Privacy Policy
Fit 2 Practise ("we", "us", "our") supports nurses, midwives and other healthcare professionals in the UK through online courses, resources, mentorship and CV writing. We know that people often come to us at a difficult and sensitive time, so we collect only what we need, keep it secure and never sell it or share it for anyone else's marketing. This policy explains what we collect, why, who helps us process it, how long we keep it and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who we are
Fit 2 Practise is the data controller for the personal information described in this policy. You can contact us about anything in it at hello@fit2practise.com.
Information we collect
When you create an account
- Required: your first and last name (printed on your course certificates), email address and a password. Your password is stored only in a securely hashed form; we can never see it.
- Optional: your profession, regulator, registration PIN, service area, workplace or employer, region, phone number, date of birth, how you heard about us and anything you add in "About you". You choose whether to give these, and you can change or remove them at any time on your profile.
- A record that you agreed to our terms and this policy, and whether you asked to receive marketing emails.
When you learn with us
- The courses and resources you have bought or been given access to, your progress through each course, quiz results and completion dates.
- Certificates we issue to you, including a unique certificate ID that lets an employer or panel confirm the certificate is genuine.
When you buy something
- Payments are handled by Stripe. We receive your name, email address, what you bought, the amount and the payment status. We never see or store your full card details.
When you contact us, book mentorship or order a CV
- The details you enter in our contact form or CV order form, and anything you send us by email or share in mentoring sessions.
- This may include information about your Fitness to Practise case, your health or other sensitive matters. We only process this because you choose to share it with us, and only to support you. We treat it as strictly confidential.
Accounts moved from our previous website
If you had an account on our previous website, we moved your name, email address, course access, progress, completion dates, quiz results and order history to this website so you keep everything you had. We also moved your old password in its encrypted form only so that you can sign in as before; it is replaced by your new-site password the first time you sign in and then deleted.
How we use your information and our lawful bases
| What we do | Lawful basis |
|---|---|
| Create and run your account, give you access to courses and resources, save your progress and issue certificates | Contract: we need it to provide what you signed up for or bought |
| Take payment, issue receipts and keep financial records | Contract and legal obligation (tax and accounting law) |
| Reply to your messages, provide mentorship and write your CV | Contract, or our legitimate interest in answering enquiries |
| Use the optional details you give us to tailor support and recommendations and to understand who we help | Your consent, which you can withdraw by removing the details from your profile |
| Health or other special category information you choose to share with us | Your explicit consent |
| Send you tips, news and offers by email | Your consent (you can unsubscribe at any time) |
| Send service emails such as password resets, receipts and certificates | Contract |
| Keep the website secure, prevent fraud and fix problems | Our legitimate interests |
We do not use your information for automated decision-making or profiling, and we do not use advertising or tracking tools.
Who we share it with
We use a small number of trusted service providers ("processors") who handle data on our behalf, under contract, and only on our instructions:
- Supabase: secure database and account sign-in.
- Vercel: website hosting.
- Stripe: card payments.
- Resend: sending account and certificate emails.
- Formspree: delivering contact and CV order forms to our inbox.
- Google Workspace: our business email.
- Vimeo or YouTube: course videos, which load only when you press play inside a course.
Some of these providers may process data outside the UK. Where they do, the transfer is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. We will only otherwise share your information if the law requires it, or to protect someone's safety.
How long we keep it
- Your account, learning records and certificates: for as long as you have an account, so you keep lifetime access. If you ask us to delete your account we will delete these, except that we may keep a certificate's ID, name, course and date so that we can still confirm it is genuine if someone checks it, unless you ask us not to.
- Payment and order records: six years, as UK tax law requires.
- Enquiries, mentoring notes and CV orders: up to two years after our last contact, unless you ask us to delete them sooner.
How we protect it
All traffic to this website is encrypted (HTTPS). Your data is stored in a secured database where each person can only see their own records, and only our authorised administrators can see learner records. Passwords are hashed and never visible to us. We limit access to people who need it to support you.
Cookies and local storage
We only use storage that is strictly necessary for the website to work, such as keeping you signed in and remembering your basket. We do not use advertising, analytics or tracking cookies. Our cookie policy lists exactly what we store.
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct anything that is wrong (you can update most details yourself on your profile);
- ask us to delete your information;
- ask us to restrict or stop using your information, or object to how we use it;
- receive your information in a portable format;
- withdraw your consent at any time, for example by unsubscribing from emails or removing optional details.
To use any of these rights, email hello@fit2practise.com. We will reply within one month. There is no charge.
Complaints
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
Our services are for adult healthcare professionals and students. We do not knowingly collect information from anyone under 16.
Changes to this policy
We will update this policy when how we use information changes. The date at the top shows when it was last updated. If a change is significant, we will tell account holders by email.