Privacy policy

This privacy policy explains how Bleepy (“we”, “us” or “our”) collects, uses and protects your personal information when you use our platform, website or related services.

This policy explains what we do with personal data under the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. Section 5 sets out the legal reason for each use. Where we rely on your consent, we ask for it separately, and you can withdraw it at any time.

For your account, sign-in and security records, Bleepy decides how they are used. Contact Bleepy at support@bleepy.co.uk.

For your training records (bookings, attendance, feedback and certificates), the organisation that runs your training decides; contact the organisation that runs your training.

Bleepy also processes the data organisations upload, on their behalf (section 3.3). Bleepy is currently a pre-incorporation trading name. There is no UK company number or registered office yet. Those details will be added here when the company is formed.

We use your information to:

• Provide and improve the Bleepy platform
• Facilitate events, resources, and learning activities
• Take payments for paid sessions, and manage organisations’ licences
• Communicate important updates via email and push notifications
• Send event reminders, booking updates, certificate notifications, and feedback requests via push notifications
• Maintain platform security and integrity
• Comply with legal obligations
• Analyse Foundation Year / placement blog engagement (only with analytics consent) to improve educational content
• Generate personalised feedback, reports, and certificates

We process your data under the following legal bases:

We may send communications about Bleepy and relevant professional opportunities or products.

You can opt out at any time via email footer links or by contacting support@bleepy.co.uk.

Bleepy offers push notifications to keep you informed about important events, bookings, certificates, and feedback requests. Push notifications are optional and require your explicit consent.

Data collection: To deliver push notifications, we store your browser's push subscription endpoint, encryption keys (p256dh and auth), and your notification preferences. This data is stored securely and is only used to send notifications you've requested. Notifications are delivered through your browser maker's push service (for example Google, Mozilla, Apple or Microsoft). The message itself is encrypted, so that service sees only where to deliver it and when. When you turn push notifications off on a device, we stop sending them there and delete that device's subscription details.

Service workers: Push notifications use browser service workers to deliver messages even when the Bleepy website is not open. The service worker code is stored locally in your browser and does not track your browsing activity.

To manage your push notification preferences, visit your profile settings page or contact support@bleepy.co.uk.

You can download a complete copy of your account's data yourself at any time from Privacy and data, in the menu under your name. It is an Excel file, which is a commonly used, machine-readable format, with one sheet for each kind of data. It includes your bookings, attendance, feedback, certificates, payments, dietary and booking answers, rota availability, the emails sent to you and whether you opened them, and the files you downloaded. The only records not in it are Foundation Year and placement blog reading records, which are kept for 90 days; ask us and we will send them.

You can also ask us for a copy by contacting support@bleepy.co.uk. We will verify your identity and respond within one month.

The periods below that say “deleted automatically” are carried out by a nightly clean-up, which deletes everything older than the period shown.

• Active accounts: Kept for as long as your account remains active.
• Inactive accounts: Kept for 7 years after last activity, so you can still evidence your training. They are not deleted automatically.
• Closed accounts: When you close your account, we remove your name, email address, contact details, profile, settings and personal content (such as portfolio files) within 7 days. This includes your address in the copies of emails sent to you and the record of whether you opened them, your faculty rota availability, the finance contact and notes you gave on invoice requests that are paid or cancelled (on a request still waiting to be paid, they stay until it is paid or cancelled, so the organisation can still settle the invoice), feedback digests written about you as an educator, and your staff alert and planner email settings. Your organisation's training records about you (bookings, cancellations, attendance, feedback scores, certificates and payments, including invoice requests) are kept for at least 7 years without your name, because organisations need them to evidence education and for tax. Download your certificates before you close your account, as you will no longer be able to. To ask for those records to be erased as well, contact the organisation that ran the training: it decides what happens to its records.
• Payment and invoice records: Kept for at least 7 years, for tax and accounting.
• System logs and sign-in records: Technical logs (system_logs), including Foundation Year and placement blog reading records, are deleted automatically after 90 days. Sign-in records (when, how and from which internet address an account signed in, with no passwords or codes) are deleted automatically after 12 months. Sign-in and check-in attempt records (used to stop repeated guessing) are deleted automatically after 30 days.
• Records of privacy choices: Kept for up to 7 years, with the internet address and browser they came from. When you close your account they are deleted, except the record of your request to close it, which is kept for 7 years.
• AI usage records: One record of each use of an AI feature (who, which feature, its size and whether it worked, never the text) is deleted automatically after 2 years.
• Analytics: Google Analytics keeps its own data for up to 2 years. Records of which teaching files you download (your name, the file and when) are kept so your organisation can see how its resources are used, for as long as your account is open. Foundation Year / blog reading records are kept for 90 days. You can withdraw analytics consent at any time with Cookie settings at the bottom of every page, or in Privacy and data, in the menu under your name. While you are signed in on your organisation's site, the two stay in step: a change in one changes the other.
• Emails sent to you: Copies of staff emails and newsletters sent to you, and whether you opened them, are kept until staff delete them. Your address is removed from them when you close your account.
• Dietary answers: Deleted automatically 30 days after the session (for a course, 30 days after its last session).
• Event bookings: Kept for at least 7 years after the event date, so attendance can be evidenced later.
• Certificate data: Kept for at least 7 years, so certificates can be verified and training evidenced.
• Feedback: Kept for at least 7 years with the session's records. Feedback given without an account (anonymous feedback) is deleted automatically after 2 years.
• Organisation data: When an organisation's subscription ends, we keep its data for up to 90 days so it can export it or come back, and then delete it on request or at the end of that period. Deletion is done by Bleepy, not automatically.

