Loading
Some images are illustrations created with AI
Version 2.0, 6 October 2026. What we hold, why, who we share it with, how long we keep it, and your rights.
We are Chronix Health Group Ltd. We run the Chronix Health Library, and we are responsible for the information it holds about you.
Chronix Health Group Ltd is the controller for the Chronix Health Library. Registered in England and Wales, company number 16663224. Registered office: 11-13 Upper High Street, Epsom, Surrey, KT17 4QY, United Kingdom. Registered with the Information Commissioner's Office, reference ZB962513.
Contact: support@careworld.app for anything about your account or this notice; privacy@careworld.app for a data-rights request. We have no Data Protection Officer. We have assessed whether the law requires one and it does not at present; our Director leads on privacy and we will assess again as the Library grows.
The Library is one of several Chronix Health products. Your Chronix Health account is one account that keeps you logged in across Kithra Vault, Care World and the Library, for the products you join; what you do in the Library stays in the Library and is not shared with another product unless you choose to share it. (A completed course can appear on your Care World profile only if you have a Care World profile and the course's certificate page says so; it never changes where you appear or who can find you.)
You give us this
Our systems record this when you use the Library
See the table. The bases are those in Article 6 of the UK GDPR.
| What we do | Why | Basis | Why |
|---|---|---|---|
| Give you your account, enrol you, show your progress, mark exams, issue and verify certificates | To deliver the course you signed up for | Contract — Art 6(1)(b) | It is the service itself. |
| Take payment, issue receipts, handle refunds, keep payment records | To be paid, and to meet our accounting duties | Contract (Art 6(1)(b)) for the sale; legal obligation (Art 6(1)(c)) for the records — Companies Act 2006 s.386–388 and HMRC, usually 6 years | The law requires the records. |
| Send you service emails: your receipt, your certificate, a failed-payment notice, a renewal notice, a change to your account or to these terms | You need to know these things to use and pay for the service | Contract (Art 6(1)(b)); the renewal notice is also a legal notice | These are not marketing, so they do not depend on the optional-emails switch. |
| Send optional emails (reminders to carry on, suggestions of the next course) | To help you finish what you started | Legitimate interests — Art 6(1)(f), with the soft opt-in for existing customers (PECR reg 22(3)); one tap turns them off | No consent banner is needed for a customer's own similar service; the off switch and the unsubscribe link are in every email. |
| Marketing about anything else | — | Consent — Art 6(1)(a). We send none unless you opt in. | — |
| Keep the Library secure: sign-in records, spotting abuse and fraud | To protect your account and ours | Legitimate interests — Art 6(1)(f) | A short record of sign-ins protects you and costs you little. |
| Answer your questions with the assistant | You asked | Legitimate interests — Art 6(1)(f) | You start it and you can stop. It makes no decision about you. |
| Handle a complaint, a data request or a safeguarding report | To meet our duties and keep people safe | Legal obligation (Art 6(1)(c)) for complaints and data rights (DPA 2018 s.164A); legitimate interests for safeguarding | |
| Count visits without identifying anyone | To see which pages are used | No personal data is held (the records carry no identifier). Cookie-based analytics, if we ever add them, only with your consent | |
| Necessary cookies (sign-in, security, payment) | To run the service | Strictly necessary — exempt from consent under PECR reg 6(4) | We use no advertising or tracking cookies. |
Nobody makes a decision about you by computer alone that has a legal or similarly significant effect on you. Your exam is marked automatically against a fixed answer key; you can retake it, and a person looks at anything you ask us to look at.
