Effective date: 1st May 2026 Last updated: August 2026
1. Who We Are
Mental Health Innovations (“MHI”, “we”, “us”, “our”) is the data controller for personal data collected through the Digital Training Platform (the “Platform”). MHI is a registered charity in England and Wales, PO Box 78319, London, W10 9FE. MHI’s registered charity number is 1175670. We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data Protection Contact: dataprotection@mhiuk.org
If you have any questions about how we handle your personal data, or you wish to exercise your rights, please contact us at the address above.
2. Who This Notice Applies To
This notice applies to all individuals who register for an account on the Platform, whether:
- you are an individual purchasing access directly (B2C); or
- you are an employee, contractor, or representative of a commercial organisation that has purchased access on your behalf (B2B).
B2B users: how we obtain your data. If you access the Platform through your employer, you will be invited by your organisation using your work email address. This means we receive your name and work email address from your employer, not from you directly. We will provide you with this notice when you first access the Platform and, in any event, within one month of receiving your data, in accordance with Article 14 UK GDPR. Any further information you provide during registration (for example, a mobile number or optional profile data) is collected from you directly.
B2B users: controller relationships. MHI is the sole, independent controller for all personal data processed on the Platform, including your account, learning, and completion data. Your employer remains an independent controller of the data it already holds about you (including your name and work email address) and of any completion information we provide to it (see Section 6), which it uses for its own purposes, such as workforce compliance and training records. Your organisation's use of that data is governed by its own privacy notice, which we recommend you review.
3. Personal Data We Collect
When you register and use the Platform, we collect and process the following categories of personal data:
| Category | Category Data Elements | Purpose |
|---|---|---|
| Account Information | First name, last name, email address, mobile phone number | Account creation, authentication, communication |
| Learning Data | Course(s) registered on, course progress, activity history, course notes | Delivering training, tracking progress, improving content |
| Completion Records | Completion certificates | Evidencing achievement, verification |
| Payment Tokens | Token identifier (no payment card data) | Validating access entitlement |
| Optional Profile Data | Interests, and any other optional fields you choose to complete | Personalising your experience (provided at your discretion) |
| Optional Profile Picture | Photograph you choose to upload | Personalising your profile. Processed only with your explicit consent, which you may withdraw at any time by removing the picture. |
| Technical / Cookie Data | IP address, browser type, pages visited, session identifiers | Platform operation, basic analytics, security |
Payment card data
We do not collect, store, or process your payment card details. Payments are processed by a third-party payment provider using Stripe. Your card data is handled entirely by that third party and Stripe in accordance with their own privacy notices and PCI DSS obligations.
4. Lawful Bases for Processing
The table below summarises the lawful bases for all processing activities:
| Processing Activity | Lawful Basis | Detail |
|---|---|---|
| Account registration and authentication (including multi-factor authentication and account recovery via your mobile number) | Contract (Art. 6(1)(b)) | Necessary to perform our contract with you, formed when you accept the Platform Terms of Use |
| Delivering training and tracking progress | Contract (Art. 6(1)(b)) | Necessary to provide the training service under the Terms of Use |
| Issuing completion certificates | Contract (Art. 6(1)(b)) | Fulfilment of the training service |
| Validating access tokens and entitlement | Contract (Art. 6(1)(b)) | Necessary to confirm your right to access purchased courses |
| Sharing completion information with your organisation (B2B users) | Legitimate interests (Art. 6(1)(f)) | Our and your organisation's interest in confirming contracted training has been delivered and completed (see Section 6) |
| Post-contract retention of account, learning and certificate data | Legitimate interests (Art. 6(1)(f)) | To evidence performance, manage disputes, and establish, exercise, or defend legal claims within the 6-year limitation period (Limitation Act 1980) |
| Strictly necessary cookies (session management, authentication, security) | Legitimate interests (Art. 6(1)(f)) | Essential to operate the Platform securely. Exempt from the consent requirement under the Privacy and Electronic Communications Regulations (PECR) |
| Analytics cookies and similar technologies | Consent (Art. 6(1)(a)) | Set only where you consent via the cookie banner, as required by PECR. You may withdraw consent at any time via [cookie preference centre link] |
| Optional profile data (interests and other optional fields) | Legitimate interests (Art. 6(1)(f)) | Voluntarily provided by you. You can remove this data at any time |
| Profile picture | Explicit consent (Art. 6(1)(a) and, where applicable, Art. 9(2)(a)) | A photograph may reveal special category data. We process it only with your explicit consent, which you may withdraw at any time by deleting the picture |
Automated decision-making
We do not carry out any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 UK GDPR). Course progress tracking is used solely to deliver the training service to you.
5. How We Use Your Data
We use your personal data to:
- create and manage your account on the Platform;
- validate your access token and entitlement;
- deliver course content and track your learning progress;
- issue completion certificates;
- communicate with you about your account or courses (e.g. reminders, updates);
- send marketing communications where you have opted in;
- operate and improve the Platform through basic analytics; and
- comply with legal obligations and protect against fraud.
