Privacy Policy

1. Introduction

IRR Practice ("IRR Practice", "we", "us", or "our") provides structured CPD remediation courses for UK healthcare and care professionals through the website irrpractice.co.uk (the "Site"). This Privacy Policy explains, in full, what personal information we collect from you, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have over it.

We have written this policy to be as clear and complete as possible, because we know the people using this Site are often doing so at a stressful time, working through a fitness-to-practise or performance process. If anything here is unclear, please contact us using the details in Section 15 and we will explain it in plain language.

By using the Site, creating an account, enrolling on a course, or otherwise providing us with personal information, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

IRR Practice is the data controller responsible for your personal information for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please replace the bracketed details above with your actual company registration information before publishing this page, so the policy is legally accurate and complete.

3. Information We Collect

We collect information in three ways: information you give us directly, information we collect automatically when you use the Site, and information we receive from third parties (such as payment processors).

3.1 Information you give us directly

• Account and registration details: full name, email address, password (stored in encrypted/hashed form), and, where relevant to your course, your profession, regulator, and registration or PIN number.
• Course and case-related information: details you choose to include in reflective statements, learning logs, assessment answers, or messages to us that relate to your remediation, fitness-to-practise case, or performance review. This can include sensitive information about your professional conduct, health, or the circumstances of your case, which you provide voluntarily.
• Payment information: billing name, billing address, and payment details. Full card details are collected and processed directly by our payment processor and are not stored on our own servers (see Section 7).
• Communications: anything you send us through contact forms, email, live chat, or telephone, including the content of your message and any attachments.
• Marketing preferences: whether you have opted in or out of receiving marketing emails from us.

3.2 Information collected automatically

• Technical data: IP address, browser type and version, device type, operating system, time zone, and referral source.
• Usage data: pages viewed, links clicked, time spent on pages, course progress, quiz results, and completion status.
• Cookies and similar technologies: as described in Section 6.

3.3 Information from third parties

• Confirmation of successful payment from our payment processor (e.g. Stripe, PayPal, or WooCommerce Payments).
• Delivery/read confirmations from our email service provider, where available.
• Where applicable, information from analytics providers such as Google Analytics.

4. How We Use Your Information

We use your personal information for the following purposes:

5. Our Legal Basis for Processing

Under UK GDPR, we must have a valid legal basis for each way we use your information. We rely on the following:

• Contract: to create your account, give you access to a course you have purchased, and process your payment, because this is necessary to fulfil our contract with you.
• Legitimate interests: to keep the Site secure, understand how our courses are used, and improve our services, where this does not override your own rights and freedoms.
• Consent: for optional marketing communications and non-essential cookies, which you can withdraw at any time.
• Legal obligation: to keep financial records for tax and accounting purposes.

Where you submit sensitive information as part of a reflective statement or case-related content (for example, details about a health condition connected to your case), you are providing this to us voluntarily and we treat it as information provided with your explicit consent, used only for the purpose of assessing and supporting your course completion.

6. Cookies and Tracking Technologies

Cookies are small text files placed on your device when you visit the Site. We use the following categories of cookies:

• Strictly necessary cookies: required for core functionality such as logging in, staying logged in while you complete a course, and processing payment through our shopping cart. These cannot be switched off.
• Performance and analytics cookies: help us understand how visitors use the Site (e.g. Google Analytics), so we can improve course content and site navigation.
• Functionality cookies: remember your preferences, such as your progress through a course, so you do not have to start again.
• Marketing cookies: used only where you have given consent, to measure the effectiveness of any advertising.

You can control or delete cookies through your browser settings at any time. Please note that blocking strictly necessary cookies may prevent you from logging in or completing a course.

7. How We Share Your Information

We do not sell your personal information. We share it only with third parties who help us run the Site and deliver our courses, and only to the extent necessary. These include:

• Payment processors (such as Stripe, PayPal, or your bank's card processor), to securely handle payment for courses. We do not store full card numbers on our own systems.
• Website and course hosting providers, who store the Site and your course data on our behalf, under contracts that require them to protect it.
• Email service providers, to send you order confirmations, course communications, and certificates.
• Learning management and e-commerce plugin providers, which power course delivery, progress tracking, and the shopping cart.
• Analytics providers (such as Google Analytics), to help us understand Site usage, where cookies for this purpose have been consented to.
• Professional advisers such as accountants or legal advisers, where reasonably necessary.
• Regulatory or law enforcement bodies, only where we are legally required to disclose information, or to protect our rights, property, or safety, or that of others.

