Privacy notice

Who is responsible for your data

Care is supplied to institutions, not to individuals. Nobody signs themselves up: your account exists because a training institution created it, enrolled you, and assigned you work. That arrangement decides who is answerable for your records:

• Your institution decides what is collected about you, which assessments and VR stations you are assigned, whether AI features are switched on, and whether a VR experience records eye-tracking or headset imagery. It is the party you have a relationship with.
• The platform operator runs the software that stores those records and keeps them separated by institution. It does not decide what your institution collects, and it does not use your records for its own purposes.

The practical consequence is that your institution is the first place to ask about anything in your record — what is held, why, how long for, and to have it corrected. The operator holds the data on the institution's behalf and acts on its instructions, so a request made to the operator directly will normally be referred back to the institution that holds the relationship with you.

Which body plays each role for a specific deployment, and how to contact it, is set by the operator running that deployment.

What Care records

Care is used by an institution to train and assess its trainees. Everything below is held per institution, and one institution cannot see another's records. The list is drawn from the database schema rather than written from memory, so it describes what the software genuinely stores:

• Your account — name, email address, interface language, profile picture, whether the account is active, when you last signed in, and a hash of your password. If you enable two-factor authentication, its secret and recovery codes.
• Your profile — headline, summary, career goals, preferred industries, a contact email, and any links you add.
• Questionnaire assessments — every answer you give, the results computed from them, and each attempt's score and timing.
• Practical assessments — the pass or fail an examiner recorded against each step of a station, the verdict, the score, the time taken, and which member of staff marked it.
• VR sessions — which experience you ran, when, on which headset, how far you got, the individual steps the simulation reported, and the score it produced.
• Career readiness scores — a versioned record, recomputed as new evidence arrives, of your technical, soft-skill, experience and certification sub-scores and the overall band derived from them.
• Certifications and badges you have been awarded, and your competency level.
• An audit trail of significant actions, such as an assessment being submitted.

Biometric and in-headset data

Some VR experiences are configured to capture more than a score. Where they are, Care records:

• Eye-tracking samples — where you were looking, as coordinates and as the object you were looking at, sampled repeatedly through a session and stored against your account.
• Engagement measures derived from those samples.
• Frames from your headset view — images of what you were seeing, stored as files and viewable by supervising staff while a session is live.

This is the most sensitive category the platform holds. Whether it is captured at all is a per-experience setting controlled by your institution, and what a given experience records is disclosed to you inside the headset before the session starts.

What is sent outside Care

Care offers an AI career coach, AI mock interviews, and an AI-drafted profile summary. When you use any of them, the text involved is sent to a third-party AI provider to be processed. That means:

• the messages you write to the coach, and its replies;
• your answers to mock interview questions, and the feedback generated from them;
• the profile text used to draft your summary.

Which provider receives it depends on how your institution has configured Care; the current options are Anthropic and Groq. An institution may also run Care with AI disabled, in which case nothing is sent.

Nothing else leaves the platform. Assessment answers, VR telemetry, biometric samples and headset frames are not sent to any third party.

Who can see it

Access inside your institution is scoped by role, not granted wholesale:

• Instructors see only the trainees assigned to them, directly or through a shared cohort.
• Programme managers see their whole institution.
• The platform operator can access any institution for support and administration.

Two things are deliberately narrower than the rest. Your conversations with the AI career coach are private to you — no member of staff has a way to read them. A mock interview can be read by supervising staff only once you have finished it, never while it is in progress.

How long it is kept

Stated plainly, because it is the gap most likely to matter: Care currently has no automated deletion of any kind. Nothing expires on a schedule. Assessment records, VR sessions, biometric samples, headset frames, coach conversations and mock interviews accumulate until somebody removes them by hand.

Retention periods have not been set. That is a decision for the operator, and it is not made here.

Asking for a copy, or for deletion

There is currently no self-service way to export or erase your data in Care. There is no button, and no automated process behind one.

In practice that means a request has to be made to your institution and carried out manually by an administrator. What you are entitled to ask for, and how quickly it will be answered, is a question for them.

Changes to this notice

This notice describes the software as it is currently built, so it changes when the software does. Adding a feature that records something new, sends data to a different provider, or changes who can see a record means this page is updated in the same release.

The date at the foot of the page is the date the description was last true. There is no notification list and no version archive: the current text is what applies, and the way to see what changed is to read it again.

A change that materially affects you — a new category of data, a new recipient outside the platform, or a new purpose for something already held — should reach you from your institution, which is the party that decides to enable it. It is not announced by the operator.