6. Data Sharing with Your Organisation (B2B Users)
Where your employer or contracting organisation has purchased access to the Platform on your behalf, we share only the following with that organisation:
- confirmation that your account is active;
- your course enrolment and completion status; and
- your certificates of completion.
We do not share your course progress, activity history, or course notes with your employer. Anything you record in your course notes is visible only to you and to MHI for the purposes of operating the Platform.
We share this data on the basis of our legitimate interests, and those of your organisation, in confirming that contracted training has been delivered and completed (Article 6(1)(f)). Your organisation is responsible for its own use of this data in accordance with its own privacy notice.
7. Other Recipients of Your Data
We may share your personal data with:
- hosting and infrastructure providers located in the UK and EEA who operate the Platform on our behalf;
- analytics providers who help us understand Platform usage (limited to non-identifying or pseudonymised data where possible);
- our third-party payment partner Titus and Stripe, solely for payment processing and token validation (they do not receive your learning data); and
- law enforcement, regulators, or other authorities where required by law.
All third-party processors are bound by data processing agreements in accordance with Article 28 UK GDPR.
8. International Transfers
Your personal data is stored and processed within the United Kingdom and the European Economic Area (EEA). We do not routinely transfer personal data outside the UK/EEA.
If any transfer outside the UK/EEA becomes necessary (for example, through a sub-processor), we will ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), UK Addendum to EU Standard Contractual Clauses, or an adequacy decision by the Secretary of State.
9. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes described in this notice. During the life of your contract, processing is based on Article 6(1)(b); after the contract ends, continued retention is based on our legitimate interests (Article 6(1)(f)) in evidencing performance and establishing, exercising, or defending legal claims within the six-year limitation period under the Limitation Act 1980.
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account information (name, email, mobile) | Duration of active use, plus 6 years from: your last course purchase or completion (B2C), or your last course completion or the end of your organisation's contract, whichever is later (B2B) | Contract (Art. 6(1)(b)) during active use; legitimate interests (Art. 6(1)(f)) thereafter, to evidence performance and defend legal claims (Limitation Act 1980) |
| Learning data (course enrolment, progress, activity history, notes) | Duration of active use, plus 6 years from course completion or last activity | Contract during active use; legitimate interests thereafter. Forms part of the service record evidencing delivery of the contracted training |
| Completion certificates | 6 years from date of issue | Contract at issue; legitimate interests thereafter, for verification, regulatory, and dispute-resolution purposes |
| Payment tokens | 6 years from date of transaction | Contract at transaction; legitimate interests thereafter, to evidence entitlement and resolve payment disputes within the limitation period |
| Optional profile data (interests) | Deleted when you clear the data, or 12 months after last account activity, whichever is sooner | Legitimate interests. Not necessary for contract performance, so a shorter retention period applies |
| Profile picture | Deleted immediately when you remove it or withdraw consent, or 12 months after last account activity, whichever is sooner | Consent. Deleted on withdrawal |
| Registration-only accounts (accounts that never enrol on or complete a course) | 12 months from registration if no course is purchased or assigned | Contract formed at Terms of Use acceptance, but minimal service delivered; limited justification for extended retention |
Where we are required by law to retain data for a longer period (for example, for tax or regulatory compliance), we will do so for the minimum period required.
10. Cookies
The Platform uses cookies and similar technologies in two categories:
Strictly necessary cookies. These are essential for the Platform to function: session management, authentication, and security. They are set without consent, as permitted by the Privacy and Electronic Communications Regulations (PECR), because the Platform cannot operate without them.
Analytics cookies. These help us understand how the Platform is used (for example, page views and session duration) so we can improve it. Analytics cookies are set only if you consent via the cookie banner when you first visit the Platform. You can change or withdraw your consent at any time via <link>. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
We do not use advertising or cross-site tracking cookies.
For a full list of the cookies we use, their purposes, and their durations, please see our Cookie Policy.
11. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access - to request a copy of the personal data we hold about you.
- Right to rectification - to request correction of inaccurate or incomplete data.
- Right to erasure - to request deletion of your data in certain circumstances.
- Right to restrict processing - to request we limit how we use your data.
- Right to data portability - to receive your data in a structured, commonly used, machine-readable format.
- Right to object - to object to processing based on legitimate interests.
- Right to withdraw consent - where processing is based on consent (e.g. marketing), you may withdraw at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at dataprotection@mhiuk.org. We will respond within one month of receiving your request. We may ask you to verify your identity before processing your request.
12. Complaints
If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
We would, however, appreciate the opportunity to address your concerns before you contact the ICO.
13. Changes to This Notice
We may update this privacy notice from time to time. Where changes are material, we will notify you by email or through a prominent notice on the Platform. The “Effective date” and “Last updated” dates at the top of this notice indicate the current version.
14. Contact Us
If you have any questions about this privacy notice or our data practices, please contact:
Data Protection Contact
MHI (UK)
Email: dataprotection@mhiuk.org