This policy explains what personal data Care2Learn collects, why we collect it, how we look after it, and the rights you have. We are committed to handling personal data responsibly and in line with UK data protection law.
1. Who we are
Care2Learn is a service provided by CARE2LEARN LIMITED, a company registered in England and Wales (company number 12435039), whose registered office is at Wren House, 68 London Road, St Albans, Hertfordshire, United Kingdom, AL1 1NG. For data protection purposes we are registered with the Information Commissioner's Office (ICO) under reference ZC205619. You can reach us about privacy matters at hello@care2learn.co.uk.
2. Our role: controller and processor
We handle personal data in two different roles, and this matters for your rights:
- When you are a care provider using Care2Learn to train your staff, you are the data controller for your staff's training records and we act as your processor — we process that data on your instructions. Requests from your staff about their records are usually best directed to their employer (you), though we will help where appropriate.
- We are the controller for the personal data we handle to run our own business — for example, account and billing contacts, enquiries, marketing, and information about how our website is used.
3. The personal data we collect
Account and contact data
When you register or get in touch: name, work email, organisation name, job role, and the content of messages you send us. When you sign up from a link or advert, we also record once, at registration, any campaign tags on that link (such as src, utm or gclid values) and the name of the website that referred you — never the full address — so we know how you found us; nothing is stored in your browser for this.
Learner records
To deliver training on behalf of care providers, the platform holds: learner names, email addresses or usernames, job roles, the courses assigned to them, their progress, assessment results, and completion certificates.
Care Passport data
Where the Care Passport (passport.care2learn.co.uk) is used, we hold worker-owned verified training credentials linked to an individual, so that a carer can evidence their record.
Technical and usage data
Basic information such as sign-in activity and general usage needed to keep the service secure and working. Payment is handled by our payment provider; we do not store full card details.
4. How we use personal data, and our lawful bases
- To provide the service (create accounts, deliver and track training, issue certificates) — on the basis of our contract with you, or, for learner data, on the instructions of the care provider.
- To run and improve our business (support, security, service improvements) — on the basis of our legitimate interests in operating a reliable service, balanced against your rights.
- To send service messages you need to receive, and, where you have opted in, marketing about Care2Learn — marketing is on the basis of your consent, which you can withdraw at any time.
- To let a certificate be checked by someone holding it — on the basis of our legitimate interests, explained in section 5 below.
- To meet legal and regulatory obligations — on the basis of our legal obligations.
5. Verifying a certificate
Certificates we issue carry a certificate ID, and anyone holding a certificate can check it at care2learn.co.uk/verify. This lets an employer confirm that training a worker holds is genuine and still in date.
To see any result, the person checking must enter both the certificate ID and the learner's surname — both printed on the certificate itself. A certificate ID on its own returns nothing, so someone who comes across an ID cannot use it to look up a learner's training record.
Where both match, we show only the learner's first initial and surname, the course title, the completion and expiry dates, the assessment result, and whether the certificate is currently valid. We do not show the learner's full first name, their email address, their employer, or any other course they have taken. We also limit how many checks can be made from one device.
Our lawful basis, and your right to object
We rely on our legitimate interests. Employers in regulated care need to be able to confirm that training a worker holds is real and in date, and we have an interest in our certificates being relied upon. We have weighed that against the privacy of learners: the disclosure is the minimum needed, it requires two details taken from the certificate itself, and the fact that a certificate can be verified is printed on the certificate when it is issued.
You have the right to object. Email hello@care2learn.co.uk and we will consider your objection and tell you what we decide. Please note that if we remove a certificate from verification, an employer checking it will be told we hold no matching record, which may make it harder for them to accept it as evidence of your training.
If you ask us to email you the result
Anyone checking a certificate can ask us to email them the result for their own records. We use the address they give only to send that result.
On that page they may also tick a box — never ticked for them — to receive occasional updates from Care2Learn about training for care providers. The result is emailed either way, so those updates are never a condition of using the checker. Our lawful basis for them is consent, and we keep a record of the exact wording shown and the date it was agreed. Consent can be withdrawn at any time, without giving a reason, using the unsubscribe link in any email we send or by emailing hello@care2learn.co.uk.
6. Cookies and similar technologies
We keep this to a minimum. We use essential storage in your browser to keep you signed in and to make the service work; we do not use it to track you across other websites.
