This policy explains how CRACAD (Clinical Research Academy, "we", "us") collects, uses, stores and protects personal data when you visit cracad.com, contact us, enrol in a course or verify a certificate. We process personal data in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it, as they apply to us.
1. Data we collect
- Enquiries: your name, email address, and optionally your phone number, organisation and course of interest, together with your message.
- Learner accounts: your name, email address, login credentials, and the professional details needed for your certificate.
- Payments: the UPI transaction details needed to match and verify your payment. We do not collect or store your UPI PIN or bank login details.
- Learning records: course progress, time spent on lessons, test and exam attempts and results, and certificates issued.
- Technical data: basic server logs (such as IP address, browser type and pages requested) used for security and to keep the service running.
2. Why we use your data
- To reply to your enquiries.
- To create and manage your account, verify your payment and give you course access.
- To record your progress, grade assessments and issue certificates.
- To let third parties confirm a certificate you have shared with them, using the certificate ID.
- To keep our services secure and meet our legal obligations.
We process your data on the basis of your consent, which you give when you submit a form or create an account, and for other lawful purposes permitted by the DPDP Act. We do not sell your personal data and do not use it for third-party advertising.
3. Certificate verification
When someone enters a valid certificate ID on our verification page, we show limited details needed to confirm the certificate: the holder's name, the course, and the issue and expiry dates. We do not show your contact details or assessment scores.
4. Sharing
We share personal data only with service providers who help us run the service (for example hosting and email delivery), under obligations to protect it, or where the law requires. If your institution enrols you, we may share your progress and completion status with that institution.
5. Retention
We keep enquiry data for as long as needed to respond and follow up. We keep learner and certificate records for as long as your account is active and for a reasonable period afterwards so certificates can continue to be verified, unless the law requires a different period. When data is no longer needed, we delete or anonymise it.
6. Security
We use reasonable technical and organisational safeguards, including encrypted connections and access controls, to protect personal data against unauthorised access, loss or misuse.
7. Your rights
Subject to the DPDP Act, you may ask to access a summary of your personal data, correct or update it, have it erased where it is no longer needed, withdraw consent, and nominate another person to exercise your rights in case of death or incapacity. You may also raise a grievance with us. Withdrawing consent does not affect processing already carried out, and may mean we cannot continue to provide the course.
8. Contact and grievances
To exercise your rights or raise a concern, use our contact form. We will respond within the time required by law. If you are not satisfied with our response, you may approach the Data Protection Board of India.
9. Changes
We may update this policy. The date at the top shows when it was last changed.