Privacy Policy

1. Our Commitment to Privacy

uCertify LLC ('uCertify', 'we', 'us', or 'our') is committed to protecting the privacy, confidentiality, security, and integrity of personal information entrusted to us.

This Privacy Policy explains how uCertify collects, uses, discloses, retains, and protects personal information when individuals use our websites, learning platform, digital courseware, assessments, virtual laboratories, certification-preparation resources, instructor tools, support services, and related products and services (collectively, the 'Services').

We apply principles of data minimization, purpose limitation, transparency, appropriate security, and accountability when processing personal information. For institution-managed accounts, uCertify collects and processes only the Student Data reasonably necessary to provide, administer, secure, and support the educational Services authorized by the Educational Institution.

We do not sell or rent personal information. We do not use Student Data for targeted advertising, to create commercial marketing profiles of students, or for unrelated commercial purposes.

For information specifically concerning children under 13, parents, guardians, and schools should also review the Children's Privacy and COPPA section below.

Where uCertify provides Services under an agreement with a school, school district, college, university, government agency, workforce-development organization, or other educational institution ('Educational Institution'), additional contractual terms, including a Data Processing Addendum or Student Data Privacy Agreement, may apply. Where such an agreement provides additional or different protections, the applicable agreement governs to the extent of the conflict.

2. Privacy Contact Information

uCertify LLC
3187 Independence Drive
Livermore, California 94551
United States

Privacy and Data Protection Inquiries: dpo@ucertify.com
Data Protection Officer: dpo@ucertify.com
Telephone: +1-415-763-6300

Parents, guardians, Educational Institutions, and users may use these contact details for privacy, Student Data, or COPPA-related inquiries.

3. Our Role When Processing Personal Information

Our role depends on how the Services are used.

Direct Users

When an individual creates an account, purchases a product, subscribes to a service, contacts uCertify directly, or otherwise interacts directly with us, uCertify generally determines the purposes and means of processing that personal information and acts as the data controller or equivalent role under applicable law.

Educational Institution Accounts

When uCertify processes Student Data on behalf of an Educational Institution, the institution generally determines the educational purpose and authorized use of the data, and uCertify processes Student Data on the institution's behalf and according to its documented instructions, contractual requirements, and applicable law.

Where applicable under the Family Educational Rights and Privacy Act ('FERPA'), uCertify may perform services as a 'school official' or outsourced service provider under the direction and control of the Educational Institution and with a legitimate educational interest in the information necessary to provide the Services.

uCertify does not acquire ownership of Student Data merely by processing it.

4. Information We Collect

The information uCertify processes depends on the Services used and how an account is created or administered.

Account and Contact Information

Name
Username
Email address
Telephone number
Organization or Educational Institution
Account identifiers
Login and authentication information
User role, such as student, instructor, administrator, or individual learner

Course and Enrollment Information

Courses and learning paths
Enrollments
Instructor assignments
Class or institution information
Participation information
Course progress and completion status

Academic and Learning Information

Assessment and quiz results
Grades and scores
Completion records
Certifications
Assignments and submissions
Learning activities
Virtual-lab activity
Practice exercises
Student-generated content
Learning analytics and progress information
Instructor feedback

Technical and Usage Information

IP address
Browser type
Operating system
Device type
Session identifiers
Login timestamps
System and security logs
Cookies and similar technologies
Platform activity and usage information

Support and Communications

Support requests
Emails and other communications
Feedback
Survey responses
Troubleshooting information

Payment and Transaction Information

When users purchase Services directly, we may process:

Billing information
Purchase information
Transaction history
Payment status

Payment card information is processed through authorized third-party payment providers and is not stored by uCertify.

Sensitive Information

Unless specifically required for an approved service or educational purpose, uCertify does not intentionally request sensitive information such as Social Security numbers, government identification numbers, health or medical information, biometric information, criminal-history information, political opinions, religious beliefs, or genetic information.

5. How We Collect Information

We may receive information:

Directly from you;
From an Educational Institution, instructor, administrator, or other authorized user;
Automatically when you use the Services;
From authorized integrations or service providers; or
As otherwise permitted by applicable law and our agreements.

For institution-managed accounts, the Educational Institution determines which users receive accounts and may provide enrollment, course, account, and related Student Data to uCertify.

6. How We Use Personal Information

We use personal information as reasonably necessary to:

Create and administer accounts;
Authenticate users;
Deliver educational content and learning activities;
Provide assessments, grading, reporting, and certifications;
Operate virtual laboratories and other interactive learning tools;
Track enrollment, participation, progress, and completion;
Provide instructor and administrative functionality;
Provide customer and technical support;
Process purchases and transactions;
Maintain, troubleshoot, and improve the Services;
Protect the security and integrity of the Services;
Prevent fraud, abuse, and unauthorized access;
Perform analytics related to operation and performance of the Services;
Communicate operational notices and service updates;
Send marketing communications where permitted and, where required, with consent;
Satisfy contractual obligations; and
Comply with applicable legal and regulatory obligations.