We use companies that only handle your information to provide their service to us, under a contract:
| Who | What for | What they handle | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Everything in section 2 | London |
| Vercel | Hosting the website | Your requests while the page is served; not stored by us as care or account content | Global edge network |
| Stripe | Taking payments and refunds | Your payment details (we never see your card), email and what you bought | United States (Stripe, LLC), and Stripe's own group companies and suppliers elsewhere; Stripe publishes where (read from Stripe's data processing agreement, 6 Oct 2026) |
| Resend | Our service and optional emails | Your email address and the email's content | Sent from the EU (Ireland, region eu-west-1; read from Resend's domain settings, 6 Oct 2026); Resend is a US company |
| Amazon SES | The emails that confirm your sign-in and reset your password | Your email address and the email's content | Amazon Web Services, a US company; the region is set in our account and is not part of what you can see or choose |
| Anthropic | The assistant | What you type or paste to it and the subject; never your name, email or account details | United States |
| Google (Google Workspace) | Our support mailbox | What you email to us | Google's own infrastructure; we have not set a data region (the edition we use does not offer one) |
| Cloudflare | DNS for our domains | No personal data; DNS lookups only | Global |
We do not sell your information. We share it with a regulator, the police or a court only where the law requires us to, or to keep someone safe.
Sending information outside the UK. Where a company above is outside the UK, or can reach information from outside the UK, we rely on the safeguard written into the company's own data-processing terms with us, read from each company's published terms on 6 October 2026: Stripe, the standard contractual clauses with the UK Addendum, or the UK–US data bridge; Amazon SES, the standard contractual clauses with AWS's UK GDPR Addendum, which is part of its service terms; Google, the standard contractual clauses in its Cloud Data Processing Addendum, which we accepted on 26 July 2026; Resend and Anthropic, the standard contractual clauses with the UK Addendum in their data-processing terms. Supabase holds our database in London. You can ask us for a copy of the safeguard that applies.
| What | How long | Why |
|---|---|---|
| Your account, enrolments, lesson progress and certificates | While your account is open | It is the service you asked for. |
| If you delete your account | Deletion is effective 30 days after you ask (you can cancel in that time). Then: your exam answers are removed, and the link to each certificate file is removed; your name is removed from your purchases, which stay as financial records. Your enrolments and lesson progress are kept without a name: when the deletion takes effect your account is emptied of your name, email address, phone number, password and profile details, and those records then point only to an empty account that nobody can sign in to. | The erasure plan on the database (read 6 Oct 2026): assessment_attempts answers nulled; certificates.certificate_url nulled; course_purchases tombstoned; enrolments and lesson_progress retained. |
| Payment and refund records | Usually 6 years | Companies Act 2006 s.388; HMRC. |
| Sign-in and security records (the audit trail) | 12 months (longer only where a legal hold, a safeguarding matter or an accounting duty applies to a particular record) | UK GDPR Art 5(1)(e): long enough to investigate a security incident and an ordinary complaint. |
| Records that an email was delivered | 60 days | Evidence that a message reached you; no longer needed after that. |
| Your express request that a paid course or a Pass starts straight away | 6 years | The record that you made the request (Consumer Contracts Regulations 2013 reg 36), which we need if a refund is disputed. |
| Visit statistics | 12 months | They hold no identifier. |
| A scrambled copy of an email address, to stop the sign-up form being misused | Up to 15 minutes | Abuse prevention; it cannot be turned back into the address. |
| A sign-up you never confirmed | Deleted 30 days after you signed up (one reminder on day 7) | You never became a user. |
| Support messages, problem reports and complaints | 6 months after they are closed | To answer you and to show we answered (the company's retention schedule v3.2, rows 16 to 18). |
| Your cookie choices | As long as the law requires us to prove a choice | An append-only record of your consent. |
After these periods we delete or anonymise the information.
Under the UK GDPR you can:
To get a copy, use Export my data from Your account — one file, straight away, no email needed. For the other rights, email privacy@careworld.app.
Providing your name and email is needed for us to give you a course and a certificate; if you do not, we cannot. Nothing else in section 2 is a legal or contractual requirement of yours.
We use a small number of necessary cookies: the sign-in cookie that keeps you signed in across the Chronix Health products you have joined, and cookies our payment and hosting providers need to take payments and serve pages. We do not use advertising or tracking cookies. You can change your choice at any time: Cookie settings.
If we change this notice we update this page and, for a change that matters to you, tell you by email before it applies. The version and date are at the top.
See also our Terms of service and Refund policy.
Change your cookie choice at any time: