01Who we are & scope of this policy

Neopeds Academy is the organization responsible (the “controller”) for personal information collected through neopedsacademy.org, our online learning portal, our event registration pages, our mobile-friendly clinical tools, and our email, SMS and chat communications (together, the “Services”).

This policy applies to everyone who interacts with the Services: learners and members, event registrants and attendees, faculty and instructors, newsletter subscribers, and visitors to our website. It does not apply to third-party websites we link to, or to information collected by our partners under their own privacy policies (for example, the hospital or society hosting an in-person workshop).

By using the Services you acknowledge that you have read this policy. Where the law requires your consent (for example, for marketing emails or non-essential cookies), we will ask for it separately.

02Information we collect

We collect information in three ways: information you give us directly, information generated as you use the Services, and limited information from third parties (such as a payment confirmation from Stripe or a registration list from a co-hosting institution).

03How we use your information

We identify our purposes before or at the time we collect personal information, and we use it only for those purposes (or purposes you would reasonably expect and that are compatible with them). Our purposes, and the legal basis we rely on where the GDPR applies, are:

We do not use your personal information for automated decision-making that has legal or similarly significant effects on you.

04Payments & billing

Purchases on our website are processed through our e-commerce platform (WooCommerce) and our payment processor, Stripe. When you pay, your card details are entered into a secure Stripe form and transmitted directly to Stripe; we never receive or store your full card number, expiry date or security code. We receive only a confirmation of payment, the card brand and last four digits, and a transaction reference so that we can issue receipts, manage refunds and reconcile our accounts.

Stripe acts as an independent controller of your payment information and may use it for fraud prevention and to comply with its own legal obligations. Stripe’s privacy policy explains how it handles your data. If you pay by bank transfer, invoice or another method we arrange with you, we keep the details needed to record the payment.

We keep transaction records for as long as tax and accounting laws require (generally seven years in Canada).

05Learning records, certificates & CME/CPD credits

Our learning portal records your progress so that you can pick up where you left off, so that we can unlock lessons and assessments in sequence, and so that we can verify you have met the requirements for a certificate. This includes lessons completed, video watch progress, quiz attempts and scores, and completion dates.

When you complete a program, we generate a certificate bearing your name, the program title, the completion date and a unique certificate ID. We keep a copy of every certificate issued so that we can re-issue it on request and so that employers, licensing bodies or accreditors can verify its authenticity if you ask us to. Where a program is accredited for continuing medical education or professional development, we may be required to share your name, credentials and completion record with the accrediting organisation, and to retain those records for the period it specifies.

Course content, discussion posts and case submissions you contribute may be visible to other learners and faculty in the same program. Please do not post patient-identifiable information.

06Diploma case-evaluation portal & submitted ultrasound images

Candidates in our diploma programs (including the CNPOCUS Diploma in Lung Ultrasound and other diploma programs delivered through Neopeds Academy) must submit ultrasound studies for faculty review. Each study is scored by a faculty mentor from 1 to 5 on technical skill, interpretation and reporting, and a candidate must achieve a score of 4 or higher on at least 15 submitted studies before the case-submission deadline to qualify for the exit examination and complete the program. This section explains exactly how those submissions are handled, so that candidates and their institutions can complete their own privacy and data-security reviews.

Institutional privacy and data-security enquiries

Hospital privacy officers, information-security officers and research-ethics staff who need to review the portal before a candidate submits images are welcome to contact the Program Director directly:

Program Director, Diploma Programs — support@cnpocus.org or support@neopedsacademy.org, +1 (289) 456-2324. We are happy to answer questions, provide written confirmation of the practices above, or arrange a call with your data-security team.

07Events, conferences, workshops & webinars

Registration and attendance

When you register for a conference, workshop, symposium or webinar, we collect the details needed to process your registration, issue your ticket or joining link, prepare name badges and attendance lists, and confirm your attendance for certificates. For in-person events we may share a participant list (name, institution and country) with co-hosting institutions, venue security and accreditation bodies where needed to run the event.

Live webinars and recordings

Live sessions are delivered through video-conferencing platforms such as Zoom. These platforms collect your display name, email address, join and leave times, and any chat messages, questions or poll responses you submit. Sessions are usually recorded so that they can be offered on demand to registrants and, in some cases, added to our course library. Your voice or video will be captured if you unmute or turn on your camera; your typed questions may appear in the recording. If you would prefer not to be recorded, keep your camera and microphone off and use the Q&A feature, or contact us before the session.

Photography and testimonials

We may take photographs and video at in-person events for use on our website, social media and promotional materials. We will tell you at the event how to let us know if you do not wish to be photographed. We only publish named testimonials with your permission.

Faculty and speakers

If you present for us, we publish your name, credentials, institution, biography and photo in the program and on our website, and we may retain your session recording and slides as part of our educational library, subject to the speaker agreement you sign.

08Accounts & memberships

You need an account to access courses and your purchase history. Your account holds your profile, order history, membership status, enrolled programs and certificates. You are responsible for keeping your password confidential; we store passwords only in hashed form and cannot read them. Membership plans give you access to content for a defined period; we keep a record of your plan, start and end dates, and renewal status so that access can be granted and removed correctly.

Access to paid content is licensed to you personally. To protect our faculty’s work, we may monitor for unusual access patterns (such as simultaneous logins from many locations) and suspend accounts that share credentials, as described in our Terms of Service.