Bleepy's database and uploaded files are stored in the UK (London).

Some sub-processors may process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

For a complete list of our sub-processors and their data processing locations, see our Sub-processors page.

We use trusted third-party providers to operate our Services securely and reliably. These sub-processors process personal data on our behalf.

We only use sub-processors that meet security, privacy, and compliance standards consistent with UK GDPR and EU GDPR, operate under written data-processing terms, and provide appropriate technical and organisational safeguards.

Paid teaching tickets are processed by Stripe. The organisation is the merchant. Bleepy does not store card numbers. Emails are sent through Microsoft 365. Google Maps shows maps on event pages and helps staff find a venue. Google reCAPTCHA checks the contact, site-feedback and create-account forms; on the sign-in page it loads only when you open the form to create an account. OpenAI provides the optional AI features described in section 10.1. See the full list on our Sub-processors page.

Bleepy offers optional AI features that help staff draft text, read uploaded timetables and documents, describe pictures, summarise feedback, suggest curriculum links, and answer questions about Bleepy's help articles and reports. They are provided by OpenAI, in the United States, under a data processing agreement. Each organisation decides whether to use them, and its organisation lead can switch them all off. The organisation lead also chooses which staff roles, and which named members of staff, can use each AI feature. Learners cannot use them.

• Only the text or picture needed for each task is sent. Patient details must not be included, and text that looks like it contains an NHS number is not sent or has the number removed.
• Learners' own names and email addresses are removed from feedback before it is sent, and email addresses are removed from uploaded files and documents.
• A person reviews what the AI writes before it is sent or published. The AI makes no decision about anyone.

Bleepy does not keep what is sent to the AI. It keeps the AI's answer only where it becomes a saved record: a feedback report a person chooses to save, and the feedback themes and feedback digests, which are saved when they are made. Themes and digests can include short quotes from feedback comments, with learners' names taken out. They are kept with the session records they describe, and stay if a learner later closes their account, because they do not name anyone; a feedback digest about an educator is deleted if that educator closes their account. Bleepy also keeps a usage record of each run: who ran it, which feature, its size and whether it worked, never the text. The organisation lead can see who used the AI features and how much, but not what they wrote. Usage records are kept for 2 years and then deleted, and each person's own records are included when they download their data. OpenAI does not use this data to train its models. By default it keeps requests for up to 30 days to check for misuse and then deletes them, unless the law requires it to keep them longer.

We implement appropriate technical and organisational measures to protect your data.

If a data breach occurs that poses a risk to individuals, Bleepy will:

• Notify the ICO within 72 hours (where legally required)
• Notify affected users without undue delay
• Provide details of the breach and mitigation steps

Bleepy is intended for people aged 16 and over. If an organisation invites someone aged 13 to 15, that organisation is responsible for getting consent from a parent or guardian. Bleepy does not allow data about children under 13, and we delete it if we find it (see our terms of use).

Bleepy is run from the UK for UK organisations. We process personal data under UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies.

You have the right to:

• Access your data
• Request correction or deletion
• Withdraw marketing consent
• Withdraw analytics consent (Cookie settings at the bottom of every page, or Privacy and data, in the menu under your name), which stops Foundation Year / blog reading analytics
• Request data portability
• Object to processing
• Restrict processing (for example while the accuracy of your data is checked)
• Lodge a complaint with the ICO or your supervisory authority

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

The optional AI features in section 10.1 only draft and suggest. A person reviews their output and makes every decision.

If Bleepy or its assets are acquired, data may be transferred under equivalent privacy obligations.

Users will be notified as required by law.

Our services may include links to external websites.

We are not responsible for their content or privacy practices.

Please review their privacy policies before sharing personal information.

We may update this policy periodically.

Material changes will be notified via the platform or email.