
We may use or retain personal information where necessary to comply with legal, tax, accounting, regulatory, court or law-enforcement obligations.
Legitimate interests
We may process personal information where this is necessary for our legitimate business interests or those of another party, provided those interests are not overridden by your rights and freedoms.
These interests may include:
Operating and administering our training business
Maintaining accurate learner and certificate records
Quality assurance and service improvement
Preventing fraud and misuse
Protecting systems and information
Managing complaints, disputes and legal claims
Communicating with employer clients
Maintaining appropriate audit trails
Where appropriate, we will consider the necessity, proportionality and effect of the processing before relying on legitimate interests.
Consent
We may rely on consent where you have been given a genuine choice, such as for certain marketing communications, non-essential cookies, photographs, recordings or optional activities.
Where consent is the lawful basis, you may withdraw it at any time. Withdrawal will not affect processing that was lawful before consent was withdrawn.
Vital interests
In rare circumstances, we may use personal information where this is necessary to protect someone’s life. Vital interests generally apply only where the processing is genuinely necessary and another less intrusive basis is not reasonably available.
Special Category information
Certain personal information requires additional protection under data protection law. This includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data used for unique identification; data concerning health; and data concerning a person’s sex life or sexual orientation. Information concerning a disability may also constitute special-category data where it reveals information about a person’s physical or mental health.
Where Clarivive MedInsight Ltd processes special-category information, we will identify an appropriate lawful basis under Article 6 of the UK GDPR and a separate condition for processing under Article 9 of the UK GDPR and, where required, the relevant condition and safeguards under Schedule 1 of the Data Protection Act 2018.
For example, health or accessibility information may be processed where necessary to consider or provide reasonable adjustments, comply with applicable legal obligations, respond appropriately to safeguarding or emergency circumstances where the relevant legal conditions are met, or establish, exercise or defend legal claims. Where we rely on explicit consent as an Article 9 condition, this will be clearly identified and the requirements for valid explicit consent will be followed.
We do not assume that consent is always the appropriate lawful basis or Article 9 condition for processing special-category information. The appropriate basis and condition will be determined according to the purpose and circumstances of the processing.
Learning Management System and certificates
Our Learning Management System is the primary system used to administer learner participation and maintain training records.
The LMS may process:
Registration and profile information
Course enrolment details
Login and access records
Course activity and progress
Assessment answers and outcomes
Attendance records
Completion information
Certificate records
Internal LMS messages
Technical and security logs
Support and administrative records
Certificates are generated using the information held in the learner record. Learners are responsible for checking that their name and other relevant registration details are accurate before completing training or requesting certificate issue.
Once a certificate has been issued, it may be locked from ordinary editing to protect the accuracy and integrity of the certification record. Where a correction is justified, the original certificate may need to be revoked, cancelled or replaced through a controlled administrative process.
Certificate metadata may be retained to:
Confirm whether a certificate is genuine
Respond to verification requests
Maintain an audit trail
Detect fraudulent or altered certificates
Record revoked or replaced certificates
Access to LMS records is limited according to role and operational need.
Internal LMS messaging
Our LMS may include internal messaging or chat features to support learner communication, course support and administration.
Messages may be reviewed where necessary for learner support, safeguarding, complaints, system misuse, quality assurance or legal reasons.
Employer and group bookings
Where training is booked, arranged, commissioned or funded by an employer or another organisation, that organisation may provide learner information to us.
We may use that information to:
Register learners
Allocate course access
Confirm attendance
Monitor completion
Administer assessments
Issue certificates
Provide agreed training reports
Resolve booking or administrative issues
Where lawful and appropriate, we may share the following information with the booking organisation:
Registration status
Attendance or non-attendance
Course progress
Completion status
Certificate issue or expiry status
Assessment outcome where relevant to the service purchased
Reassessment or referral status
Administrative or learner-support issues where disclosure is necessary
Conduct or safeguarding information where there is a lawful and proportionate reason to disclose it
We will not routinely provide employers with detailed assessment answers, private correspondence, medical information or unrelated personal information.
The extent of information shared may depend on the contractual arrangements, the purpose of the training, the employer’s legal responsibilities and the reasonable expectations of the learner.
Marketing communications
We may send information about courses, services, events, offers, newsletters and relevant training updates where we have a lawful basis to do so.
Where consent is required, marketing will only be sent after the appropriate consent has been obtained.
In some business-to-business circumstances, we may rely on legitimate interests or another lawful basis where permitted by law. We will still provide a clear way to object or unsubscribe.
You may opt out of marketing communications at any time by:
Using the unsubscribe link in an email
Updating your communication preferences where available
Contact us by filling the form below.
