Privacy Policy
GAIA Biomodels Ltd
Last updated: 7 October 2026
1. Who we are
GAIA Biomodels Ltd (“we”, “us”, “our”) is a company registered in England and Wales. We create anatomical training models, simulation kits and online training for veterinary professionals.
We are the data controller responsible for your personal data, and we are registered with the Information Commissioner’s Office (ICO).
Contact for data matters:
GAIA Biomodels Ltd
12 Rudge Close, Gloucester, GL2 4ET, United Kingdom
We are not legally required to appoint a Data Protection Officer and have not appointed one.
This policy explains what personal data we collect, why, how long we keep it, who we share it with, and your rights. It covers our website, our online shop and the GAIA Training System (our online learning platform).
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
2. The data we collect
We collect different data depending on how you interact with us. We have grouped it below.
2.1 If you buy from us or contact us about a purchase
- Name, job title and role
- Business email address and phone number
- Company or practice name
- Billing and delivery address
- Order history and the products or licences you have purchased
- Online orders go through our WooCommerce shop, and payments are processed by our payment provider (Revolut). We do not store your card details.
2.2 If you are a learner on the GAIA Training System
Where your data comes from. If your practice enrolled you, the person organising the training at your practice gives us your name, job title and work email through our setup form, so we can create your account. If you bought access yourself, you gave us these details directly.
While you use the platform, we hold:
- Account details: name, work email, username, job title, practice and the date your account was activated
- Progress data: lessons, modules and topics started and completed; the last step you visited; course start and completion dates; total time spent
- Assessment data: quiz attempts, answers given, scores, pass or fail results, time spent on each quiz and the full history of attempts
- Your CPD certificate
We use this data to run the course, record your progress and issue your CPD certificate.
2.3 What we do not share with your practice
We do not send your progress or assessment data to your practice. Practices can choose to keep their own GAIA Learner Tracker, which they fill in themselves through conversations with their team. We do not have access to it.
We do not use AI tools on learner data. We do not use learner data for marketing and we do not add learners to our marketing emails. If you choose to sign up to our free resources, that is a separate decision covered by section 3.4.
2.4 Technical data
When you use the website, we automatically collect:
- IP address
- Browser type and version, operating system and device
- Login activity and security logs (failed login attempts, account lockouts), which we keep for security purposes
- Cookies necessary for the site to function, to keep you logged in, and for site caching
We have configured the platform so that our advertising and marketing tracking does not operate inside the logged-in training area. Inside the course, we only collect what is needed to run the training and record your progress.
Course videos play through Vimeo. When you watch a video, Vimeo receives technical data such as your IP address and device details, and the Vimeo video player may set its own cookies. You can read how Vimeo uses this data in Vimeo’s privacy policy.
2.5 Marketing and website analytics (public pages only)
On our public website pages (not inside the training platform), we may use analytics and advertising tools, including tools provided by Meta, Google and TikTok, to understand how visitors use our site and to show relevant content.
These tools run only where you have given consent through our cookie banner. You can change or withdraw your cookie preferences at any time. See section 8 for more on cookies.
2.6 Special category data
We do not collect special category data (such as data about your health, race, ethnicity, religious beliefs, sexual orientation, political opinions, trade union membership, or genetic or biometric data). We do not collect data about criminal convictions.
We do not collect data about animal patients. The training uses simulation models, not live animals.
3. Our legal basis for using your data
Under UK GDPR we must have a legal basis for processing your data. We rely on the following.
3.1 Legitimate interests: learners enrolled by their practice
When your practice enrols you on the GAIA Training System, we rely on legitimate interests. Your practice has bought the training for its team, and we need your account, progress and assessment data to deliver it to you. We only ask for what we need, and you can object at any time (see section 6).
We ask practices to let their team know they will receive access. We also tell you directly, in the email we send when your account is ready.
3.2 Performance of a contract
When you buy from us, or buy training access for yourself, we process your data because it is necessary to deliver what you have purchased.
3.3 Other legitimate interests
We process some data because it is reasonably necessary to run our business and does not override your rights. Examples: keeping security logs to protect accounts, keeping records of who to contact about an order, and improving our course content by looking at how the course is used across all learners in an aggregated form.
3.4 Consent
We rely on consent for specific things, such as sending you marketing emails (if you opt in) and running advertising or analytics cookies on our public website. You can withdraw consent at any time.
3.5 Legal compliance
We process some data because the law requires it, for example keeping financial records for the period required by UK tax law.
4. Who we share your data with
We do not sell your personal data. We share it only as set out below.