Student Data obtained through an Educational Institution is used only for the authorized educational purposes described in the applicable agreement, the institution's documented instructions, or as otherwise required by law.

7. Legal Bases for Processing

Where applicable law requires a legal basis for processing, uCertify may rely on one or more of the following:

Performance of a Contract: To provide requested educational products and services, administer accounts, process transactions, and fulfill contractual obligations.
Legitimate Interests: To secure and maintain the Services, prevent fraud, provide support, perform appropriate analytics, and improve reliability and functionality, where those interests are not overridden by applicable privacy rights.
Consent: Where required for activities such as certain cookies, optional features, marketing communications, or other processing requiring consent.
Legal Obligations: To comply with applicable tax, accounting, regulatory, security, law-enforcement, or other legal obligations.

For Student Data processed on behalf of an Educational Institution, uCertify processes information in accordance with the institution's instructions, applicable agreements, and applicable law.

8. Student Data and Educational Institutions

uCertify recognizes that Educational Institutions entrust us with information relating to their students.

Ownership and Control

The Educational Institution retains its rights in Student Data. uCertify receives only the rights necessary to provide and support the Services.

Student-generated work remains the property of the student or Educational Institution as determined by applicable law and institutional policy. uCertify does not claim ownership of student assignments, assessments, laboratory work, uploaded files, project submissions, or similar student-generated content.

Permitted Uses

Student Data may be processed for activities such as:

Authentication and account administration;
Course delivery;
Learning management;
Assessments and grading;
Virtual laboratories;
Academic reporting;
Progress tracking;
Customer support;
Service maintenance;
Security and fraud prevention; and
Legal and contractual compliance.

Prohibited Uses

Except where expressly authorized by applicable law and an applicable agreement, uCertify does not:

Sell or rent Student Data;
Commercially license Student Data;
Use Student Data for targeted advertising;
Build commercial marketing profiles of students;
Disclose Student Data to unrelated third parties;
Use Student Data for unrelated commercial purposes; or
Use identifiable Student Data to train publicly available or general-purpose artificial-intelligence models without appropriate written authorization.

FERPA

FERPA applies primarily to Educational Institutions receiving federal education funding. uCertify supports Educational Institutions in meeting their FERPA obligations.

Where the FERPA school-official exception applies, uCertify processes education records only for the institutional function for which the information was provided, subject to applicable restrictions regarding use and redisclosure.

9. Children's Privacy and COPPA

uCertify provides educational technology that may be used by schools and students, including students under the age of 13.

Where the Children's Online Privacy Protection Act ('COPPA') applies to uCertify as the operator of an online service, uCertify remains responsible for fulfilling the obligations imposed on operators under COPPA, including applicable requirements relating to notice, consent, collection, use, disclosure, parental rights, security, retention, and deletion of children's personal information.

School-Authorized Educational Use

Where permitted by law, an Educational Institution may act as a parent or guardian's agent for the limited purpose of authorizing uCertify's collection, use, and disclosure of a child's personal information when:

The Services are authorized by the Educational Institution;
The information is collected for the use and benefit of the Educational Institution;
The information is used for a legitimate educational purpose; and
The information is not used for unrelated commercial purposes.

When relying on school authorization under COPPA, uCertify provides the Educational Institution with appropriate notice concerning our collection, use, and disclosure practices and provides the institution the rights and information required by applicable COPPA requirements.

School authorization does not transfer uCertify's obligations as an operator under COPPA to the Educational Institution.

Where school authorization cannot lawfully be relied upon, uCertify will obtain verifiable parental consent before collecting, using, or disclosing a child's personal information where COPPA requires such consent, unless an applicable COPPA exception applies.

Information Collected from Children

Depending on the Services authorized by the Educational Institution, information may include:

Name or username;
Email or school-provided account identifier;
Enrollment and course information;
Grades and assessment results;
Progress and completion information;
Assignments and submissions;
Virtual-lab and learning activity;
Authentication information;
IP address, device/browser information, session identifiers, cookies, and other technical information necessary to provide, secure, and maintain the Services; and
Support communications.

We seek to collect only information reasonably necessary for the authorized educational service.

How Children's Information Is Used

Children's personal information is used only for purposes such as:

Providing school-authorized educational Services;
Authenticating and managing accounts;
Delivering courses, assessments, and laboratories;
Tracking academic progress and completion;
Providing reports to authorized educators;
Supporting users;
Maintaining security and preventing fraud;
Maintaining the functionality and reliability of the Services; and
Complying with applicable legal requirements.

uCertify does not use children's personal information for targeted advertising or to create commercial marketing profiles.