On our public marketing pages we also use optional Google measurement cookies (Google Ads and Google Analytics) to understand our advertising and how those pages are used. These are off by default: nothing is set unless you choose Accept on the cookie banner, rejecting is always as easy as accepting, and the service works the same either way. Your choice is recorded in your browser and you can change it at any time using the “Cookie choices” link in the page footer, or by clearing this site’s data in your browser.
7. Who we share data with
We do not sell personal data. We share it only with trusted providers who help us run the service, under contracts that require them to protect it. These include:
- our hosting and infrastructure provider (Render);
- our email and communications provider (Resend);
- our payment provider (Stripe);
- Google (Google Ads and Google Analytics), only if you accept the optional measurement cookies described in section 6 — and only usage data from our public marketing pages, never learner training records; and
- professional advisers, or authorities, where we are legally required to disclose information.
8. Where data is stored and international transfers
The platform and its database are hosted in the United States. Our hosting provider, Render, runs the service from its Oregon (US) region, and our email provider, Resend, also processes data in the US. Our payment provider, Stripe, processes payment data in the US and elsewhere. So personal data held in Care2Learn — including learner training records — is stored in the US, not in the UK or EEA.
UK data protection law permits this where a recognised safeguard is in place, and here it is. Render, Resend and Stripe are each certified under the EU–US Data Privacy Framework and its UK Extension (the “UK–US data bridge”), which the UK government has approved as providing adequate protection for personal data sent from the UK, and each processes personal data for us under its data processing agreement. If a provider lost its certification, we would put an alternative safeguard in place (such as the UK International Data Transfer Agreement or UK-approved standard contractual clauses) or move the data.
If your organisation needs this for its own records or risk assessments: name Render (US, hosting and database), Resend (US, email) and Stripe (payments), with the UK Extension to the EU–US Data Privacy Framework as the transfer safeguard.
9. How long we keep it
We keep personal data only for as long as needed for the purposes above. Learner records are kept for as long as the care provider's account is active and in line with their instructions. When an account closes, we make data available for export for a reasonable period, then delete or anonymise it unless we are required to keep it (for example, for tax or legal reasons).
Leavers. When a care provider deactivates a staff member's licence, that person's records are kept for the provider's chosen retention period — 6 years after deactivation unless the provider sets otherwise (between 1 and 10 years, in their Settings) — and are then erased automatically: the training history, Care Certificate portfolio and uploaded evidence are deleted, and the person's certificates can no longer be verified through this site. Providers can also erase a deactivated person's record at any time, for example to carry out an erasure request. After erasure, only anonymous counts remain (how many records were erased and how many courses they had completed), plus the bare certificate IDs so that anyone checking one is told the record was erased rather than being led to think the certificate was never genuine.
One record is kept for longer: which version of our Terms & Conditions your organisation accepted, and when — together with the accepting email address and IP address — is retained for six years after your account closes, matching the limitation period for contract claims in England and Wales.
10. How we protect it
We use appropriate technical and organisational measures to keep personal data secure, including access controls and encryption in transit. No system is completely secure, but we work to protect your information and to respond quickly if anything goes wrong.
11. Your rights
Under UK data protection law you have the right to: access your personal data; ask us to correct it; ask us to delete it; restrict or object to how we use it; ask for a copy in a portable format; and withdraw consent where we rely on it. To exercise these rights, contact us at hello@care2learn.co.uk.
12. Children
Care2Learn is a professional training service for adults working in care. It is not directed at children and we do not knowingly collect children's personal data.
13. Changes to this policy
We may update this policy from time to time. When we make significant changes, we will update the date at the top and, where appropriate, let you know.
14. Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to us, and we would like the chance to put it right. Email hello@care2learn.co.uk with “complaint” in the subject line, or use the contact form on our home page, or write to the address in section 15. Tell us what has gone wrong and how it affects you.
We will acknowledge your complaint within 30 days of receiving it, look into it, and reply to tell you the outcome and what we are doing about it, without undue delay.
If your data is held in Care2Learn because your employer uses us to manage training, your employer controls those records. We may pass your complaint to them to answer as the data controller, and we will tell you if we do.
You also have the right to complain to the ICO, the UK's data protection regulator, at ico.org.uk — whether or not you complain to us first.
15. Contact us
For any privacy question, email hello@care2learn.co.uk or write to us at Wren House, 68 London Road, St Albans, Hertfordshire, United Kingdom, AL1 1NG.