Privacy Policy

1. Who operates this portal

The training facility identified on this page operates this portal and manages its learner records. This notice describes the application’s practices. OpenAI/ChatGPT and Cloudflare provide sign-in, hosting and database infrastructure and handle information under their own applicable agreements and privacy notices. Contact the Facility at the privacy contact shown here for questions or requests.

2. Information collected and its sources

From ChatGPT sign-in, the portal receives a Site-specific account identifier, email address and, when supplied, a display name. It does not receive or store your ChatGPT password. A Facility administrator may add your name, email and department to the roster before your first visit and may deactivate the learner record. Invitation records include the invited email, expiry and status, creator, and redemption time/account. Only a hash of the invitation token is stored; the raw token is placed in the invitation link’s URL fragment and submitted to the server when you inspect or redeem it.

The portal stores course assignments and due dates, lesson progress and training cycles; assessment scores, pass/fail results and attempt dates; and certificate identifiers, student name, course, facility details, completion date, score and any annual training date. Submitted answers are used to grade an attempt; the application stores the resulting score and pass/fail record rather than a per-question answer history.

Administrators may record workplace evaluation dates, evaluator names and notes. Do not enter medical information, Social Security numbers, financial details or other unnecessary sensitive information in free-text fields. Facility settings contain operator, instructor, signatory and contact details.

Policy acceptance records contain your account identifier, the policy versions and document snapshots, the Facility name and the server-recorded acceptance time. The application does not add an IP address or browser fingerprint to this acceptance record. Hosting and sign-in providers may process IP addresses, request details and security/session information to deliver and protect their services.

3. Purposes of use

The Facility uses this information to manage email-bound invitations, identify authorized learners, assign and deliver training, save progress, grade tests, issue and verify completion records, track refresher needs, document workplace evaluations, manage access, address record errors and maintain evidence of policy acceptance. The application does not use learner records for advertising, sell them, or share them for cross-context behavioral advertising.

4. Who can see the information

Students can access their own training records. The Facility administrator can manage and view the roster, assignments, assessment results, certificates and workplace evaluations. The administrator may export certificate records as CSV for authorized training administration and employer recordkeeping. Infrastructure providers process data as needed to operate their services. Information may also need to be disclosed when required by law or for lawful protection of people and systems.

Certificate verification is public and does not require sign-in or policy acceptance. Anyone with the exact certificate number or QR link can see the matching student name, course, training facility, completion date, public certificate identifier, training scope, and an annual training date when one exists. Assessment scores and course references are not included in the public lookup response. The service has no public student directory, name search, partial-match search or endpoint listing all certificates. Each certificate uses an independent random verification code. It does not expose the student’s email, department, internal learner/account identifier, other course records, individual failed-attempt history or workplace evaluation notes. Do not treat a QR link or certificate number as confidential once the certificate has been shared.

A student or administrator can download, print or share a certificate or wallet card. Older copies issued before public verification may require an updated download; their former internal-record links keep invited owner/student authorization rather than becoming public searches. A recipient then sees the details on that document, including any printed facility contact or signatory details. Sharing a document permits public verification of that matching completion record but does not grant access to training or learner accounts. The Facility cannot recall copies that other people have already downloaded or printed.

5. Cookies, tracking and external links

The application does not add advertising trackers or analytics scripts, create its own tracking cookies or use browser local storage to keep learner records. Fonts and QR generation are served or performed by the application; the QR is not sent to an external QR-image service. Necessary session, sign-in and security mechanisms may be used by the hosting and identity providers.

The application performs no cross-site behavioral tracking and does not change its behavior in response to a Do Not Track signal. It does not sell personal information or share it for cross-context behavioral advertising, regardless of a browser opt-out signal. The Facility’s use of a separate website may have different practices.

OSHA, NIOSH and provider reference links lead to external websites. If you follow one, that website receives the request and its own privacy policy applies. Those source websites are not embedded as tracking content in the lessons.

6. Retention, security and changes to records

The Facility keeps learner and training records for administration, historical verification and applicable training-record, employment or legal requirements. There is no automatic deletion schedule in the application. Deactivating a learner restricts portal access but does not delete historical records. Ask the Facility for the retention period that applies to your records; it should remove information when no longer needed and lawfully able to do so. Acceptance evidence may need to be kept while a claim, dispute or recordkeeping obligation remains.

Training and account access are protected through email-bound invitation redemption, sign-in, server-side authorization and HTTPS. The public course catalog, policy pages and exact certificate verification do not require an invitation. Signing in or accepting policies alone does not grant a learner account. Certificates preserve the details recorded at issue. No online service can guarantee complete security. The Facility controls training invitations, activated learners and exports and should limit account access to the people who need it. Public verification intentionally remains accessible to anyone holding the exact certificate code.

7. Your choices, requests and California privacy rights

You can decline training account terms by leaving the invitation screen or signing out; training and account features then remain unavailable. You may read course descriptions and these policies and verify an exact certificate without accepting them. Public verification of a previously issued certificate does not end when its learner signs out; contact the Facility about correction, deletion or other applicable privacy requests. To request access to your information, correction of inaccurate details, a copy, deletion where available, or information about retention, contact the Facility at the privacy contact shown on this page. Use the email associated with your roster record when practical; do not send passwords or sensitive identity documents through this portal.

The Facility may need to verify your identity and authority before acting. Requests are subject to applicable law and exceptions, including required employer records, legal holds and protection of other people’s information. These policies do not require a waiver of any applicable privacy right.

California residents may have rights to know/access, correct or delete personal information and to receive non-discriminatory treatment for exercising applicable rights. Whether particular California laws apply depends on the operator and circumstances. Use the same Facility contact to submit a request or arrange an authorized-agent request. The application does not sell or share information for cross-context behavioral advertising and does not use sensitive personal information to infer characteristics for advertising.

8. Policy changes and effective date

The effective date and version are displayed on this page. When these policies change, the updated versions will be posted here and activated learners must complete a new acknowledgment/acceptance step before further training/account use. Public visitors can continue to read policies and use exact certificate verification without a click-through agreement. The application records the version and exact policy text presented at acceptance. Contact-detail changes may be reflected in the operator details without changing the substantive policy text.