Opting out of marketing does not prevent us from sending essential service communications relating to:
Your booking
Your learner account
Course access
Training dates
Assessment or completion
Certificates
Payments, refunds or cancellations
Security or policy changes
Complaints, appeals or support requests
We do not sell personal information or marketing lists.
Cookies and website data
Our website may use cookies and similar technologies to operate, secure and improve the website.
Cookies may be used to:
Maintain website functionality
Remember settings and preferences
Support login or account functions
Maintain security
Understand website performance
Measure visitor interaction
Support analytics
Deliver marketing or embedded third-party content where permitted
Some cookies are strictly necessary for the website to operate and may not require consent.
Analytics, advertising and other non-essential cookies will be used only where permitted and, where required, after consent has been obtained.
You may manage your choices through our cookie-control mechanism or your browser settings. Blocking some cookies may affect website functionality.
Please read our separate Cookie Policy for further information.
Who we share information with
We may share personal information only where there is a lawful and legitimate reason to do so.
Recipients may include:
Learning Management System providers
Website, domain and hosting providers
Cloud-storage and backup providers
Payment processors and financial-service providers
Email, messaging and communication providers
Customer-support and booking-system providers
IT support, cybersecurity and technical-service providers
Trainers, assessors, internal quality assurers and authorised administrators
Employer clients or commissioning organisations
Accreditation, certification or awarding bodies where applicable
Professional advisers, including accountants, auditors and legal advisers
Insurers and insurance representatives
Debt-recovery or fraud-prevention providers where necessary
Government departments, regulators, courts, law-enforcement bodies or public authorities where required
A purchaser, investor or professional adviser involved in a legitimate corporate transaction, subject to appropriate confidentiality controls
Service providers that process personal information on our behalf are expected to use it only for authorised purposes and to apply appropriate confidentiality and security measures.
We may also disclose information where necessary to protect a person from serious harm, investigate suspected unlawful conduct, enforce our terms, or establish, exercise or defend legal rights.
We do not sell personal information.
International transfers
Clarivive MedInsight Ltd operates primarily within the United Kingdom. Some service providers, cloud platforms or software systems we use may process or permit access to personal information outside the UK.
Where we make a restricted international transfer, we will ensure that it is carried out in accordance with applicable international-transfer requirements under the UK GDPR (Chapter V, Articles 44A–49), the Data Protection Act 2018 and relevant amendments made by the Data (Use and Access) Act 2025 (Schedule 7).
Where required, we will use an appropriate legal transfer mechanism, such as:
UK adequacy regulations or approved transfers (UK GDPR, Article 45A);
Appropriate safeguards (UK GDPR, Article 46);
The UK International Data Transfer Agreement (IDTA) or UK Addendum (UK GDPR, Article 46; Data Protection Act 2018, section 119A);
An applicable legal exception where permitted (UK GDPR, Article 49); and
A transfer risk assessment and any necessary contractual, technical or organisational safeguards where required (UK GDPR, Article 46; Data (Use and Access) Act 2025, Schedule 7).
We will review relevant international-transfer arrangements when selecting and managing service providers.
How long we keep information
We retain personal information only for as long as it is reasonably required for the purpose for which it was collected, or where continued retention is necessary for legal, contractual, tax, accounting, audit, safeguarding, certification, insurance or dispute-management reasons.
There is no single statutory retention period applying to every category of personal information. Retention must be assessed according to the purpose and circumstances.
Retention periods may therefore differ. For example:
Website security and activity logs may be kept for a relatively short period unless needed for an investigation.
Enquiry and routine support records may be deleted when they are no longer operationally necessary.
Learner registration, attendance and assessment records may be retained for quality-assurance, audit and certification purposes.
Certificate metadata may be retained for a longer period to support verification and fraud prevention.
Financial and transaction records may be retained to meet legal and accounting obligations.
Complaint, appeal, malpractice, safeguarding or legal-dispute records may be retained for longer where justified by the nature of the matter.
Marketing records may be kept until consent is withdrawn, an objection is made, or the information is no longer needed.
Suppression records may be retained where necessary to ensure that a person who has opted out is not unintentionally contacted again.
At the end of the relevant retention period, information will be securely deleted, anonymised or otherwise disposed of unless a lawful reason requires continued retention.
The storage-limitation principle requires personal information not to be kept in identifiable form for longer than necessary.
Please refer to our Records Retention Policy for further information.
Your rights
Depending on the circumstances and the lawful basis used, you may have the right to:
Be informed about how your personal information is used
Request access to your personal information
Ask us to correct inaccurate or incomplete information
Request deletion of personal information
Request restriction of processing
Object to certain processing
Withdraw consent where consent is the lawful basis
Request data portability where applicable
Ask for information about certain automated decisions where applicable
Complain to the Information Commissioner’s Office
These rights are not absolute.
