1. Who we are

Booking Hub is operated by the organisation that runs this service for you (for example your employer, NHS organisation, or training partner). If you are unsure who is responsible for your data, contact the team that gave you access to Booking Hub.

2. Information we collect

Depending on how you use Booking Hub, we may process categories such as:

• Identity and contact details (for example name, email address, and phone number) when you register, book, or are invited to an account.
• Account and security information such as login identifiers and session data needed to keep you signed in securely.
• Booking and course information such as courses you view or book, attendance where recorded, and related notes or health education data your organisation has configured the service to collect.
• Technical data such as IP address and browser type where needed for security, troubleshooting, or audit logs.

3. How we use your information

We use personal information to:

• Provide the booking service, accounts, and role-based admin features you are entitled to.
• Manage courses, sessions, educators, and patients or learners as configured for your site.
• Keep the platform secure, prevent abuse, and meet legal and regulatory obligations.
• Communicate with you about bookings, access, or service changes where appropriate.

Where UK or EU data protection law applies, we rely on appropriate lawful bases such as performance of a contract, legitimate interests (balanced against your rights), legal obligation, or consent where we ask for it separately.

4. Sharing and international transfers

We share information with subprocessors (such as hosting or database providers) only as needed to run Booking Hub, under contracts that require appropriate protection. We do not sell your personal information. Data may be processed in the United Kingdom and, if your organisation uses services hosted elsewhere, in other countries with safeguards such as standard contractual clauses where required.

5. Retention

We keep information only for as long as needed for the purposes above, including legal, accounting, or reporting requirements. Retention periods may depend on your organisation's policies and the type of record.

6. Your rights

Subject to applicable law, you may have rights to access, correct, delete, or restrict processing of your personal data, to object to certain processing, to data portability, and to withdraw consent where processing is based on consent. You may also have the right to lodge a complaint with a supervisory authority. To exercise rights, contact your organisation's data protection or privacy contact, or use the account tools your administrator has made available.

7. Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, or destruction. No method of transmission over the Internet is completely secure.

8. Changes

We may update this policy from time to time. The "Last updated" date below will change when we do. Material changes may be communicated through the service or by your organisation.