Disclosure of Children's Information

Children's information may be disclosed only as reasonably necessary to provide and support the authorized Services, including to:

The Educational Institution and its authorized personnel;
Service providers and subprocessors supporting uCertify's Services;
Parties required by applicable law, court order, or valid legal process; or
Other parties where specifically authorized by applicable law and appropriate consent.

uCertify takes reasonable steps to ensure that service providers processing children's personal information are capable of maintaining appropriate confidentiality, security, and integrity protections. Where COPPA requires additional online-notice disclosures, uCertify will identify the applicable operator names and the identities or specific categories of third parties and purposes for disclosure through the Privacy Policy or a clear and prominent linked notice.

Parent and Guardian Rights

Subject to applicable law and appropriate identity verification, a parent or guardian has the right to:

Review personal information collected from their child;
Request correction of inaccurate information where appropriate;
Have their child's personal information deleted where required by law; and
Refuse to permit further collection or use of their child's personal information where applicable.

Requests may be submitted to dpo@ucertify.com.

For accounts provided through an Educational Institution, uCertify may coordinate with the institution as appropriate to verify the request and fulfill applicable rights.

Retention of Children's Information

uCertify retains children's personal information only for as long as reasonably necessary to fulfill the specific educational or operational purpose for which it was collected, satisfy applicable contractual obligations, or meet legal requirements.

Children's personal information is not retained indefinitely.

When the information is no longer required, uCertify securely deletes or otherwise disposes of it using measures designed to protect against unauthorized access or use.

10. Cookies and Similar Technologies

uCertify uses cookies and similar technologies for purposes such as:

Authentication and session management;
Shopping-cart and transaction functionality;
Security and fraud prevention;
Remembering appropriate settings;
Maintaining website and platform functionality;
Measuring performance; and
Analytics and service improvement.

IP addresses, cookies, device identifiers, and similar persistent identifiers may constitute personal information under certain laws, including COPPA in appropriate circumstances.

For children and school-authorized Student Data, these technologies are not used for targeted advertising or unrelated commercial profiling.

Where applicable law requires consent for non-essential cookies, uCertify will request that consent.

11. Artificial Intelligence and Automated Technologies

uCertify may use artificial-intelligence or machine-learning functionality to support educational services, accessibility, learning recommendations, security, or service functionality.

Identifiable Student Data is not used to train publicly available or general-purpose foundation models without appropriate written authorization.

Student Data is not used for AI-based targeted advertising.

Where uCertify uses de-identified or aggregated information for analytics, research, service improvement, security, reliability, or product development, we take reasonable measures designed to prevent the information from identifying an individual and do not attempt to re-identify it except where permitted by law for security or compliance purposes.

12. How We Share Information

We may disclose personal information only as reasonably necessary for legitimate purposes described in this Policy, including to:

Educational Institutions

For institution-managed accounts, information may be made available to authorized instructors, administrators, and other personnel of the applicable Educational Institution.

Service Providers and Subprocessors

We may use third parties for services such as:

Cloud hosting;
Infrastructure;
Email delivery;
Customer support;
Monitoring;
Security;
Backup and disaster recovery;
Payment processing; and
Analytics.

Service providers that process Student Data are required to be subject to appropriate contractual confidentiality, privacy, security, lawful-processing, and deletion obligations.

A current list of relevant subprocessors may be made available to Educational Institutions upon reasonable request. Where COPPA requires public identification of other operators collecting or maintaining children's personal information through the Services, uCertify will provide the required identification through this Policy or a clear and prominent linked notice.

Affiliates

Information may be shared with uCertify affiliates where reasonably necessary to provide, secure, administer, or support the Services and subject to appropriate protections.

Legal Requirements

We may disclose information where required by applicable law, regulation, subpoena, court order, or valid governmental request.

Where legally permitted, uCertify may notify the affected Educational Institution before disclosing Student Data and may seek to limit a request to information that is legally required.

Business Transactions

If uCertify is involved in a merger, acquisition, reorganization, financing, or sale of business assets, information may be transferred as part of that transaction subject to applicable law and continuing privacy and contractual obligations.

13. International Data Transfers

uCertify operates internationally and may process information in countries other than the country in which the user or Educational Institution is located.

Where personal information is transferred across national borders, uCertify applies safeguards required by applicable law.

Any contractual requirement that Student Data remain within a particular geographic location is governed by the applicable agreement with the Educational Institution.

14. Information Security

uCertify maintains administrative, technical, organizational, and physical safeguards designed to protect personal information and Student Data against unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction.

