Data Protection & GDPR

1. Our approach to data protection

Glutathione Training is committed to handling personal data responsibly, proportionately and transparently. Our professional education platform may process account information, learning records, assessments, reviewer feedback, certification information, enquiries, support records and other information required to provide and administer our services.

This page explains our general data-protection framework. More detailed information about the categories of information we process and the purposes for which we use it is available in our Privacy Policy.

2. Data-protection principles

Where the GDPR or equivalent principles apply, we aim to process personal data in accordance with the following principles:

• Lawfulness, fairness and transparency: personal data should be processed on an appropriate legal basis and in a manner individuals can reasonably understand.
• Purpose limitation: information should be collected for specified and legitimate purposes and not used incompatibly with those purposes.
• Data minimisation: we should collect only information reasonably necessary for the relevant purpose.
• Accuracy: reasonable steps should be taken to keep relevant personal information accurate and appropriately current.
• Storage limitation: identifiable information should not be retained indefinitely without a legitimate reason.
• Integrity and confidentiality: appropriate measures should protect information from unauthorised access, loss, misuse or disclosure.
• Accountability: appropriate records, processes and safeguards should support responsible data handling.

3. Data controller and processors

For personal data for which Glutathione Training determines the purposes and essential means of processing, Glutathione Training acts as the data controller.

We may engage service providers acting as data processors or independent controllers, depending on the service and legal relationship involved. These may include providers supporting hosting, email, security, payments, communications, translation and other technical or operational functions.

Where a provider acts on our behalf as a processor, appropriate contractual and organisational safeguards should govern its processing.

4. Lawful bases

Depending on the activity, our processing may rely on:

• performance of a contract or steps requested before entering a contract;
• legitimate interests in operating, securing and administering a professional education service;
• compliance with legal obligations;
• consent where consent is the appropriate legal basis.

Different processing activities can rely on different lawful bases. Consent is therefore not necessarily the legal basis for all personal-data processing undertaken by the platform.

5. Special-category and clinical information

Where educational exercises involve clinical scenarios, learners should use anonymised, fictionalised or appropriately de-identified information in accordance with professional, legal and organisational obligations.

A learner remains responsible for complying with the confidentiality and data-protection obligations applicable to information obtained through their own professional practice.

6. Professional learning and assessment records

Certain records have continuing educational and evidential significance. These can include assessment attempts, written submissions, scores, reviewer decisions, feedback, completion records, certificates and audit information.

Requests concerning such information will be considered in light of applicable data-protection rights as well as legitimate requirements to preserve the integrity, authenticity and verifiability of professional learning and certification records.

7. Data-subject rights

Subject to applicable law and relevant exemptions, an individual may have the right to request:

• confirmation of whether their personal data is being processed;
• access to relevant personal data;
• correction of inaccurate personal data;
• completion of incomplete information where appropriate;
• erasure where the legal conditions for erasure are satisfied;
• restriction of processing in qualifying circumstances;
• objection to qualifying processing;
• portability of eligible data;
• withdrawal of consent where consent is relied upon.

Rights are subject to the circumstances and are not absolute. A request to erase information, for example, may not require deletion of information that must legitimately be retained for legal, accounting, fraud-prevention, assessment, certification or evidential purposes.

8. Exercising your rights

A data-protection request can be made through our Contact Us page.

Please provide sufficient information for us to understand the request. We may ask for reasonable evidence of identity where necessary to prevent unauthorised disclosure, alteration or deletion of personal information.

We aim to respond within the period required by applicable law. A particularly complex request, or multiple requests from the same individual, may be subject to any lawful extension permitted by the relevant legislation.

9. Automated processing and human review

The learning platform may automatically score objective assessment components such as multiple-choice questions. Other elements may require human review, including written submissions, competency evidence, feedback and certification approval where specified by the course process.

Where human approval forms part of the applicable certification process, the final certification decision is not made solely by an automated scoring mechanism.

10. Access controls

Access to administrative, assessment and professional records should be restricted according to operational need and authorised role. The platform may use role-based access controls separating functions such as administration, assessment review, audit and learner access.

Users should not attempt to access records, functions or information for which they have not been authorised.

11. Security measures

Measures used to protect information may include, as appropriate:

• encrypted HTTPS connections;
• authenticated user accounts;
• role-based permissions;
• restricted administrative access;
• anti-abuse and automated-bot controls;
• security and application logging;
• protected infrastructure and backups;
• appropriate access and change controls.

Security measures are reviewed in the context of the nature of the service and risks reasonably identified. No online service can eliminate all security risk.

12. Personal-data breaches

Suspected security incidents involving personal data should be assessed promptly. Where an incident constitutes a personal-data breach, we will consider the nature of the information, likely consequences, affected individuals and the notification requirements imposed by applicable law.

Where legally required, an appropriate supervisory authority and/or affected individuals will be notified within the applicable legal framework.

13. International transfers

Some infrastructure or service providers may operate internationally. Where personal data is transferred to a country requiring additional safeguards under applicable law, an appropriate recognised transfer mechanism or safeguard should be used where required.

14. Data retention

Retention is determined according to the purpose and nature of the record. Relevant factors may include contractual requirements, professional education integrity, certification, financial and accounting requirements, legal obligations, dispute management, security and the establishment or defence of legal claims.

We do not intend to retain identifiable personal information indefinitely where there is no continuing legitimate purpose for doing so.

15. Supervisory authorities

Individuals may have the right to raise a complaint with the data-protection supervisory authority applicable to their circumstances.

We encourage individuals to contact us first where appropriate so that we have an opportunity to understand and address the concern, although doing so does not remove any statutory right to contact a supervisory authority.

16. Governance and review

Our data-protection arrangements may be updated as the platform, services, legal requirements and processing activities develop. Material changes to public-facing information will be reflected in the relevant policy documentation.