Privacy Policy

Document control

1. Purpose and status

AURAFEEDS LTD, operating AuraFeeds Academy, is committed to handling personal information lawfully, fairly, transparently and securely.

This Privacy Policy explains what personal information AuraFeeds collects, how it is obtained, why it is used, the lawful bases relied upon, who it may be shared with, where it is stored, how long it is retained and the rights available to individuals.

For UK data-protection purposes, AURAFEEDS LTD is the data controller for personal information collected through AuraFeeds Academy. Voyager and other technical suppliers may act as processors where they handle personal information on AuraFeeds' instructions.

This policy reflects the current technical and operational arrangements confirmed by the Academy platform provider.

2. Who this policy applies to

This policy applies to:

• individual learners and purchasers;
• learners whose access is purchased or allocated by an employer, care provider, NHS organisation, college or other organisation;
• people who contact AuraFeeds for support, refunds, complaints or accessibility assistance;
• business and organisational contacts involved in bulk purchases;
• website visitors where technical information is processed.

3. Personal information collected

3.1 Registration and account information

• Name.
• Email address.
• Date of birth.
• Account and authentication information needed to provide secure access.
• Acceptance of the Terms and any immediate-access acknowledgement, including the date and version accepted.

The current platform does not routinely collect a separate username, job title or employer field as part of learner registration.

3.2 Order and payment information

• Course ordered or allocated.
• Order number, date, price and payment status.
• Billing contact information where required.
• Card brand and last four digits displayed in the order record.

Payments are processed by Stripe. AuraFeeds does not store full card numbers or card security codes.

3.3 Course and completion information

• Course enrolment and access.
• Lesson and course completion status.
• Whether required quiz questions have been answered correctly.
• Feedback submitted.
• Certificate information, including learner name, course and completion date.

The platform does not currently retain a percentage quiz score or detailed quiz score. Unlimited attempts are available, and completion is based on answering all required questions correctly.

3.4 Technical and security information

• Login and authentication information.
• An essential login cookie lasting 12 hours.
• Security, diagnostic or operational information required to keep the platform working.

Voyager has confirmed that the site does not currently use marketing cookies, analytics cookies or third-party embedded video services. The platform is not described as routinely collecting IP addresses for AuraFeeds' learner records, although infrastructure providers may process technical connection information as part of secure hosting and service delivery.

3.5 Communications and support

AuraFeeds may retain information provided in emails or other communications concerning learner support, course access, refunds, complaints, accessibility requests, privacy rights or technical issues.

3.6 Special-category information

AuraFeeds does not normally require health information or other special-category personal information. A learner may voluntarily provide limited information when requesting an accessibility adjustment or support.

Such information will be used only where necessary and where an appropriate legal basis and additional condition apply. Learners must not include identifiable patient, service-user, family or confidential workplace information in feedback, assessments or general support messages.

4. How information is collected

• Directly from an individual during registration, purchase, course participation or correspondence.
• From an employer, care provider, college, NHS organisation or other organisation purchasing or allocating access.
• Automatically through the learning platform when a learner signs in or completes course activity.
• From Stripe in relation to payment status and limited transaction information.
• From Voyager and other service providers where needed to provide technical support, hosting, security, backups or platform administration.

5. Purposes and lawful bases

5.1 Contract

AuraFeeds relies on the performance of a contract, or steps requested before entering a contract, to:

• create and administer accounts;
• process orders and provide course access;
• record completion and issue certificates;
• provide learner support;
• administer refunds and organisational purchases.

5.2 Legitimate interests

AuraFeeds may rely on legitimate interests, subject to an appropriate balancing assessment, to:

• operate, secure and improve the Academy;
• maintain completion and certificate records;
• prevent fraud, account sharing and misuse;
• respond to enquiries and complaints;
• analyse anonymous or aggregated feedback;
• manage relationships with organisational purchasers;
• establish, exercise or defend legal claims.

5.3 Legal obligation

Information may be processed where necessary to comply with tax, accounting, company, consumer-protection, data-protection or other legal obligations.

5.4 Consent

Consent may be used for optional direct marketing or publication of an identifiable testimonial. Consent can be withdrawn at any time. Registration and acceptance of Terms are not treated as consent to every use of personal information.

5.5 Special-category information

Where a learner voluntarily provides health-related information for an accessibility request, AuraFeeds will identify an appropriate Article 6 lawful basis and a valid condition for special-category processing before using it.

6. How information is used

• Register and authenticate learners.
• Provide and administer course access.
• Record course completion and certificate status.
• Process purchases, invoices and refunds.
• Deliver support and resolve technical problems.
• Respond to complaints and accessibility requests.
• Collect and review learner feedback.
• Maintain CPD, quality-assurance and audit records.
• Protect platform security and prevent misuse.
• Comply with legal and regulatory duties.
• Notify active learners of material course or service changes.

7. Marketing

AuraFeeds does not currently collect learner information for marketing through the Academy sign-up process unless a separate, clear marketing choice is presented.

Where direct marketing is introduced, AuraFeeds will identify the lawful basis, provide a clear opt-in or opt-out as required and maintain a record of preferences. Service messages about orders, accounts, access, security, course changes and certificates are not marketing.

Individuals can object to or unsubscribe from marketing at any time by using the facility in the message or emailing contact@aurafeedsacademy.org.

8. Feedback

A learner may be required to submit feedback before a certificate is made available. Feedback may be used to evaluate course quality, confirm whether learning objectives have been met, identify accessibility or technical barriers, support CPD review and produce anonymous or aggregated reports.

AuraFeeds will not publish a learner's name, quotation, image or identifiable testimonial without appropriate permission. Identifiable patient or service-user information must not be included.

