Privacy Policy
Last reviewed 31 August 2026 · Next review 31 August 2027
1. Who we are
InsideOut Wellness Academy is the controller responsible for personal information described in this policy. Contact: info@insideoutwellness.academy; 1B Law Street, Hoole, Chester, CH2 3AT.
2. Who this policy applies to
This policy applies to website visitors, prospective and current students, graduates, clients or participants involved in student case-study work, contractors, associates and other people who interact with the Academy.
3. Personal information we may collect
- Identity and contact details.
- Enrolment, attendance, learning, assessment and qualification records.
- Financial and transaction information.
- Communications, feedback, complaints and support records.
- Technical, website, portal and cookie information.
- Reasonable-adjustment and accessibility information.
- Assessment submissions, including examination answers, business plans, case studies, reflective assignments and practical assessment recordings where required.
- Limited information relating to case-study clients where students submit assessment evidence. Students are required to remove direct identifiers and use only information necessary for assessment.
4. Special category information
Some information may be special category personal data, for example health information disclosed for reasonable adjustments, safeguarding information, or information contained in reflective work or case studies. We will identify both an Article 6 lawful basis and, where required, an Article 9 condition before processing special category data. We will collect no more than is reasonably necessary for the purpose.
5. Why we use personal information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Enrolment, course delivery, attendance, assessment and certification | Contract; legitimate interests where appropriate |
| Payment, accounting and debt recovery | Contract; legal obligation; legitimate interests |
| Reasonable adjustments and learner support | Contract/legitimate interests plus an appropriate Article 9 condition where special category data is involved |
| Safeguarding and risk management | Legal obligation, vital interests and/or legitimate interests as applicable; appropriate Article 9 condition where required |
| Complaints, appeals and quality assurance | Contract; legitimate interests; legal obligation where applicable |
| Website security and administration | Legitimate interests; legal obligation where applicable |
| Marketing | Consent or legitimate interests/soft opt-in where permitted by law |
6. Assessment data and AI-assisted review
The Academy may use approved AI-assisted tools to support limited administrative or preliminary review of assessment material where this is necessary and proportionate. AI is not used to make the final decision about whether a student passes, fails or qualifies. A human assessor remains responsible for assessment decisions and feedback.
Reflective assignments and recorded practical assessments are not submitted to the Academy's AI-assisted assessment workflow. Where anonymised case-study material is reviewed using an approved AI tool, students must remove direct client identifiers and a human assessor will also review the work. The Academy will not intentionally use identifiable client information to train public AI models.
Students may request meaningful human review of any decision materially informed by automated processing and may raise concerns through the complaints or appeals process.
7. Sharing information
We may share information with tutors, assessors, internal or external quality assurers, awarding/accrediting/professional bodies, IT and learning-platform providers, payment providers, professional advisers, regulators and public authorities where necessary and lawful. Service providers are expected to process information only for agreed purposes and with appropriate safeguards.
8. International transfers
Some service providers may process information outside the UK. Where this occurs, we will use an applicable adequacy arrangement or appropriate contractual and organisational safeguards required by UK data-protection law.
9. Retention
| Record type | Typical retention approach |
|---|---|
| Core student, assessment outcome and qualification records | Normally 6 years after completion or withdrawal, unless a longer period is required by an awarding/accrediting body or for verification of qualifications. |
| Assessment working copies and assessor feedback | Normally up to 2 years after the final assessment/appeal window has closed, unless needed for quality assurance, complaint, appeal or legal purposes. |
| Recorded practical assessments | Kept only for the assessment, moderation and appeal period and then securely deleted unless a longer period is required for an active complaint/appeal or by an external quality-assurance requirement. |
| Reflective assignments | Kept only as long as necessary for assessment, moderation and appeal, then deleted or minimised in line with the retention schedule. |
| Case-study evidence | Kept only as long as necessary for assessment, moderation and appeal; students must minimise client data and remove direct identifiers. |
| Financial records | Normally 6 years where required for tax/accounting purposes. |
| Marketing data | Until consent is withdrawn or it is no longer reasonable to retain it. |
These periods may be extended where reasonably necessary for an unresolved complaint, appeal, safeguarding matter, legal claim or regulatory request.
10. Security
We use appropriate technical and organisational measures to protect personal information, including access controls, secure systems, confidentiality obligations, data minimisation and breach-response procedures.
11. Your rights
- Access to your personal information.
- Correction of inaccurate information.
- Erasure in circumstances where the law provides this right.
- Restriction of processing.
- Objection to certain processing.
- Data portability where applicable.
- Withdrawal of consent where processing is based on consent.
- Rights relating to significant automated decisions, including human intervention and the ability to contest a decision where applicable.
Requests can be sent to info@insideoutwellness.academy. You may also complain to the Information Commissioner's Office (ICO).
12. Cookies and marketing
Our Cookie Policy explains how cookies and similar technologies are used. Non-essential cookies will only be used where an appropriate consent mechanism permits them. Marketing communications will include a clear opt-out route.
© InsideOut Wellness Academy 2026. All rights reserved.