Privacy Policy

The Marula Institute ("we", "us", "our") is a national paediatric complex care governance institute based in the United Kingdom. We provide training, competency frameworks, and certification to organisations and individuals working in children's complex health care.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Marula Institute is the Data Controller for personal data processed through our training and certification platform.

This Privacy Policy describes how we collect, use, store, and share personal data in connection with our training registration and certification process. It applies to:

• Client organisations ("Employers") - companies, providers, hospices, and other organisations that register employees for Marula training programmes.
• Individual trainees ("Trainees") - employees, carers, and other individuals whose details are submitted for training and certification.

This policy should be read alongside any separate contract or data processing agreement in place between the Marula Institute and your organisation.

Data submitted by Employers

When an organisation registers employees on our platform, they may provide the following information about each Trainee:

• Full name
• Work email address
• Job title and role
• Department or team
• Training programme(s) to be completed

Data submitted by Trainees

Once an Employer registers a Trainee and sends them a personalised registration link, the Trainee may provide or confirm:

• Personal or alternative contact email address
• Confirmation of role and employer
• Any further information required to complete their registration

Data generated through training

As Trainees progress through our programmes, we automatically record:

• Modules started and completed
• Assessment results and scores
• Dates of completion
• Certification status and certificate issue dates
• Renewal or expiry dates where applicable

We use the personal data we hold for the following purposes:

• To register Trainees on the appropriate training programme
• To send Trainees their registration link and onboarding information
• To track training progress and record completion
• To issue certificates of completion and maintain certification records
• To notify Trainees and Employers of upcoming renewal or expiry dates
• To allow Trainees to share proof of certification with current or future employers
• To meet our obligations to certification and accreditation bodies
• To improve our training programmes and platform
• To respond to enquiries and provide support

We will not use your personal data for marketing purposes without your explicit consent.

Under the UK GDPR, we rely on the following lawful bases for processing personal data:

• Contract - processing is necessary to fulfil our agreement with the Employer to deliver training and issue certifications.
• Legitimate interests - we have a legitimate interest in maintaining accurate certification records to support the safety and quality of children's complex care, and to allow Trainees to demonstrate their qualifications.
• Legal obligation - where we are required to share data with regulatory or accreditation bodies.
• Consent - where a Trainee chooses to keep their records beyond employment or uses them independently to demonstrate qualifications.

We do not sell personal data. We may share data with the following categories of third parties, strictly for the purposes described in this policy:

Certification bodies

Where a training programme leads to a formal accreditation or certificate, we will share the necessary Trainee data (name, completion date, result) with the relevant certification body in order to issue and register the qualification.

Employers

The organisation that registered a Trainee will have access to that Trainee's training progress and certification status. This allows Employers to manage workforce compliance and training records.

Training providers

Where training content is delivered by a third-party training company on behalf of the Marula Institute, we will share the relevant Trainee information with that provider solely for the purpose of delivering the training.

Technology and hosting providers

Our platform and data are hosted by secure, UK or EEA-based technology providers acting as Data Processors under written agreements that comply with UK GDPR requirements.

We recognise that certification records have long-term value - particularly for carers and healthcare workers who may wish to demonstrate their qualifications to future employers. For this reason:

Trainees may request deletion of their personal data and certification records at any time by contacting us (see Section 11). Upon a valid deletion request, we will remove personal data within 30 days, subject to any legal or regulatory obligations that may require us to retain specific records.

Where an Employer account is closed, Trainee data will be retained for the individual Trainee's benefit until they request its deletion. We will make reasonable efforts to notify affected Trainees in such circumstances.

Under UK GDPR, both Trainees and Employers have the following rights in relation to personal data we hold:

Trainee right to remove registration details

When an Employer enters a Trainee's details and sends them a registration link, the Trainee has the right to remove their details before completing registration. To exercise this right, Trainees should follow the link provided in the registration email, where they will have the option to decline and request removal of their information.

To exercise any of the above rights, please contact us at info@marulainstitute.org. We will respond within one calendar month.

We take the security of personal data seriously. Our measures include:

• Encrypted data storage and secure transmission (TLS/SSL)
• Access controls limiting who can view personal data within our organisation
• Regular security reviews of our platform and processes
• Data processing agreements with all third-party providers
• Staff training on data protection responsibilities

In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours and will inform affected individuals without undue delay where required.

Our training platform uses cookies and similar technologies to operate correctly and to improve your experience. These may include:

• Essential cookies - required for the platform to function (e.g. keeping you logged in).
• Analytics cookies - used to understand how the platform is used, so we can improve it.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the platform.

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact us:

Right to complain to the ICO

If you are not satisfied with our response, you have the right to lodge a complaint with the UK's data protection supervisory authority:

• Information Commissioner's Office (ICO)
• Website: www.ico.org.uk
• Helpline: 0303 123 1113

Changes to this policy

We may update this Privacy Policy from time to time. Where we make material changes, we will notify Employers and Trainees by email and update the effective date at the top of this page. We encourage you to review this policy periodically.