Legal
Privacy policy
Effective from 20 October 2026
This policy explains how My Care Training collects, uses and protects personal information when you visit mycaretraining.com, contact us, start a demo, buy a course, or use our learning platform. We handle personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We never sell or rent your personal information.
1. Who we are
My Care Training is the trading name of My Care Training Ltd, a company registered in Scotland. You can contact us at info@mycaretraining.com or on 0141 648 4801.
2. The information we collect
When you visit our website
- We measure visits with Umami, a privacy-friendly analytics service. It does not use cookies, does not store anything on your device and does not collect personal information: we see totals such as page views, referring websites, country, and device type.
- Our hosting provider keeps short-lived technical logs (such as IP address and browser type) to run and protect the website.
When you contact us or start a free demo
- Your name, email address, phone number, organisation, job title, number of care staff, your care regulator and (if you give it) your registration number, and your message.
- To stop automated abuse, forms are checked by Cloudflare Turnstile, which looks at technical signals from your browser.
When you have an account on our learning platform
- Your name, email address and password (stored only in a scrambled, one-way form we cannot read).
- For managers and administrators: two-step verification details for signing in.
- If your employer gave you access: your organisation, the courses assigned to you, and any groups you belong to.
- Your learning records: lessons completed, quiz attempts and scores, course completions, and certificates.
- A record of sign-ins (date, time, and the device and browser used) for security.
- Messages you send to our support team.
- Emails we send you (such as invitations and course reminders) and whether they were delivered.
When you buy a course
- Your name, email address, what you bought, the amount and the date. Payments are taken by Stripe: we never see or store your full card details.
3. Whose information it is (controller and processor)
- Website visitors, enquiries, demos and people who buy courses for themselves: we decide how this information is used, so we are the controller.
- Staff whose employer provides their training: your employer decides what training you do and uses the records to manage its workforce and show inspectors that staff are trained. For those records your employer is the controller and we process them on its behalf, under our agreement with it. Questions about how your employer uses your training records are best sent to your employer; we will help them answer.
- Certificates: we issue every certificate and keep the register that lets anyone check one is genuine (see section 5), so we are the controller of the certificate register.
4. How we use your information, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Provide your account, courses, progress and certificates | Contract (with you, or with your employer) |
| Process payments and send receipts | Contract |
| Keep financial records | Legal obligation |
| Reply to enquiries and set up and follow up demos | Legitimate interests (answering people who contact us) |
| Send service emails: invitations, course assignments, reminders, completion and access-expiry notices | Contract, or legitimate interests where your employer chose them |
| Keep the platform secure: sign-in records, two-step verification, rate limits, bot checks, error monitoring | Legitimate interests (protecting accounts and the service) |
| Run the public certificate checker | Legitimate interests (letting employers and inspectors confirm certificates are genuine) |
| Understand how the website is used, in totals only | Legitimate interests (improving the website) |
We do not send marketing emails. If we start a newsletter, we will only send it to people who ask for it, and every email will have an unsubscribe link.
5. Checking certificates
Each certificate has a unique number and a QR code. Anyone who has the number can check it at mycaretraining.com/verify and will see the learner's name as printed on the certificate, the course, the completion date and whether the certificate is valid, expired or revoked. The checker cannot be searched by name. This lets employers and inspectors confirm a certificate is genuine.
6. Who we share information with
We use trusted service providers to run our website and platform. They act only on our instructions and are bound by contracts to protect your information.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, accounts and sign-in, file storage | London, UK |
| Vercel | Website and platform hosting | London, UK (Vercel Inc. is in the USA) |
| Twilio SendGrid | Sending emails | USA |
| Stripe | Taking payments | UK and EU (Stripe also processes in the USA) |
| Sentry | Reporting technical errors so we can fix them | EU |
| Cloudflare | Turnstile bot checks on forms | Global network |
| Upstash | Rate limiting (protects against abuse) | London, UK |
| Umami | Website analytics (no personal information) | EU |
If your employer provides your training, your managers at that employer can see your progress, quiz results and certificates.
We may also share information if the law requires it, to protect people's rights and safety, or as part of a sale or merger of our business (the new owner would have to follow this policy).
7. Transfers outside the UK
Some providers process information outside the UK, mainly in the USA. When they do, the transfer is protected by the UK-US data bridge or by the UK's International Data Transfer Agreement or Addendum, as the law requires.
8. How long we keep information
| Information | How long |
|---|---|
| Enquiries and demo requests that don't become customers | 12 months |
| Demo organisations that don't become customers | 90 days after the demo ends |
| Active accounts and training records | While the account is active |
| Training records and certificates of deactivated staff | 5 years after deactivation, so employers can show training history to inspectors |
| Certificate register (name, course, date, status) | No fixed end date, so a certificate can always be checked when someone presents it |
| Sign-in records | 12 months |
| Purchase and invoice records | 6 years, for tax purposes |
| Technical error reports | Up to 90 days |
9. Cookies
We only use cookies that are strictly necessary:
- Sign-in cookies keep you signed in to the learning platform. They are removed when you sign out and stop working when your session expires.
- Security cookies may be set by Cloudflare Turnstile on forms, and by Stripe on the payment page to prevent fraud.
We don't use advertising or tracking cookies, and our analytics don't use cookies, so we don't need to ask for your consent with a cookie banner. You can block cookies in your browser, but you won't be able to sign in.
10. Your rights
You have the right to:
- ask for a copy of your personal information;
- ask us to correct information that is wrong;
- ask us to delete your information (we may need to keep some records, such as invoices, or a record that a certificate was issued);
- object to, or ask us to restrict, how we use your information;
- ask for your information in a format you can take elsewhere.
To use any of these rights, email info@mycaretraining.com. We will reply within one month. If your training is provided by your employer, we may pass your request to them, as they decide how those records are used.
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
11. How we protect your information
Information is encrypted in transit and at rest. Access is limited to people who need it. Administrators must use two-step verification, and managers use it by default unless their organisation asks us to turn it off. Each organisation can only see its own staff's records. No system is completely secure, so please keep your password to yourself and choose one you don't use elsewhere.
12. Changes to this policy
We may update this policy. The latest version will always be on this page with its effective date, and we will tell account holders by email about any important change.