For example, we may lawfully refuse or limit a request where:
Information must be retained to meet a legal obligation
The information is required for certificate verification
Retention is necessary for an existing complaint, appeal or legal claim
Disclosure would adversely affect another person’s rights
An exemption applies
The request is manifestly unfounded or excessive
We cannot identify the information or verify the person making the request
Where a request cannot be fully accepted, we will explain the reason where legally permitted.
How to make a privacy request
To exercise your data protection rights or raise a concern about how we use your personal information, please complete the Privacy Request Form provided below.
The form may be used to request:
Access to the personal information we hold about you
Correction of inaccurate or incomplete information
Deletion of personal information where applicable
Restriction of processing
Objection to certain uses of your information
Withdrawal of consent where consent is the lawful basis
Data portability where applicable
Any other privacy-related request or concern
Please provide enough information for us to identify you, understand your request and locate the relevant records.
We may contact you for further information or reasonable proof of identity before processing your request. This is necessary to ensure that personal information is not disclosed, changed or deleted without proper authorisation.
Submitting the form does not mean that every request will automatically be approved. Some data protection rights are subject to legal limitations, and we may need to retain certain records for legal, contractual, financial, safeguarding, audit or certificate-verification purposes.
We will respond within the timeframe required by applicable data protection law. Where a request is particularly complex, we will inform you if additional time is legally permitted.
You may also contact us regarding a privacy request at:
Email: info@clarivive.co.uk
Security
We use proportionate technical and organisational measures intended to protect personal information against accidental or unlawful loss, alteration, destruction, disclosure, access or misuse.
Depending on the system and risk involved, measures may include:
User authentication
Password controls
Role-based access restrictions
Restricted administrative permissions
Secure configuration
Encryption where appropriate
Secure hosting and storage
Backups and recovery controls
Audit and activity logs
Certificate-access controls
Staff and contractor confidentiality requirements
Malware and security monitoring
Incident reporting and response procedures
Supplier due diligence
Data minimisation
Controlled deletion and disposal
Periodic review of access rights
Access to personal information is limited to individuals who reasonably require it for their role.
Users are responsible for keeping login credentials secure and must not share passwords or allow another person to access their account.
No website, email service, cloud platform or electronic system can be guaranteed to be completely secure. However, we take reasonable and proportionate measures to reduce privacy and security risks.
Children and young people
Our training services are mainly intended for adults, employees, professionals and organisations.
We do not knowingly collect personal information from children through ordinary course bookings unless the training has been specifically arranged for younger learners and appropriate safeguards have been established.
Where a child or young person participates in training, we may require:
Consent or authorisation from a parent, guardian, school, college or commissioning organisation
Age-appropriate privacy information
Appropriate supervision
Safeguarding controls
Restricted communications
Additional identity and booking checks
We will collect only the information reasonably required to administer the training and protect the learner.
If we become aware that a child’s information has been provided without an appropriate basis, we will review the circumstances and delete or restrict the information where required.
Social media
Clarivive MedInsight Ltd may operate official social-media accounts for communication, education, promotion and customer engagement.
Our official channels may include:
X
YouTube
Telegram
Threads
If you interact with us through a social-media platform, the platform provider may collect and process your information independently under its own privacy policy and terms.
Depending on how you interact with us, we may receive:
Your profile name
Public account details
Comments, reactions or messages
Enquiry details
Engagement and analytics information
Information you choose to share publicly or privately
You should not send sensitive, medical, identity, financial or confidential information through public comments or unsecured social-media messages.
We may moderate, hide, retain, report or delete content where necessary to address inappropriate conduct, protect users, meet platform rules or manage legal and reputational risks.
Only social-media accounts linked from our official website should be treated as authorised Clarivive MedInsight Ltd channels.
Changes to this Privacy Policy
We may update this Privacy Policy where necessary to reflect:
Changes in law or regulatory guidance
Changes to our services
New systems or service providers
Changes to our use of personal information
Changes to security or governance arrangements
Feedback, audits or operational improvements
The latest version will be published on our website with an updated revision date.
Where a change is significant and materially affects how personal information is used, we may provide additional notice through our website, LMS, email or another appropriate communication method.
We recommend reviewing this policy periodically.
Contact
For questions, privacy requests or concerns about how we handle personal information, Please fill the inquiry form given below or contact:
Clarivive MedInsight Ltd
Email: info@clarivive.co.uk
When contacting us, please provide sufficient information for us to understand and investigate your enquiry. Do not send unnecessary identity documents, medical records, financial details or other sensitive information unless we specifically request them through an appropriate method.
