Privacy Policy

1. Who we are

Nexi Bot LTD ("we", "us", "our") operates the Proven. CPD platform. We are a company registered in England and Wales.

• Trading name: Proven. CPD
• Legal entity: Nexi Bot LTD
• Company number: 16502958
• ICO registration: ZB910034
• Registered address: Suite 627, 80A Ruskin Ave, Welling DA16 3QQ (correspondence only)
• Privacy contact: [email protected]

2. Data we collect

2.1 Account and identity data

• Full name, email address and hashed password
• Professional role (student, NQP, qualified paramedic, practice educator, organisation admin)
• HCPC registration number and registration date (optional, provided by you)
• Organisation or employer name
• Profile photograph (if uploaded)

2.2 Professional portfolio data

• CPD activity logs: dates, activity types, descriptions, learning outcomes and hours
• Reflective accounts (Gibbs' Cycle or Borton's model)
• Placement records: shift dates, hours, clinical settings and supervisor details
• Skill assessment forms and digital proficiency sign-off records
• Uploaded evidence documents (certificates, photographs, feedback forms)
• HCPC standard tags linked to CPD entries
• Mentor and Practice Educator relationships

2.3 Technical and usage data

• Login timestamps and session tokens
• IP address and approximate geographic location (country/region)
• Device type, browser and operating system
• Pages visited and features used within the platform
• Error logs and performance diagnostics

2.4 Communications data

• Support emails and messages you send us
• Forum posts and peer discussion content (visible to other registered users)
• Survey and feedback responses

2.5 Data we do NOT collect

We do not collect or store patient-identifiable information. Reflective accounts must be written in anonymised form in line with your professional obligations. You are solely responsible for ensuring no patient data is included in your portfolio entries.

3. How we use your data

• Platform delivery: Account creation, authentication, portfolio management, PDF generation and sign-off workflows.
• Personalisation: Role-based configuration, HCPC requirement calculation and relevant feature surfacing.
• Communications: Transactional emails (account verification, password resets, sign-off notifications) and CPD deadline reminders.
• Security: Fraud prevention, abuse detection and access control.
• Platform improvement: Analysis of anonymised or aggregated usage patterns to improve features and fix issues.
• Legal compliance: Responding to lawful requests from regulators, courts or law enforcement.
• Organisation services: Where you are enrolled by an organisation, we share your progress data with authorised administrators and Practice Educators as instructed by that organisation (who act as the data controller for those processing activities).

4. Legal bases for processing (UK GDPR)

• Contract — Article 6(1)(b): Processing necessary to provide the Platform under our Terms of Service.
• Legitimate interests — Article 6(1)(f): Security monitoring, fraud prevention, platform improvement and direct marketing to existing users (with opt-out available at any time).
• Legal obligation — Article 6(1)(c): Compliance with applicable law, including HMRC obligations and lawful law enforcement requests.
• Consent — Article 6(1)(a): Optional analytics cookies and optional marketing communications. Consent may be withdrawn at any time without affecting prior processing.

5. Sharing your data

We do not sell your personal data. We may share it with:

• Organisation administrators and Practice Educators: Where you are enrolled via an organisation account, authorised staff can view your portfolio and progress data.
• Service providers (data processors): Cloud hosting (UK-based), email delivery, analytics and payment processing — all subject to UK GDPR-compliant data processing agreements.
• Professional bodies: Only at your explicit request when you submit your own exported PDF portfolio.
• Law enforcement and regulators: Only where required by law, court order, or to protect safety.
• Business transfers: In a merger, acquisition or asset sale, successor entities will be subject to equivalent data protection obligations.

6. Data retention

• Account data: Duration of account plus 3 years after deletion.
• Portfolio data (CPD logs, reflections, placements): Duration of account. 30-day export window after account deletion before permanent erasure.
• Proficiency sign-off records: 7 years from date of sign-off.
• Support communications: 3 years.
• Technical logs: Up to 12 months.
• Financial records: 7 years (HMRC requirement).

7. Your rights

Under the UK GDPR and the Data Protection Act 2018, you have the right to:

• Access (Article 15): Obtain a copy of your personal data.
• Rectification (Article 16): Correct inaccurate or incomplete data.
• Erasure (Article 17): Request deletion, subject to legal retention requirements.
• Data portability (Article 20): Receive your data in a structured, machine-readable format.
• Object (Article 21): Object to processing on the grounds of legitimate interests, including direct marketing.
• Restrict processing (Article 18): Limit how we use your data while a dispute is resolved.
• Automated decisions (Article 22): We do not make solely automated decisions that produce legal or similarly significant effects on you.

To exercise any of these rights, email [email protected]. We will respond within one calendar month. Identity verification may be required.

8. Cookies

We use cookies and similar technologies on the Platform. See our full Cookie Policy for details. You can manage your cookie preferences via our Cookie Settings at any time.

9. International transfers

We store your data on UK-based servers. Some service providers may process data outside the UK or EEA. Where such transfers occur, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or UK Standard Contractual Clauses. Contact us for details of safeguards applicable to specific transfers.

10. Children

The Platform is intended for individuals aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe we hold data about a child under 16, contact [email protected] and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes by email or Platform notice at least 14 days before they take effect. The "Last updated" date at the top indicates when this policy was last revised.

12. Contact & complaints

For any privacy queries or to exercise your rights, contact us at:

• Email: [email protected]
• Post: Proven. CPD / Nexi Bot LTD, Suite 627, 80A Ruskin Ave, Welling DA16 3QQ

If you are unsatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow SK9 5AF