Depending on the system and data involved, measures may include:

Encryption in transit and at rest where appropriate;
Role-based access controls;
Least-privilege access;
Strong authentication;
Multi-factor authentication for privileged administrative access where supported;
Security logging and monitoring;
Network-security controls;
Malware protection;
Vulnerability management;
Security testing;
Secure software-development practices;
Change management;
Personnel confidentiality requirements;
Security-awareness training;
Incident-response procedures; and
Business-continuity and disaster-recovery measures.

No system can guarantee absolute security. uCertify therefore continually evaluates and improves its safeguards based on risk, technology, applicable requirements, and evolving security threats.

15. Data Retention and Deletion

uCertify does not retain identifiable personal information indefinitely without a legitimate business, contractual, educational, or legal purpose.

Retention periods depend on the type of information and purpose of processing. For institutional Student Data, the Institutional Student Data schedule below applies instead of the general account schedule to the extent the same information is covered by both, unless an applicable written agreement or law requires a different period.

General Account Information

Account information may generally be retained for the duration of the account and for up to three years thereafter where reasonably necessary for support, contractual, dispute-resolution, security, or legal purposes.

Payment and Financial Records

Transaction and legally required financial records may generally be retained for up to seven years or for another period required by applicable tax, accounting, or legal requirements.

Support Communications

Support records may generally be retained for up to three years following resolution unless a different period is necessary for security, contractual, or legal reasons.

Marketing Information

Marketing preferences and related contact information are retained until consent is withdrawn, the individual opts out, or the information is no longer required.

Analytics

Identifiable analytics information may generally be retained for up to 26 months where applicable. Properly aggregated or de-identified information may be retained longer where it no longer reasonably identifies an individual.

Institutional Student Data

During an Educational Institution's subscription, Student Data is retained as reasonably necessary to provide the authorized Services.

Unless a different written agreement or applicable law requires another period, following termination:

Student Data may remain available for export for up to 30 days; and
Production Student Data is generally deleted or rendered inaccessible within 60 days following the applicable export period.

Information may remain temporarily in protected backup systems until expiration under the normal backup lifecycle.

Information subject to a valid legal hold, security investigation, fraud-prevention requirement, or other lawful retention obligation may be retained for the required period and remains subject to applicable confidentiality and security protections.

Children's personal information is subject to the additional retention limitations described in the Children's Privacy and COPPA section and will not be retained longer than reasonably necessary for the specific purpose for which it was collected.

16. Your Privacy Rights

Depending on applicable law and the nature of your relationship with uCertify, you may have rights to:

Request access to personal information;
Request correction of inaccurate information;
Request deletion;
Restrict certain processing;
Object to certain processing;
Request data portability;
Withdraw consent where processing relies on consent;
Opt out of marketing communications; and
Lodge a complaint with an applicable data-protection or regulatory authority.

Requests may be submitted to dpo@ucertify.com.

We may take reasonable steps to verify the identity and authority of the individual making a request before fulfilling it.

Student and Parent Requests

For Student Data controlled by an Educational Institution, students, parents, or guardians may submit requests through the institution or contact uCertify.

Where appropriate, uCertify will coordinate with the Educational Institution and provide reasonable assistance to facilitate lawful requests for access, correction, export, or deletion.

Nothing in this process limits rights available directly to a parent or child under applicable law, including COPPA.

17. Marketing and Opt-Out Choices

Users may unsubscribe from marketing emails using the unsubscribe link contained in the communication or by contacting dpo@ucertify.com.

Opting out of marketing communications does not prevent uCertify from sending necessary account, transaction, security, educational, or service-related communications.

Student Data obtained through an Educational Institution is not used for targeted advertising.

18. Security Incidents

uCertify maintains incident-response procedures designed to detect, investigate, contain, remediate, and recover from security incidents.

If uCertify determines that a Security Incident involving institutional Student Data has occurred, uCertify will notify the affected Educational Institution without unreasonable delay after reasonable verification, consistent with applicable law and applicable agreements, except where notification must be delayed by law or at the request of law enforcement to avoid interfering with an active investigation.

Where appropriate and unless uCertify is independently required by law to notify directly, uCertify will coordinate with the Educational Institution regarding legally required communications to students, parents, guardians, regulators, or other affected parties.

19. Links and Third-Party Services

Our Services may contain links to third-party websites or services.

uCertify is not responsible for the privacy practices of independent third parties operating outside our Services. Users should review the privacy notices of those third parties before providing personal information to them.

Third-party service providers processing information on uCertify's behalf are addressed separately under the How We Share Information section.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, legal requirements, technology, or privacy practices.

The updated version will be posted on this page with a revised 'Last Updated' date.

Where required by applicable law, contract, or the nature of a material change, we will provide additional notice or obtain appropriate consent before the change takes effect.

21. Contact Us

Questions, privacy requests, COPPA inquiries, or concerns regarding this Privacy Policy may be directed to: