How we protect your personal data

Healthcare Practise ("we", "us", "our") runs ae.healthcarepractise.com and provides the courses sold on it. We decide why and how the personal data described in this policy is processed, so we are its controller under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL").

For any question about this policy or your data, email support@healthcarepractise.com with "Privacy" in the subject line, or use our contact page.

This policy applies to personal data we handle when you visit the website, create an account, buy and study a course, take an assessment, download or verify a certificate, contact us or receive emails from us.

It does not cover the websites of the UAE authorities and official legislation portals we link to as sources. They have their own privacy policies.

What stays on your device. Your place in a course, your reflection notes and your reading settings (such as text size) are saved in your browser's local storage on the device you use. They are not sent to us and we cannot see them. The course pack you save at the end of a course is generated in your browser.

What we do not collect. We do not receive your full card number; the payment provider handles it. We do not ask for health data, and we do not need any information about patients. Please do not include patient details, file numbers or the names of others in messages. If you tell us about a complaint or investigation you are facing, we use that only to answer you and treat it as confidential.

The PDPL allows personal data to be processed with your consent, or without it in specific cases the law lists, such as where processing is necessary to perform a contract you are party to, to meet a legal obligation, or to establish or defend legal claims. The basis we rely on for each purpose is shown below.

We do not sell personal data and do not share it for other organisations' marketing.

Automated marking. Assessment answers are marked automatically against fixed answers, and that decides whether you pass. You can retake an assessment, and if you think an answer was marked wrongly you can ask for a person to review it.

Some learners take our courses while a complaint, investigation or committee process is open. We treat the fact that you have an account, the courses you have bought and your results as confidential. We do not tell your employer, your licensing authority, a Medical Liability Committee, your insurer or anyone else that you have enrolled, unless:

• you ask us to, for example to confirm completion to a named person;
• someone enters a certificate number you have shared on our verification page;
• we are required to by law, for example by a court order or a binding request from a competent authority. Where the law allows, we will tell you before we disclose anything.

Each certificate carries a unique number and a QR code. Anyone who enters a valid number on the verification page sees the learner's name, the course title, the learning hours, the completion date and the final assessment score, followed by our independence statement. The page cannot be searched by name, lists nothing for courses that are bought but not completed, and is kept out of search engines. Only people you give the number to can see these details.

We keep certificate records so that verification keeps working for the retention period in section 9. If you ask us to erase your certificate records, the certificate will no longer verify.

We share personal data only as far as needed, with:

• Our payment provider, which processes card payments and refunds and carries out fraud checks.
• Our hosting provider, which stores the website, its database and backups.
• Email delivery services, which send account, order and certificate emails.
• Analytics providers, Google (Google Analytics) and Microsoft (Microsoft Clarity), only if you accept analytics cookies in the cookie banner.
• A web font service, which receives your IP address when certain pages, such as the certificate, load fonts from it.
• Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.
• Public authorities or courts, only where the law requires it (see section 5).
• A successor, if the website or the courses are transferred to another organisation, which would then have to protect your data in line with this policy.

Service providers act on our instructions as processors. We choose them for their security standards, require them to keep your data confidential and secure, and do not allow them to use it for their own purposes.

Some of our service providers, for example hosting, email or payment services, may store or process data on servers outside the United Arab Emirates. The PDPL allows personal data to be transferred abroad to countries whose laws give an adequate level of protection, and otherwise only in the limited cases it sets out, which include a transfer necessary to perform a contract with you and a transfer you have expressly consented to.

We transfer data abroad only on one of those grounds. We also use contractual commitments from our providers, and encryption of data in transit, to keep it protected wherever it is processed. You can ask us for more information about the transfers that apply to your data.

When a period ends we delete the data or anonymise it so that it no longer identifies you. We may keep specific records for longer if they are needed to deal with a legal claim or an official request that is already under way.

• The website uses encrypted (HTTPS) connections throughout.
• Passwords are stored in hashed form, and card details never reach our servers.
• Course content opens only for enrolled learners, and access to learner records is limited to the people who need it to run the service.
• We keep software up to date and take regular backups.

No online system can be made completely secure. If a breach of personal data occurs that is likely to harm your privacy, we will take steps to contain it and will notify you and the UAE Data Office where the PDPL requires us to.

Under the PDPL you can ask us to:

• tell you what personal data we hold about you, why we use it, who receives it, where it came from and how long we keep it;
• give you a copy of the data you provided, or send it to another organisation, in a structured, machine-readable format where this is technically possible;
• correct data that is inaccurate or incomplete;
• erase data that is no longer needed or is being processed unlawfully, unless we must keep it, for example for tax records or a legal claim;
• restrict how we use your data while a question about its accuracy or our use of it is resolved;
• stop using it for direct marketing, at any time;
• review a decision made only by automated processing, such as the marking of an assessment, by a person.

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did with your consent before you withdrew it.

If you are unhappy with how we have handled your data or a request, please contact us first so that we can try to put it right. You also have the right to complain to the UAE Data Office.

1. Email support@healthcarepractise.com with "Privacy request" in the subject line, from the email address on your account if you can.
2. Say which right you want to use and, if it helps, which data or course it concerns.
3. We may ask you to confirm your identity before we act, so that we never give your data to someone else.
4. We reply without undue delay and within any time limit the law sets. If we cannot do all that you ask, for example because the law requires us to keep certain records, we will explain why.

There is no charge for a request. You can also correct your name and email address yourself from your account.

Cookies are small files a website places on your device. Browser storage (local storage) works in a similar way but stays on your device and is not sent to the website with each request.

You can also delete or block cookies through your browser settings. Doing so may stop parts of the website from working.

Our courses are for qualified healthcare professionals and students of the health professions aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We will update this policy when our services or the law change. The current version is always on this page, with the date it was last updated. If we make a significant change that affects how we use your data, we will also tell you by email.

Email support@healthcarepractise.com with "Privacy" in the subject line, or write to us through the contact page.