Privacy Policy

Generic Curriculum Passport · Last updated 14 August 2026

This policy explains what personal data the Generic Curriculum Passport collects, how we use it, who we share it with, how long we keep it, and your rights under UK data protection law. It applies to everyone who uses the Platform — trainees, educators, and administrators.

1. Who we are

The Generic Curriculum Passport (“the Platform”, “we”, “us”, “our”) is operated by CJ Butterworth Ltd, a company registered in England and Wales (company number 11687742), registered office 22 Leslie Avenue, Wirral, CH49 1RS.

CJ Butterworth Ltd is the data controller for personal information processed through the Platform, and is registered with the UK Information Commissioner’s Office (ICO), registration number ZB079327. If you have any questions about this policy or how your data is handled, email support@generic-curriculum-passport.co.uk.

2. Who this policy covers

Only trainees register directly for the Platform and accept our Terms and Conditions at registration. Educators — Assigned Educational Supervisors (AES), Training Programme Directors (TPD), External Assessors, and Associate Deans — are invited onto the Platform by a trainee or an administrator rather than registering themselves. This policy applies equally to educator accounts: the same principles of lawful, transparent, and minimal use of personal data apply, even though educators do not separately tick a Terms acceptance box.

3. Information we collect

If you are a trainee, we collect:

• Your title, name, email address, and password (stored as a one-way hash — we cannot read it);
• Your GDC registration number and phone number (phone is optional);
• Your specialty and deanery (Str trainees), or training year dates (Dct trainees);
• Your training year records and self-assessed RAG (Red/Amber/Green) progress against the GDC generic curriculum;
• The evidence files you choose to upload to demonstrate your training. You must not upload any patient-identifiable information — see our Terms and Conditions, clause 7;
• Comments left on your portfolio by educators linked to your account;
• Notifications, and your account/subscription status.

If you are an educator, we collect:

• Your title, name, email address, and password (hashed);
• Your GDC registration number, phone number, and deanery;
• Your role (AES, TPD, External Assessor, or Associate Dean) and the specialty/deanery scope that role applies to;
• Any comments you make on a trainee’s portfolio.

For everyone, we also automatically record sign-in timestamps and account-level security events (such as password resets or account changes) in an internal audit log, for security and support purposes.

4. How we use your data

We use your personal data to:

• provide and operate your training portfolio, and the educator oversight functions linked to it;
• send you essential account emails — email verification, password resets, educator invitations, and access-expiry warnings. We keep email volume to a minimum and do not send marketing newsletters or promotional email;
• maintain a security and audit log of account-level events;
• respond to support tickets and enquiries you send us;
• produce anonymised, aggregate statistics for administrative oversight (for example, how much evidence exists in a given domain across all trainees). These statistics are never used to identify an individual trainee to anyone outside the Platform.

5. Who we share your data with

• Your linked educators (AES, TPD, External Assessor, Associate Dean) have read-only access to your training records, RAG progress, and evidence, for the purpose of supervising your training. Only educators you (or your training programme) have linked to your account can see your data — other trainees can never see it.
• Platform administrators can access account data as needed for support, account administration, and to operate the Platform.
• Service providers who help us run the Platform (see section 6 below), strictly to provide their service to us.

6. Service providers we use

We use a small number of specialist providers to run the Platform. Each is only permitted to use your data to provide their service to us — not for their own purposes.

• Hostinger — hosts our website and database, on infrastructure located in the United Kingdom.
• Cloudflare (R2 storage) — provides secure cloud storage for the evidence files you upload. Your files are stored on infrastructure located in Europe.
• Resend — sends our transactional email on our behalf (verification, password reset, and notification emails). Resend is based in the United States, so sending you an email involves transferring your name and email address there for that purpose. This transfer is protected under the UK Addendum to the EU Standard Contractual Clauses, and Resend is also certified under the UK Extension to the EU–U.S. Data Privacy Framework — both are safeguards recognised under UK data protection law for this kind of transfer.

We do not currently process card payments directly through the Platform. If this changes in future (for example, if a subscription needs to be paid for directly rather than funded by your deanery), we will update this policy before doing so to explain how a payment provider would handle your data.

7. Cookies

The Platform uses a single essential cookie to keep you securely signed in while you use it. We do not use analytics, advertising, or tracking cookies of any kind, and no other website or company can use cookies to track you through the Platform.

8. How long we keep your data

We keep your data for as long as your account is active. If you close your account (Settings → Data & Privacy → Danger Zone), it is immediately marked for deletion and access ends straight away. For a short period afterwards you can restore your account simply by signing in again. Once that period ends, we permanently delete your account together with your training records, evidence files, comments, and notifications.

Security and audit log entries are kept separately, for a limited period (currently three months), after which they are deleted. If your account is deleted before then, any remaining log entries are anonymised so they no longer identify you.

9. Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• rectification — ask us to correct inaccurate or incomplete data;
• erasure — ask us to delete your data (you can also do this yourself by closing your account, as described above);
• restrict how we use your data in certain circumstances;
• data portability — receive a copy of your data in a portable format. You can download a full ZIP export of your evidence at any time from Settings → Data & Privacy; and
• object to certain uses of your data.

To exercise any of these rights, email support@generic-curriculum-passport.co.uk. We may need to verify your identity before acting on a request.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you think we have not handled your personal data properly: ico.org.uk, or by telephone on 0303 123 1113. We would appreciate the chance to address your concern directly first, at the email address above.

10. Keeping your data secure

Passwords are stored as one-way cryptographic hashes and are never stored or visible in plain text. Evidence files are stored in access-controlled cloud storage that only the Platform can reach. Access to your account requires your password, and we log account-level security events for monitoring purposes. No method of storage or transmission over the internet is completely secure, but we take reasonable technical and organisational steps to protect your data.

11. Who can use the Platform

The Platform is intended for GDC-registered dental professionals resident in the United Kingdom, and is not directed at or intended for use by children.

12. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Your RAG (Red/Amber/Green) progress is a self-assessment that you record yourself — it is never calculated or decided automatically on your behalf.

13. Changes to this policy

We may update this policy from time to time, for example if we introduce a new feature or service provider that changes how we handle your data. If we make a significant change, we will let you know. The “Last updated” date at the top of this page always reflects the current version.