We do not share the content of your reflective statements, learning logs, or case-related submissions with any regulator or third party on your behalf. Any submission of your certificate or course evidence to your regulator or employer is your own responsibility, unless we have explicitly agreed otherwise with you in writing.

8. How Long We Keep Your Information

We keep personal information only for as long as necessary for the purposes described in this policy:

• Account and course data: for as long as your account remains active, and for a reasonable period afterwards so you can regain access to your certificates and course history.
• Payment and invoicing records: for the period required by UK tax law, generally up to 6 years.
• Marketing preferences: until you unsubscribe or withdraw consent, at which point we retain a minimal record to ensure we do not contact you again.
• Support communications: for a reasonable period to allow us to handle any follow-up queries or complaints.

When information is no longer needed, we securely delete or anonymise it.

9. Your Rights

Under UK GDPR, you have the following rights in relation to your personal information:

• Right of access: to ask us for a copy of the personal information we hold about you.
• Right to rectification: to ask us to correct any information that is inaccurate or incomplete.
• Right to erasure: to ask us to delete your personal information, where there is no legal reason for us to keep it (for example, this does not override our obligation to retain financial records).
• Right to restrict processing: to ask us to limit how we use your information in certain circumstances.
• Right to data portability: to ask us to provide your information in a structured, commonly used, machine-readable format, or to transfer it to another organisation.
• Right to object: to object to our use of your information where we rely on legitimate interests, or to object to direct marketing at any time.
• Right to withdraw consent: where we rely on your consent (for example, for marketing emails or non-essential cookies), you can withdraw it at any time.

To exercise any of these rights, contact us using the details in Section 15. We will respond within one month, as required by law. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your information properly.

10. Payments, Course Completion & Refunds

This section explains, in full, how payment, course access, and refunds work, so there is no ambiguity before you enrol.

All courses on this Site are digital products, delivered instantly online once payment has been confirmed. Because access to course content, learning materials, and assessments is granted immediately on purchase, standard consumer "cooling-off" refund rights that apply to physical goods do not apply in the same way once a course has been engaged with.

10.1 Before you start a course

If you have purchased a course but have not yet started it, or have completed only part of it, please contact us as soon as possible if you wish to discuss a refund. Requests are considered on a case-by-case basis and are not guaranteed.

10.2 Why this policy exists

This policy exists because, once a course is completed, you have received the full value of the digital content and materials, and a certificate has already been issued that may have been submitted as evidence to a regulator, employer, or other third party. It would not be reasonable for us to offer a refund on a service that has already been fully delivered and used.

10.3 Payment security

Payments are processed securely through our third-party payment processor. We do not store your full card details on our own servers. Please refer to Section 7 for more detail on how payment providers handle your information.

10.4 Bundle purchases

Where multiple courses are purchased together as a bundle, the same non-refundable condition applies individually to each course within the bundle once that specific course has reached 100% completion, even if other courses in the bundle remain incomplete.

If you have any questions about this policy before enrolling, please contact us first at info@irrpractice.co.uk — we would rather answer your questions upfront than deal with a dispute afterwards.

11. Children's Privacy

The Site and our courses are intended for use by adult healthcare and care professionals, and are not directed at children. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected such information, we will delete it promptly.

12. International Data Transfers

Some of the third-party providers we use (for example, hosting, payment, or analytics providers) may store or process information outside the United Kingdom. Where this happens, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement, an adequacy decision, or equivalent standard contractual clauses, so that your information continues to receive a comparable level of protection.

13. Data Security

We take the security of your personal information seriously and use appropriate technical and organisational measures to protect it, including:

• Encrypted connections (HTTPS/SSL) across the Site.
• Secure, hashed storage of account passwords.
• Restricted access to personal information, limited to staff who need it to do their job.
• Use of reputable, PCI-compliant payment processors for handling card payments.
• Regular software and security updates to the Site and its plugins.

No method of transmission over the internet or electronic storage is 100% secure. While we work hard to protect your information, we cannot guarantee its absolute security.

14. Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or in how we operate the Site. Any changes will be posted on this page with an updated "Last updated" date at the top. We encourage you to review this page periodically. Continued use of the Site after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy, how we use your personal information, or wish to exercise any of your rights, please get in touch: