Privacy Policy

Last updated: 7 October 2026

1. Who we are

ArtAICare Academy is responsible for the personal information described in this policy. It covers our Academy website, training purchases, learner workspaces, teaching activities, support and certification.

ArtAICare Academy
Contact address: 11 avenue du Rock'n'Roll, 4361 Esch-sur-Alzette, Luxembourg
R.C.S. Luxembourg n° B 303 899
Business Licence n° 10189529 / 0 and 10189529 / 1
VAT number: LU37347026
Privacy contact: info@artaicare.academy
Telephone: +352 4666449732
Website: https://www.artaicare.academy

Separate use of the ArtAICare therapy platform is governed by the privacy information and agreements provided for that service.

2. Information we collect

Depending on your interaction with the Academy, we process:

• Registration information: name, email address, country, selected programme, cohort and relevant professional information.

• Purchase information: billing details, order references, invoices, payment status and membership discount eligibility.

• Learning information: attendance, workbook submissions, coursework, assessments, feedback, completion and certificate records.

• Communications: enquiries, support requests and messages about your training.

• Technical information: account activity, IP address, browser or device information, connection events and security logs.

• Recorded contributions: your image, voice, display name or shared work where captured in a teaching recording under the arrangements explained before the session.

We obtain information directly from you and through your use of our website and learning environment. If an employer or institution enrols you, it may provide your name, work contact information and programme assignment. We provide privacy information when first contacting you or within the applicable information deadline.

Your name, working email address and necessary purchase details are required to administer your enrolment. Without them, we cannot deliver the booked training.

3. Why we use your information

We use personal information to:

• Confirm purchases and administer enrolment.

• Contact you one week before scheduled training and arrange your workspace.

• Share joining instructions and pre-course materials.

• Deliver teaching, replays, workbooks and learning resources.

• Review coursework, assess completion and issue certificates.

• Provide support and resolve complaints.

• Maintain security and prevent misuse.

• Meet accounting, tax and other legal obligations.

Where you are the contracting participant, necessary training administration relies on performance of the training contract. Institutional enrolments may rely on our legitimate interest in delivering the agreed programme to the designated learners.

Accounting and legally required records rely on legal obligations. Proportionate security, fraud prevention and service troubleshooting rely on our legitimate interests in protecting participants and maintaining reliable services.

Optional marketing, publicity and research participation rely on consent or another lawful basis explained separately before the activity. Information is not repurposed for an unrelated use without an appropriate legal basis and notice.

4. Private hosting and security

Academy learning workspaces, coursework, teaching recordings and internal learning activities are hosted within ArtAICare’s private server environment, administered by ArtAICare.

We use the same security assessment and data protection protocols applied to the ArtAICare therapy platform at https://therapy.artaicare.com.

These protocols follow ArtAICare’s independent security assessment against ISO/IEC 27001 and SOC 2 control frameworks and address GDPR, UK GDPR, HIPAA requirements where applicable, and relevant EU AI Act obligations.

Our safeguards include controlled access, encryption, infrastructure security, monitoring and incident response procedures. Access to learner information is limited according to role and operational need.

Academy education does not require identifiable patient information. Applying platform security protocols does not authorise uploading clinical records into training activities.

5. Website and payment services

Our public Academy website and shop use Hostinger, and payments are processed through Stripe.

These services process website, order or payment information needed for their respective functions. They do not host our Academy learning workspaces, coursework or teaching recordings.

Payment card information is handled through the payment provider. Do not send card numbers by email or through a training workspace.

Relevant providers may process information under our instructions or as independent controllers for their own legal and operational responsibilities.

6. Teaching recordings and participant choice

We record trainer-led teaching to provide the replay access included in your programme. We minimise the capture of participant images, voices, names and private discussions.

Before recording identifiable participant contributions, we explain the intended use and obtain any separate consent required.

You may keep your camera off and use a question or participation method that avoids identifying you in the recording. The available arrangements will be explained before the session.

Private breakouts and sensitive discussions are not recorded unless a separate, appropriate arrangement has been explained and agreed.

Teaching replays are restricted to authorised learners and Academy personnel for the programme. We do not publish your image, voice, artwork or testimonial for marketing, or use it in research, without a separate appropriate permission.

Contact info@artaicare.academy to discuss a recording that identifies you or to withdraw recording consent.

7. Who can access information

Access is limited to the people and organisations necessary for the relevant purpose:

• Authorised Academy staff, trainers and support personnel.

• Other learners who can see your chosen display name or contributions in shared activities.

• Hostinger and Stripe for website, order and payment functions.

• A certificate-awarding institution, including the University of Luxembourg where identified for your programme, receiving the minimum information needed for the award or verification.

• An employer or sponsor receiving attendance or completion information where this arrangement has been disclosed.

• Authorities or professional advisers where legally required or necessary for legal claims.

We do not sell learner personal information or provide participant contact lists for third-party marketing.

8. International participation and processing

Our programmes welcome participants internationally. Private hosting does not remove the need to assess international access or the processing carried out by website and payment services.

Where personal information is transferred outside the European Economic Area, we use an applicable lawful mechanism, such as an adequacy decision or appropriate contractual safeguards, together with additional measures where required.

You may contact info@artaicare.academy for information about relevant transfer arrangements and how to obtain a copy of applicable safeguards.

9. How long we keep information

We retain information according to its purpose and applicable legal requirements.

Learning access: Therapist Accelerator replays and included resources remain available for six calendar months after the scheduled cohort end. Other programmes use the access period stated in their listing.

Coursework and learner administration: retained while needed to deliver training, assess completion, provide agreed support and resolve outstanding learning or service enquiries.

Certificate records: limited identity, programme and award information may be retained while needed to verify issued certificates and meet relevant awarding-body requirements.

Financial records: retained for the periods required by applicable tax and accounting law.

Complaints and legal claims: retained as necessary to resolve the matter and meet applicable legal limitation periods.

Security information: retained for the period necessary to investigate incidents, prevent misuse and maintain service integrity.

Consent and marketing records: retained while needed for the relevant activity, to record withdrawal or to demonstrate the permissions relied upon.

Information is deleted or anonymised when it is no longer needed. Expiry of replay access does not automatically require deletion of legally necessary records. Restricted backup copies are removed through the applicable backup lifecycle and are not available for ordinary use.

10. Patient information and AI activities

Use fictional or genuinely anonymised examples during training. Do not upload identifiable patient records, confidential clinical information or unnecessary sensitive personal data.

Where AI tools are used in learning activities, we explain their purpose and relevant information handling arrangements.

We do not use identifiable learner work to train AI models without a separate lawful and clearly explained arrangement. We do not make enrolment or certification decisions solely through automated processing that produces legal or similarly significant effects.

If you request an accessibility adjustment, provide only the information needed to arrange support. If sensitive information is necessary, we explain the purpose and applicable legal basis before collecting it.

11. Cookies and marketing

Necessary cookies and similar technologies support website functions, checkout, account access and security.

Any non-essential analytics, advertising or similar tracking introduced on the website requires the applicable consent before it operates. Where optional cookies are used, you may manage your choices through the website’s consent controls. Browser settings also allow you to control cookies, although blocking necessary cookies may affect website functions.

Academy marketing subscriptions are optional. You may unsubscribe through the message or by contacting us. Unsubscribing does not stop essential communications about a training you purchased.

12. Your rights

Subject to applicable law, you may:

• Request access to your information.

• Ask us to correct inaccurate information.

• Request deletion or restriction of processing.

• Object to processing based on legitimate interests.

• Object to direct marketing.

• Request portability where applicable.

• Withdraw consent without affecting processing that was lawful before withdrawal.

Send requests to info@artaicare.academy. We may request proportionate information to verify your identity where necessary.

We normally respond within one month. Where a lawful extension is needed, we explain the reason and revised timeframe.

You may complain to Luxembourg’s National Data Protection Commission at https://cnpd.public.lu or another competent supervisory authority.

13. Policy updates

We update this policy when our services, information handling or legal obligations change. The date above identifies the latest version.

Where required, we provide additional notice of material changes. A policy update does not itself provide consent for a new optional use of your information.