09Email, SMS & live chat

Email

We send transactional emails (receipts, joining instructions, course notices) to everyone who buys from or registers with us; these are necessary to provide the Services and you cannot opt out of them while you have an active account or registration. We send marketing emails — our newsletter and announcements about upcoming programs — only with your consent or, where CASL permits, based on an existing business relationship. Every marketing email includes an unsubscribe link, and you can also unsubscribe by emailing us. We honour opt-outs within ten business days.

SMS / text messages

If you opt in to receive text messages (for example, event reminders or urgent schedule changes), we collect your mobile number, your consent record, your name and contact details, and a history of messages sent and received. We use this information only to send the messages you signed up for and to operate and improve our messaging service. Message frequency varies; message and data rates may apply. To opt out at any time, reply STOP to any message. For help, reply HELP or email support@neopedsacademy.org. We do not share SMS opt-in data or mobile numbers with third parties or affiliates for their marketing purposes; this data is shared only with the service providers that deliver our messages, or when required by law.

Live chat

Our website offers a live-chat widget (provided by Tawk.to) so you can ask questions in real time. The chat provider collects your name and email (if you enter them), your messages, IP address, browser information and pages visited during the chat. Transcripts are kept so that we can follow up on your enquiry and train our support team.

10Cookies & analytics

Cookies are small text files placed on your device. We use them, together with similar technologies such as local storage and pixels, for the purposes below.

Where required by law we ask for your consent before setting non-essential cookies. You can also control cookies through your browser settings; most browsers let you refuse or delete cookies. If you disable cookies, parts of the Services (including login, checkout and course progress tracking) may not function. We do not currently respond to “Do Not Track” browser signals, but we do honour Global Privacy Control signals where the law requires it.

11How we share information

We do not sell, rent or trade your personal information, and we do not share it with third parties for their own marketing. We share information only in the following circumstances:

• Service providers who process information on our behalf under contracts that require them to protect it and use it only for our purposes. These include: our website hosting and content-delivery provider; Stripe (payments); WooCommerce and our learning-platform software; Zoom or similar platforms (webinars); Tawk.to (live chat); our email and SMS delivery providers; form and automation tools; analytics providers; and our accountants and IT support.
• Accreditation bodies and co-hosting institutions — your name, credentials and attendance or completion record, where needed to award credits or run an event you have registered for.
• Faculty and other learners — your name and contributions in shared discussion spaces, and your name and institution on event attendee lists where the event uses them.
• Legal and safety — where required by law, regulation, subpoena or court order; to protect the rights, property or safety of Neopeds Academy, our learners or the public; or to enforce our Terms of Service.
• Business transfers — if Neopeds Academy is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honour this policy and will notify you of any material change.
• With your consent — in any other case, we will ask you first.

12International transfers

Neopeds Academy is located in Canada, and our learners join us from more than 100 countries. Some of our service providers store and process information in the United States and other countries outside Canada, the European Economic Area and the United Kingdom. When information is stored outside your country, it may be accessible to the courts, law enforcement and national security authorities of that country.

Whenever we transfer personal information internationally we take steps to protect it, including using providers that offer contractual data-protection commitments (such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum), limiting the information transferred to what is necessary, and reviewing our providers’ security practices. You may contact us for more information about the safeguards we use.

13How long we keep information

We keep personal information only as long as necessary for the purposes described in this policy, to meet legal, accounting or reporting requirements, or to establish or defend legal claims. Our general retention periods are:

When information is no longer needed we delete it or irreversibly anonymise it so that it can no longer identify you.

14How we protect your information

We use physical, technical and organisational safeguards appropriate to the sensitivity of the information, including encryption in transit (HTTPS/TLS) across the whole website, hashed passwords, role-based access controls so that staff and faculty see only what they need, secure and reputable hosting with regular backups, automatic security updates and malware scanning, and contractual security obligations for our service providers.

No method of transmission or storage is completely secure. If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada (and other regulators where required) as soon as feasible. You can help by using a strong, unique password and by contacting us immediately if you suspect unauthorised use of your account.

15Your privacy rights & choices

Depending on where you live, you may have some or all of the following rights. We extend the core rights of access, correction, deletion and marketing opt-out to everyone, wherever you are.

How to exercise your rights. Email support@neopedsacademy.org with the subject line “Privacy request”. We may need to verify your identity before acting on your request. We respond within 30 days (or sooner where local law requires); if we need more time or must decline part of a request, we will tell you why. There is no charge for a request unless it is manifestly unfounded or excessive.

Please note that deleting your account will remove your access to any courses and certificates you have purchased. Download your certificates before requesting deletion.

16Children’s privacy

The Services are designed for healthcare professionals and trainees and are not directed to anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

17Third-party websites & content

Our website contains links to external sites, embedded video players, maps and social-media features that are operated by third parties. Those third parties may collect information about you when you interact with their content, under their own privacy policies, which we encourage you to read. We are not responsible for their practices.

18Changes to this policy

We review this policy regularly and will update it when our practices or the law change. The effective date at the top of the page tells you when it was last revised. If we make a change that materially affects your rights or how we use information you have already given us, we will notify you by email or by a prominent notice on our website before the change takes effect. Your continued use of the Services after that date means you accept the updated policy.

19Contact us & complaints

Our Privacy Officer is accountable for our compliance with this policy and with applicable privacy laws. If you have a question, wish to exercise your rights, or have a concern about how we have handled your information, please contact us first — we take every concern seriously and will do our best to resolve it promptly.