GAIA Biomodels Ltd

1. Who we are

GAIA Biomodels Ltd (“we”, “us”, “our”) is a company registered in England and Wales. We create anatomical training models, simulation kits and online training for veterinary professionals.

We are the Data Controller responsible for your personal data.

Contact for data matters:

GAIA Biomodels Ltd

12 Rudge Close, Gloucester, GL2 4ET, United Kingdom

info@gaiabiomodels.com

We are not legally required to appoint a Data Protection Officer and have not appointed one.

This policy explains what personal data we collect, why, how long we keep it, who we share it with, and your rights. It covers our website, our online shop, and the GAIA Training System (our online learning platform).

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. The data we collect

We collect different data depending on how you interact with us. We have grouped it below.

2.1 If you buy from us or contact us about a purchase

• Name, job title, and role
• Business email address and phone number
• Company or practice name
• Billing and delivery address
• Order history and the products or licences you have purchased
• Payment is processed by our payment provider (Stripe). We do not store your card details.

2.2 If you are a learner on the GAIA Training System

When your organisation purchases training access for you, your training coordinator provides us with your name and email address so we can create your account.

While you use the platform, we collect:

• Account details: name, email, username, account creation date
• Professional details: your role (vet, nurse, technician) and your practice
• Progress data: lessons, modules and topics started and completed; the last step you visited; course start and completion dates; total time spent
• Assessment data: quiz attempts, answers given, scores, pass/fail results, time spent on each quiz, and the full history of attempts
• Derived data: progress status (for example “on track” or “not started”), average quiz scores, days since last login, and estimated time to completion

We use this data to run the course, record your progress, generate your monthly progress report, and produce your completion certificate.

2.3 Reporting to your training coordinator

If you are a learner whose access was purchased by an organisation, we share your progress and assessment data with that organisation’s training coordinator. This allows them to monitor the training they have arranged and funded.

We do not share anything with your coordinator that we do not also share with you. You receive the same monthly progress report that your coordinator receives.

2.4 Technical data

When you use the website, we automatically collect:

• IP address
• Browser type and version, operating system and device
• Login activity and security logs (failed login attempts, account lockouts), which we keep for security purposes
• Cookies necessary for the site to function, to keep you logged in, and for site caching

We have configured the platform so that advertising and marketing tracking does not operate inside the logged-in training area. Inside the course, we only collect what is needed to run the training and record your progress.

2.5 Marketing and website analytics (public pages only)

On our public website pages (not inside the training platform), we may use analytics and advertising tools, including tools provided by Meta, Google and TikTok, to understand how visitors use our site and to show relevant content.

These tools run only where you have given consent through our cookie banner. You can change or withdraw your cookie preferences at any time. See section 7 for more on cookies.

2.6 Special category data

We do not collect special category data (such as data about your health, race, ethnicity, religious beliefs, sexual orientation, political opinions, trade union membership, or genetic or biometric data). We do not collect data about criminal convictions.

We do not collect data about animal patients. The training uses simulation models, not live animals.

3. Our legal basis for using your data

Under UK GDPR we must have a legal basis for processing your data. We rely on the following.

3.1 Performance of a contract

When your organisation buys training access for you, we process your account data, progress data and assessment data, and share progress reports with your coordinator, because this is necessary to deliver the training service that has been purchased. This is our main legal basis for the training platform.

The organisation that purchases your access is responsible for informing you that your data will be shared with us and that your progress will be visible to your coordinator. We require the purchasing organisation to confirm this in writing before we activate accounts.

3.2 Legitimate interests

We process some data because it is reasonably necessary to run our business and does not override your rights. Examples: keeping security logs to protect accounts, keeping records of who to contact about an order, and improving our course content by looking at how the course is used across all learners in an aggregated form.

3.3 Consent

We rely on consent for specific things, such as sending you marketing emails (if you opt in) and running advertising or analytics cookies on our public website. You can withdraw consent at any time.

3.4 Legal compliance

We process some data because the law requires it, for example keeping financial records for the period required by UK tax law.

4. Who we share your data with

We do not sell your personal data. We share it only as set out below.

4.1 Your training coordinator

As described in section 2.3, if your training access was purchased by an organisation, your progress and assessment data is shared with that organisation’s training coordinator.

4.2 Service providers (processors)

We use third-party service providers who process data on our behalf and under our instructions. These currently include:

• Website and platform hosting
• Stripe — payment processing
• ActiveCampaign — email communications and, on public website pages only, site analytics
• Anthropic — we use AI tools to help generate progress reports from course data
• Google — where we use Google Workspace and Google Drive to store business documents

Each of these providers is required to keep your data secure and use it only for the purposes we specify. We will keep this list up to date.

4.3 Advertising platforms (public website only)

On our public website pages, and only with your cookie consent, tools from Meta, Google and TikTok may receive data about your visit. These platforms have their own privacy policies:

• Meta
• Google
• TikTok

These tools do not operate inside the logged-in training platform.

4.4 Legal and business transfers

We may share your data if required by law, to enforce our terms, or in connection with a sale, merger or transfer of our business. If our business is transferred, your data would be covered by the acquiring company’s privacy policy, but the data would remain protected.

5. How long we keep your data

We keep your personal data only as long as necessary for the purpose we collected it.

• Training account and progress data: for the duration of your training access, plus 12 months after it ends, after which it is deleted or anonymised.
• Order and financial records: for the period required by UK tax law (currently 6 years).
• Security logs: 90 days
• Marketing data: until you opt out, after which we stop using it for marketing.

We may keep data longer if there is a complaint or a realistic prospect of legal proceedings.

6. Your rights

Under UK GDPR you have the following rights:

• Right to be informed — to know how we use your data (this policy)
• Right of access — to receive a copy of the data we hold about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to ask us to delete your data, where there is no overriding reason to keep it
• Right to restrict processing — to ask us to limit how we use your data in certain circumstances
• Right to object — to object to processing based on legitimate interests, and to object to direct marketing at any time
• Right to data portability — to receive certain data in a structured, machine-readable format

To exercise any of these rights, email info@gaiabiomodels.com. We will respond within one month. There is no fee unless the request is clearly unfounded or excessive.

You can also delete your account at any time by contacting help@gaiabiomodels.com 

If you are a learner and you want your data erased, please note that this may affect your ability to complete the training, and we may need to inform the organisation that purchased your access.

You have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority (www.ico.org.uk). We would appreciate the chance to address your concerns first, so please contact us before approaching the ICO.

7. Cookies

Our website uses cookies. Some are strictly necessary for the site to work and to keep you logged in. Others, used only on our public pages, support analytics and advertising and run only with your consent.

You can manage your cookie preferences through our cookie banner at any time.

8. How we protect your data

We use technical and organisational measures to keep your data secure. Access to personal data is limited to people who need it, and they are bound by confidentiality obligations.

No transmission of data over the internet can be guaranteed to be completely secure. While we work to protect your data, we cannot guarantee the security of data you send to us, and you do so at your own risk. If you believe your account is no longer secure, contact us immediately.

9. International transfers

Some of our service providers may process data outside the UK. Where this happens, we take steps to ensure your data receives a level of protection consistent with UK data protection law, for example through approved safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

10. Third-party links

Our website may contain links to other websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies.

11. Changes to this policy

We keep this policy under review and will post any updates here, with a revised date. For significant changes, we will take reasonable steps to notify you.

12. Contact

For any questions about this policy or your data, contact:

GAIA Biomodels Ltd

12 Rudge Close, Gloucester, GL2 4ET, United Kingdom

info@gaiabiomodels.com