Privacy

[Draft for attorney review. Not in force until reviewed.]

[Training entity name] operates bloodbornecert.com. This page describes what we collect, why, and who else sees it.

What we collect

• Account and certificate data: your name, email address, course progress, test answers and scores, and certificates issued.
• Purchase data: amount, date, and a Stripe reference. Card details are entered on Stripe's page and never reach our servers.
• Employer data: organization name, the purchaser's email, seat codes, and email addresses the purchaser enters to invite staff.
• Support messages you send us.
• Visit data: the page you first arrived on, the referring site, and campaign tags in the link (for example utm_source or a Google Ads click ID), stored in a first-party cookie for 90 days and attached to any purchase. If enabled, Google Analytics and Google Ads measure visits and purchases, and Cloudflare Web Analytics counts page views without cookies.

How we use it

To deliver the course, issue and verify certificates, send transactional email (sign-in links, receipts, certificates, seat invitations, and a reminder 30 days before your retrain date), answer support requests, prevent fraud, and measure which pages and ads lead to purchases. We do not sell personal data and do not send marketing email without consent.

Who sees it

• Anyone with your verification number can see your name, the course, completion and retrain-by dates, and whether the certificate is valid or revoked. Nothing else.
• Your employer, if you redeemed a seat they bought: your name, email, progress, certificate number and dates.
• Service providers who process data for us: Stripe (payments), Cloudflare (hosting, database, file storage), Resend (email delivery), and Google (analytics and ads measurement, if enabled).
• Authorities, where required by law.

Retention

Employers must keep bloodborne pathogens training records for three years, so we keep certificate and training records for at least five years after completion to keep them verifiable. Other data is kept while your account is active and deleted or de-identified when no longer needed.

Your choices

You can ask to see, correct or delete your data through the support page. We will correct errors promptly. Deleting a certificate record ends its verification; if an employer relies on it, we may keep the minimum needed to answer verification requests for the retention period above. You can block analytics cookies in your browser without affecting the course.

Children

The service is intended for adults in the workforce and is not directed to children under 16.

Changes and contact

We will post changes here with a new date. Questions: use the support page.

Last updated: [date on publication]