Privacy Policy

1. Who we are

Core & Oak provides online continuing professional development, downloadable resources, articles and professional learning materials for healthcare professionals.

For UK data protection purposes, the controller is:

Legal controller: Dr Michael McCluskey trading as Core & Oak Professional Development

Trading name: Core & Oak

Business address: 3 Ardmore Close, Derryadd, Craigavon, County Armagh, BT66 6SB

Email: info@coreandoak.com

Public website: https://coreandoak.com

Learning platform: https://learn-coreandoak.thinkific.com

This policy applies to personal information processed through the Core & Oak WordPress website, the Thinkific learning platform, payment and email services, free-resource delivery, enquiries, course enrolment and related administration.

2. Information we collect

• Identity and contact details, such as your name and email address.
• Account details and login information for the learning platform.
• Course enrolment, access, progress, completion and certificate information.
• Purchase and transaction information, including the product purchased, amount, date and payment status.
• Free-resource requests and communication preferences.
• Messages, support requests, complaints, survey responses, feedback and reviews you choose to provide.
• Technical and usage information, such as IP address, browser, device, referral source, pages viewed and interactions, where collected by WordPress, Thinkific, security tools, analytics or similar technologies.
• Subscription, follower and marketing-preference information where you opt in through WordPress, Thinkific or another Core & Oak service.
• Contact-form information and any attachments or other information you submit.

Please do not submit patient-identifiable information, confidential service information or sensitive clinical information through forms, emails, comments, reflections, assignments or messages.

3. How and why we use personal information

We use personal information only where we have a lawful basis under UK data protection law.

Providing courses, downloads and learner accounts

We use identity, contact, account, enrolment, progress and completion information to provide courses, digital resources, learner access, certificates and related services. Our lawful basis is normally performance of a contract, or taking steps at your request before entering into a contract.

Processing purchases and maintaining financial records

We use identity, contact and transaction information to process payments, confirm purchases, administer refunds and maintain accounting, tax and business records. Our lawful bases are performance of a contract and legal obligation.

Responding to enquiries, support requests and complaints

We use contact details, correspondence and related account or purchase information to respond to enquiries, provide learner support, investigate complaints and resolve disputes. Our lawful bases are normally legitimate interests, performance of a contract or legal obligation, depending on the circumstances.

Providing essential service communications

We use your contact and account information to send messages about account creation, enrolment, purchases, course access, password resets, security, progress, completion, failed payments, refunds and support. Our lawful basis is normally performance of a contract or legitimate interests in operating and protecting the service.

Sending optional marketing communications

Where you actively opt in, we may use your name, email address, marketing preference and information about the resource or course in which you expressed interest to send occasional emails about relevant Core & Oak learning content, professional-development opportunities, course launches and offers. Our lawful basis is consent. You can withdraw consent at any time.

Improving our website, courses and learner experience

We may use technical, usage, survey, feedback and aggregated information to understand how services are used, improve accessibility and content, measure performance and protect website and platform security. Our lawful basis is normally legitimate interests. Where cookies or similar technologies legally require consent, our lawful basis is consent.

Preventing misuse and protecting security

We may use account, transaction and technical information to prevent fraud, unauthorised access, misuse, security incidents and breaches of our Terms. Our lawful basis is legitimate interests and, where applicable, legal obligation.

Establishing, exercising or defending legal claims

We may use relevant account, transaction, correspondence and complaint information where necessary to establish, exercise or defend legal rights. Our lawful basis is legitimate interests or legal obligation, depending on the circumstances.

4. Marketing communications

Where you actively opt in, Core & Oak may use your name and email address to send occasional marketing communications about relevant learning content, professional-development opportunities, course launches and offers.

Marketing consent is optional. You can access a free resource, create an account or purchase a course without agreeing to receive marketing communications.

Thinkific may record your marketing preference and send marketing communications on behalf of Core & Oak.

You can withdraw your consent at any time by:

• using the unsubscribe facility provided in a marketing email;
• changing your notification or marketing preferences where available; or
• emailing info@coreandoak.com.

We will stop sending marketing communications after you withdraw consent, although we may retain a minimal suppression record to ensure that your preference is respected.

Essential messages relating to a requested download, account, purchase, course access, security, failed payment, refund or learner support are not marketing communications and may still be sent where necessary.

We do not currently use a separate third-party newsletter platform. If that changes, this Privacy Policy will be updated.

5. Cookies, analytics and similar technologies

The WordPress website and Thinkific learning platform may use cookies, web storage, pixels, scripts and similar technologies for purposes including:

• essential website and platform operation;
• account sign-in and security;
• fraud and misuse prevention;
• remembering preferences;
• measuring website and platform use;
• analytics and service improvement; and
• marketing, where enabled and consented to.

Strictly necessary technologies may be used without consent where permitted by law.

Where consent is legally required, non-essential technologies will not be activated until you have made a valid choice. You will be given information about the relevant purposes and, where available, can reject non-essential technologies or change your preferences later.

