Records Retention Policy

Purpose

This policy explains how Clarivive MedInsight Ltd manages the retention, review, archiving, anonymisation and secure disposal of learner, training, certificate and business records.

Its purpose is to ensure that records are:

1. Retained for an appropriate and justifiable period
2. Available when required for training, certification, audit or legal purposes for certain defined time period.
3. Protected against unauthorised access, alteration or loss
4. Reviewed when their retention period expires
5. Securely deleted or anonymised when no longer required
6. Reduced to limited metadata where retaining a full record is unnecessary

Retention periods may be revised where legislation, regulatory requirements, accreditation arrangements, contractual duties, technology or business operations change.

Records we may hold

Records retained by Clarivive MedInsight Ltd may include:

1. Learner registration and account details
2. Course enrolment and completion records
3. Attendance and non-attendance records
4. Assessment answers, scores and outcomes
5. Practical assessment and observation records
6. Certificate records and verification metadata
7. Learning Management System activity records
8. Webinar attendance and participation records
9. Reasonable-adjustment and accessibility records
10. Complaints and appeals records
11. Safeguarding and serious-incident records
12. Malpractice, fraud and misconduct records
13. Booking, payment, refund and invoice records
14. Employer and group-booking records
15. Learner-support and communication records
16. Marketing consent, objection and suppression records
17. Website form submissions
18. Audit, quality-assurance and trainer records
19. Records required for legal, insurance or contractual purposes

We aim to retain only information that is adequate, relevant and necessary for the stated purpose.

General retention approach

Records may move through the following stages:

Active record

The record is required for a current learner account, course, booking, assessment, complaint, support matter or other active business purpose.

Restricted archive

The record is no longer used routinely but must remain available for an applicable retention, audit, legal, certification or contractual purpose. Access should be restricted to authorised individuals.

Metadata-only record

The detailed record is deleted or reduced, but limited information is retained for a specific purpose such as certificate verification, fraud prevention or confirmation that a request was previously completed.

Secure deletion or anonymisation

The record is securely deleted or irreversibly anonymised when there is no continuing lawful or operational reason to retain identifiable information.

Retention periods should normally begin from a defined event, such as:

1. Course completion
2. Certificate issue or expiry
3. Learner-account inactivity
4. Closure of a complaint or appeal
5. End of the relevant financial year
6. End of a contract
7. Last communication
8. Withdrawal of marketing consent

Records may also be placed under a legal or safeguarding hold, meaning routine deletion is paused while an investigation, claim, audit or serious concern remains active.

Typical retention periods

The following periods are general operational standards. A shorter or longer period may apply where justified by the circumstances, legal requirements, awarding-body rules, contractual obligations or an active investigation.

Limited-company tax and accounting records may generally need to be retained for six years from the end of the relevant company financial year, with longer retention required in certain circumstances.

The periods in this table are maximum working standards, not automatic instructions to retain every record for the entire period. Records may be deleted earlier where they are no longer needed and no legal, contractual or operational reason requires continued retention.

Certificate verification

Clarivive MedInsight Ltd may retain limited certificate metadata for longer than detailed LMS activity, assessment answers or routine learner communications.

Certificate metadata may include:

1. Learner name
2. Course title
3. Completion or assessment date
4. Certificate reference number
5. Certificate issue and expiry date
6. Certificate status
7. Whether the certificate was replaced, revoked or cancelled
8. Delivery or assessment type where relevant

This information may be retained to:

1. Verify whether a certificate is genuine
2. Respond to authorised verification enquiries
3. Detect fraudulent or altered certificates
4. Maintain an audit trail
5. Confirm whether a certificate has expired, been replaced or revoked

Certificate verification must be proportionate. We will not ordinarily disclose detailed assessment answers, health information, private communications or unrelated learner records merely to verify a certificate.

Where a detailed learner record is no longer needed, it may be deleted while limited verification metadata is retained.

Longer retention

Records may be retained beyond the usual period where this is reasonably necessary for:

1. An existing or anticipated legal claim
2. An unresolved complaint or appeal
3. A safeguarding concern
4. A fraud, malpractice or misconduct investigation
5. An insurance matter
6. A regulatory, accreditation or awarding-body audit
7. Certificate integrity or suspected certificate misuse
8. Tax or accounting compliance
9. Contractual requirements
10. Law-enforcement or court requirements
11. A personal-data request that is still being handled
12. Another documented legal or governance reason

Where a record is retained longer than its normal period, the reason should be documented and the need for continued retention reviewed periodically.

Longer retention does not mean unrestricted access. Archived records must remain protected and accessible only to authorised individuals with a legitimate need.

Deletion requests

Individuals may request deletion of their personal information through the privacy-request process described in our Privacy Policy.

A deletion request will be considered individually with a signed consent form uploaded while initiating a request for deletion. The right to erasure is not absolute, and some information may lawfully need to be retained.

For example, we may need to retain limited records for:

1. Certificate verification
2. Financial and accounting compliance
3. Legal claims
4. Complaints or appeals
5. Safeguarding
6. Fraud prevention
7. Audit or accreditation
8. Contractual obligations
9. Establishing that a marketing objection has been respected
10. Defending or exercising legal rights

Where full deletion cannot be completed, we may:

1. Delete information that is no longer required
2. Restrict further use
3. Reduce the record to necessary metadata
4. Anonymise information
5. Explain why specific information must be retained

Closing or deleting a learner account does not necessarily require deletion of all underlying course, assessment, transaction or certificate-verification records.

Secure deletion

When records are no longer required, they will be securely deleted, anonymised or reduced to limited metadata using methods appropriate to the system and sensitivity of the information.

This may include:

1. Permanent deletion from active systems
2. Secure disposal of paper records
3. Removal of unnecessary attachments
4. Anonymisation of reporting or quality-assurance data
5. Deletion through approved supplier or platform controls
6. Overwriting or secure disposal of storage media where appropriate
7. Removal from routine backups according to the relevant backup cycle

Information contained in backups may not disappear immediately when it is deleted from an active system. Backup copies should remain protected, should not be used for ordinary business purposes and should be overwritten or deleted through the normal backup-retention cycle.

Where deletion is completed in response to a formal privacy request, an appropriate record may be retained to demonstrate that the request was received and acted upon.

Contact

For questions about records retention, deletion or the use of personal information, please use the privacy-request form provided under our Privacy Policy.

If the form cannot reasonably be used, contact:

Email: info@clarivive.co.uk

Please provide enough information for us to identify the relevant records and understand your request. We may need to verify your identity before disclosing, correcting or deleting personal information.

Do not send passwords, full payment-card information, unnecessary medical records or confidential patient information through ordinary email.