HealthBoxHR Ltd (Learn) – Privacy Policy

Updated and effective as of 9th September 2026

This policy covers HBHR Learn, our learning management system. For the HBHR HR and payroll platform, see the HealthBoxHR Ltd Privacy & Data Processing Policy.

Introduction

HealthBoxHR Ltd (“HBHR”, “we”, “us”, “our”) provides HBHR Learn, a cloud-based learning management system (“the Service”) that allows organisations (“Clients”) to deliver, manage, and track training and educational content to their learners (“Users”).

This Privacy Policy explains how we collect, use, store, and protect personal data when you use the Service. We operate within the UK GDPR as amended by the Data (Use and Access) Act 2025; the Data Protection Act 2018 (as amended by the DUAA); the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended, including by the DUAA).

The Client is the Data Controller for personal data processed through the Service, and HBHR acts as a Data Processor on their behalf.

About us

HealthBoxHR Ltd is registered in England and Wales with company number 16132339 and registered office at Second Floor, 2 Queens Square, Ascot Business Park, Lyndhurst Road, Ascot, Berkshire, SL5 9FE.

HealthBoxHR Ltd is registered with the Information Commissioner’s Office (ICO), registration number ZC074567.

Information we collect

Account and Identity Data – provided by you directly

• Name, job title, organisation
• Email address
• Username and password (stored using secure hashing)
• Content you upload, submit, or create within the platform (for example photos, videos and documents used for creating course content)

Learning and Usage Data – collected automatically

• Course enrolments, progress, completion status, and scores or grades
• Assessment and quiz responses
• Certificates issued
• Time spent on courses, login history, and activity logs
• Diagnostic and performance data

Automated Decision-Making

Certain features (for example automated quiz grading, and adaptive learning paths that recommend content) may involve automated processing.

Retention and Security of Data

We retain data only for as long as is necessary to fulfil the purposes outlined above and in accordance with the Client’s instructions, and retained for the duration of the Client’s subscription. Unless otherwise requested or required to be kept by a statutory or regulatory body in compliance with our legal obligations, all data will be permanently deleted upon termination of the contract.

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit and at rest;
• Role-based access controls limiting data access to authorised personnel;
• Secure authentication practices, including support for multi-factor authentication.

Subject Access Requests (SAR)

Individuals have the right to ask if HBHR is using or storing their personal data and how it is being processed. They can also ask for copies of their personal data. This right of access is also known as making a Subject Access Request, a SAR.

Both the data controller (Client) and the data processor (HBHR) have different responsibilities when it comes to responding to a SAR, but ultimately the data controller is primarily responsible as they hold the legal responsibility for ensuring compliance with the UK GDPR. The processor will assist the controller in fulfilling the SAR, by providing the necessary data or helping to locate data that the controller may hold. However, the processor is not the main party handling the request.

Contacting Us

If you have any questions relating to our Privacy Policy or your information, or wish to exercise any of your rights as described in this Privacy Policy or under data protection laws (SAR or DSAR), you can contact our Data Protection Officer as below. We will respond within 30 days.

By post:
Data Protection Officer
HealthBoxHR Ltd
Second Floor, 2 Queens Square
Ascot Business Park
Lyndhurst Road
Ascot
Berkshire
SL5 9FE

By email: dataprotection@healthboxhr.com

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If this Privacy Policy changes in any way, we will place an updated version on this page and update the “Updated and effective” date above.