The precise technologies used depend on the services and features enabled on WordPress, Thinkific and connected providers. Further details may be provided through the live cookie banner, preference centre or a separate Cookie Notice.

6. Service providers and recipients

We use selected service providers to operate Core & Oak. They may process personal information on our behalf or, in some circumstances, as independent controllers.

These currently include:

• Automattic and WordPress.com, for website hosting, operation, security, subscriptions and website statistics where enabled;
• Thinkific, for learner accounts, course delivery, digital downloads, enrolment, course progress, certificates, checkout, marketing preferences and automated account or course communications;
• Stripe, for payment processing and related transaction services;
• Google, through Gmail, for receiving, storing and responding to enquiries, learner support, complaints and other business correspondence;
• cloud storage, bookkeeping, accounting and administrative service providers where used;
• professional advisers, including accountants, insurers or legal advisers; and
• public authorities, regulators, courts or law-enforcement bodies where disclosure is legally required or reasonably necessary.

We disclose only the information reasonably required for the relevant purpose.

We do not sell personal information.

7. International transfers

Some providers used by Core & Oak may process personal information outside the United Kingdom.

Where this involves a restricted transfer under UK data protection law, we will rely on an appropriate legal mechanism. This may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another safeguard permitted by law.

You can request further information about the safeguards relevant to your personal information by emailing info@coreandoak.com.

8. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, tax, professional and dispute-resolution requirements.

The periods or criteria we normally apply include:

• Learner accounts, enrolment and access records: while the account or access remains active and for a reasonable period afterwards to administer learning records, respond to queries and manage disputes.
• Course progress, completion and certificate records: for as long as reasonably needed to support learner records, verify completion and respond to related enquiries.
• Purchase, payment and accounting records: for the period required by applicable tax, accounting and legal obligations.
• Free-resource records: for as long as needed to deliver the resource and administer any marketing preference.
• Marketing consent records: while consent remains valid and afterwards for as long as reasonably necessary to demonstrate how and when consent was obtained.
• Marketing suppression records: for as long as needed to ensure that an unsubscribe or objection continues to be respected.
• Enquiries and learner-support correspondence: for as long as needed to resolve the matter and manage any reasonable follow-up.
• Complaints and disputes: until the matter is resolved and for a reasonable period afterwards in case further action is required.
• Technical, security and analytics information: according to the purpose, risk and retention settings of the relevant service.

We periodically review retained information and delete or anonymise it when it is no longer reasonably required.

9. Security

We take proportionate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction.

These measures may include access controls, secure service providers, password protections, software updates, backups, data-minimisation practices and appropriate business procedures.

No online system can be guaranteed to be completely secure. You are responsible for protecting your login credentials and should contact us promptly if you believe your account or information has been compromised.

10. Your data protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal information is used;
• request access to the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request erasure where the legal conditions are met;
• request restriction of processing where the legal conditions are met;
• object to processing based on legitimate interests;
• object at any time to the use of your personal information for direct marketing;
• request transfer of information in a portable format where applicable;
• withdraw consent at any time where processing is based on consent; and
• complain to Core & Oak or the Information Commissioner’s Office.

These rights are not absolute and may depend on the circumstances, legal basis and applicable exemptions.

To exercise a right, email info@coreandoak.com. We may need to verify your identity before acting on a request.

We normally respond without undue delay and within the statutory time limit. Complex or multiple requests may lawfully take longer where permitted.

11. Data protection complaints

You may make a data protection complaint by emailing info@coreandoak.com with the subject line “Data protection complaint”.

Please explain:

• what happened;
• which information or processing concerns you;
• any relevant dates or correspondence; and
• what outcome you are seeking.

We will acknowledge receipt within 30 days. Without undue delay, we will take appropriate steps to investigate, make relevant enquiries, keep you informed where necessary and communicate the outcome.

You may also complain to the Information Commissioner’s Office. You do not have to complete our internal complaint process before contacting the ICO.

12. Children

Core & Oak courses and services are intended for adults and healthcare professionals.

We do not knowingly offer learner accounts or paid services directly to children. Please contact us if you believe that a child has provided personal information.

13. Automated decision-making

Core & Oak does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects.

This Privacy Policy will be updated if that changes.

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in law, our services, our providers or the ways in which we process personal information.

The current version will be made available through coreandoak.com and the Core & Oak Thinkific learning platform.

Where changes are material, we may provide additional notice through the website, learning platform or email where appropriate.

15. Contact

Data controller Dr Michael McCluskey trading as Core & Oak Professional Development Trading name Core & Oak Address 3 Ardmore Close Derryadd Craigavon County Armagh BT66 6SB Email info@coreandoak.com Data protection complaints Email info@coreandoak.com with the subject line “Data protection complaint”.

Document status: Final operational draft for publication. It should be reviewed whenever services, providers, cookies, marketing practices or legal requirements change.