9. Organisational and bulk purchases

Bulk purchases are currently managed manually. An organisation may provide AuraFeeds with a learner's name and email address so that access can be allocated.

AuraFeeds may provide the purchasing organisation with reasonable administrative information, such as whether a licence has been activated, course progress, completion status and certificate status.

The platform does not store a percentage quiz score, and identifiable learner feedback will not routinely be disclosed to the purchasing organisation. An organisation that provides or receives personal information may be a separate data controller and is responsible for its own lawful processing.

10. Sharing personal information

AuraFeeds may share personal information only where necessary and lawful with:

• Voyager, as website and learning-platform provider;
• hosting, database, security and backup providers used to operate the platform;
• Stripe, for payment processing;
• email and communication service providers;
• professional advisers, such as accountants, insurers and legal advisers;
• CPD assessors or certification bodies where reasonably required;
• an employer or organisation that purchased or allocated access, within the limits described above;
• regulators, courts, law-enforcement bodies or public authorities where required by law.

AuraFeeds does not sell personal information. Suppliers acting as processors should be bound by appropriate data-processing terms and may use information only as instructed, except where the law requires otherwise.

11. Hosting and international transfers

Voyager has confirmed that Academy data is hosted in the United States. This means personal information may be transferred outside the United Kingdom.

AuraFeeds will ensure that the relevant hosting arrangements, transfer route and safeguards are documented and kept under review. Appropriate safeguards may include an applicable UK adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with any required transfer-risk assessment.

Individuals may contact AuraFeeds for further information about the safeguards used for international transfers.

12. Cookies and similar technologies

The Academy currently uses one essential login cookie with a duration of 12 hours. It is used to maintain authentication and provide the service requested by the learner.

The site does not currently use marketing cookies, analytics cookies or third-party video embeds. Because the cookie is essential to the requested service, it is not used for advertising or behavioural tracking.

If the platform's use of cookies or similar technologies changes, this policy and any separate Cookie Policy or consent mechanism will be updated before non-essential technologies are introduced.

13. Retention

AuraFeeds keeps personal information only for as long as necessary for the purpose for which it was collected, including contract administration, certificate integrity, legal obligations, quality assurance and dispute handling.

Retention periods are reviewed regularly and may be updated where operational, legal or regulatory requirements change. Information may be retained longer where required by law, needed for a legal claim or connected to an unresolved complaint.

14. Security

AuraFeeds and its suppliers will take appropriate technical and organisational measures, proportionate to the risks, to protect personal information against unauthorised access, loss, misuse, alteration, disclosure or destruction.

• Restricted administrative access.
• Secure authentication and password controls.
• Encrypted transmission where appropriate.
• Secure hosting, backups and recovery arrangements.
• Software and security updates.
• Monitoring and incident-management procedures.
• Confidentiality and data-processing obligations for relevant suppliers.

No online system can guarantee absolute security. Learners must keep login details confidential and notify AuraFeeds promptly if they believe an account has been compromised.

15. Data breaches

Suspected personal-data breaches will be assessed promptly. AuraFeeds will work with Voyager and relevant suppliers to contain the incident, understand the information affected, reduce harm and document the response.

Where the legal threshold is met, AuraFeeds will notify the Information Commissioner's Office and affected individuals within the applicable timescales.

16. Individual rights

Depending on the circumstances, individuals may have rights to:

• be informed about the use of personal information;
• request access to personal information;
• have inaccurate or incomplete information corrected;
• request erasure;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where consent is relied upon;
• complain about the handling of personal information.

Rights are not absolute and legal exemptions may apply. AuraFeeds may request information needed to verify identity and locate the relevant records.

Requests should be sent to contact@aurafeedsacademy.org. AuraFeeds will normally respond within one month, subject to any lawful extension.

17. Children and younger learners

AuraFeeds Academy is primarily designed for professionals, carers, support workers, students, apprentices and others involved in enteral feeding. It is not generally marketed as a children's service.

The Academy does not currently impose a general under-18 block because some training may be relevant to 16- or 17-year-old young carers, sibling carers, apprentices or college students.

Where a younger learner enrols, AuraFeeds will use clear language and collect only the information needed to provide the course. Where appropriate, participation should be supported or agreed by a parent, guardian, employer or education provider. AuraFeeds will review whether additional age-appropriate measures are required if younger learners become a significant user group.

18. Automated decision-making

AuraFeeds does not currently use learner information for automated decisions that produce legal or similarly significant effects. Course completion is based on the learner completing required content, answering each required question correctly and submitting feedback.

19. External links

The Academy may link to clinical guidance, manufacturers, YouTube or other external resources. External organisations are responsible for their own privacy practices. Learners should review the privacy information of the external service before providing personal information.

20. Complaints

Privacy questions or concerns should first be sent to contact@aurafeedsacademy.org so that AuraFeeds can investigate.

An individual also has the right to complain to the Information Commissioner's Office. Contact details and current guidance are available on the ICO website.

21. Changes to this policy

AuraFeeds may update this policy where services, suppliers, platform features, legal requirements or data-handling practices change. The current version will be published on the Academy website.

Material changes affecting active learners may also be notified by email or through the platform. The effective date and version will be shown in the document.

22. Contact

AURAFEEDS LTD

525 New Ashby Road

Loughborough

United Kingdom

LE11 4EX

Email: contact@aurafeedsacademy.org

Company number: 17194187

ICO registration number: ZC195920

23. Reference framework

This document has been prepared with reference to the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and current ICO guidance on privacy information, lawful bases, security, cookies and international transfers.