4.1 Service providers (processors)
We use third-party service providers who process data on our behalf and under our instructions. These currently include:
- Hostinger: hosts our website and training platform on servers in Frankfurt, Germany, with backups in France
- Vimeo: stores and plays our course videos from the United States
- JotForm: receives the team details practices send us through our setup form, and stores them in Germany. We delete them once accounts are set up
- Microsoft (Outlook): our business email, including the email that tells learners their account is ready
- Revolut: payment processing for online orders and bank transfers
- ActiveCampaign: marketing emails to people who have opted in, and analytics on public website pages only
Each of these providers is required to keep your data secure and use it only for the purposes we specify. We will keep this list up to date.
4.2 Advertising platforms (public website only)
On our public website pages, and only with your cookie consent, tools from Meta, Google and TikTok may receive data about your visit. These platforms have their own privacy policies:
These tools do not operate inside the logged-in training platform.
4.3 Legal and business transfers
We may share your data if required by law, to enforce our terms, or in connection with a sale, merger or transfer of our business. If our business is transferred, your data would be covered by the acquiring company’s privacy policy, but the data would remain protected.
5. How long we keep your data
We keep your personal data only as long as necessary for the purpose we collected it.
- Learner accounts and training data: your practice’s training access lasts 12 months from its start date, which is when we activate the accounts for your practice, not from the date you first log in. If you join later, your access ends at the same time as everyone else’s at your practice. We contact your practice about two months before access ends to talk about renewal. When access ends, we close your account and delete or anonymise your data within 30 days. Please download your CPD certificate before your access ends, as it is deleted with your account.
- Team details sent through our setup form: deleted once accounts are set up.
- Order and financial records: for the period required by UK tax law (currently 6 years).
- Security logs: 90 days.
- Marketing data: until you opt out, after which we stop using it for marketing.
We may keep data longer if there is a complaint or a realistic prospect of legal proceedings.
6. Your rights
Under UK GDPR you have the following rights:
- Right to be informed: to know how we use your data (this policy)
- Right of access: to receive a copy of the data we hold about you
- Right to rectification: to have inaccurate data corrected
- Right to erasure: to ask us to delete your data, where there is no overriding reason to keep it
- Right to restrict processing: to ask us to limit how we use your data in certain circumstances
- Right to object: to object to processing based on legitimate interests, and to object to direct marketing at any time
- Right to data portability: to receive certain data in a structured, machine-readable format
To exercise any of these rights, email privacy@gaiabiomodels.com. We will respond within one month. There is no fee unless the request is clearly unfounded or excessive.
You can also ask us to close your account at any time by emailing help@gaiabiomodels.com.
If you are a learner and ask us to delete your data, you will no longer be able to complete the training, and we will let your practice know that your account has been closed.
7. Questions and complaints
If you have a question, concern or complaint about how we use your personal data, email privacy@gaiabiomodels.com. You don’t need to use any particular wording. We will:
- acknowledge your complaint within 30 days
- look into it without undue delay and keep you updated
- tell you the outcome
If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk.
8. Cookies
Our website uses cookies. Some are strictly necessary for the site to work and to keep you logged in. Others, used only on our public pages, support analytics and advertising and run only with your consent.
Inside the training platform, we only use the cookies needed to keep you logged in and run the course. The Vimeo video player used for course videos may also set its own cookies (see section 2.4).
You can manage your cookie preferences through our cookie banner at any time.
9. How we protect your data
We use technical and organisational measures to keep your data secure. Access to personal data is limited to people who need it, and they are bound by confidentiality obligations.
No transmission of data over the internet can be guaranteed to be completely secure. While we work to protect your data, we cannot guarantee the security of data you send to us, and you do so at your own risk. If you believe your account is no longer secure, contact us immediately.
10. International transfers
Hostinger and JotForm store our data in the European Union (Germany and France), which the UK recognises as providing an adequate level of protection.
Vimeo stores our course videos in the United States. Vimeo is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as providing adequate protection.
Where any other provider processes data outside the UK, we make sure your data receives a level of protection consistent with UK data protection law, for example through approved safeguards such as the UK International Data Transfer Agreement or adequacy regulations.
11. Third-party links
Our website may contain links to other websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies.
12. Changes to this policy
We keep this policy under review and will post any updates here, with a revised date. For significant changes, we will take reasonable steps to notify you.
13. Contact
For any questions about this policy or your data, contact:
GAIA Biomodels Ltd
12 Rudge Close, Gloucester, GL2 4ET, United Kingdom