Last updated 20 October 2026
This policy explains how SMUG Training Ltd, trading as Sports Medicine Ultrasound Group (SMUG), uses your personal information when you visit our website, contact us, book training or use our learning resources. It also explains your choices and rights.
Who is responsible for your information
SMUG Training Ltd is the data controller. This means we decide why and how your information is used. We are registered with the Information Commissioner’s Office (ICO). We follow UK data protection law, including the UK GDPR and Data Protection Act 2018, as amended.
For privacy questions or requests, email info@ultrasoundtraining.co.uk. You do not need to contact our software providers separately to exercise your rights over information we control.
Information we collect
We collect information you give us through enquiries, bookings, forms, emails and learning accounts. If an employer, colleague or other organiser books for you, they may give us your name, contact details, professional role and course information. We use this to arrange your place and contact you about the course.
Depending on the service, we collect your name, email, phone number, organisation, job role, relevant qualifications or experience, billing details and booking choices. We also keep payment and refund records, correspondence, attendance, course progress, feedback and certificate information.
Our website and learning platforms also collect technical information such as your IP address, browser, device, login activity and pages or resources used. Where you agree to analytics, we use visit information to understand and improve the website. We keep records of marketing choices and consent where relevant.
Information you need to provide
We only ask for information relevant to the service. If you do not provide essential booking, eligibility or payment information, we may be unable to confirm your place or provide course access. Optional feedback and marketing choices do not affect your booking.
Sensitive information
Please do not send identifiable patient records, scans or case histories through booking forms, ordinary email or the learning portal. Remove patient identifiers from any teaching material you submit.
If you ask for accessibility support or tell us about an allergy or other health need, we use only the details needed to arrange support. We normally ask for your explicit consent to use health information, alongside our legitimate interest in making suitable arrangements. We restrict access and only share necessary details with those arranging the support. You can withdraw consent, although this may limit the support we can arrange. If another legal condition applies, we will explain it.
Why we use your information
Data protection law requires a lawful basis for each use of personal information. We use the following bases.
- Contract – to take steps you request before booking, confirm and administer your booking, take payment, send joining instructions, provide learning resources, record progress and issue certificates where applicable.
- Legitimate interests – to answer general enquiries, administer employer bookings where you are not personally party to the contract, manage attendance, improve training, protect our systems, prevent fraud and handle complaints or legal claims. We consider your privacy and do not use this basis where your rights override those interests.
- Legal obligation – to keep required tax and accounting records and respond to lawful requests from regulators or authorities.
- Consent – for marketing where required, optional analytics and any other optional use for which we ask permission. Health information needs an additional legal condition, as explained above.
Marketing and your choices
We use Mailchimp to send course news and updates. We send marketing emails with your consent, or under the existing customer “soft opt-in” where the legal conditions are met. This means we obtained your details directly during a sale or genuine discussion about a sale, the messages concern our own similar services, and you were offered an easy opt-out both when we collected your details and in every message. A previous booking alone does not automatically meet these conditions.
You can unsubscribe using the link in any marketing email or email info@ultrasoundtraining.co.uk. We keep a limited suppression record so that we respect your choice. Unsubscribing does not stop essential booking, payment or course access messages.
Where email engagement tracking is enabled, Mailchimp can record opens, clicks, IP address and device information. We use this to understand engagement and improve communications, subject to any consent required for tracking technologies. You can contact us about tracking or unsubscribe from marketing.
Who we share information with
We do not sell your personal information. We share it only where needed to provide services, run our business or meet legal requirements.
Ticket Tailor manages bookings, attendee information, tickets and booking messages. Xero manages billing, invoices and accounting records. Thinkific hosts learning accounts, resources, progress and certificates. Mailchimp manages email marketing, preferences and related engagement information.
These providers generally process the information we upload on our behalf under their data processing terms. Hosting data with them does not remove SMUG’s responsibility for it. Providers may separately act as controllers for their own legal, security or business purposes, as explained in their privacy notices.
Other service providers and recipients
Stripe processes card payments, as described on our website. Full card details are entered with the payment provider; we do not store full card numbers or security codes. We receive payment status, transaction references and limited payment information needed to manage bookings, invoices and refunds.
Our website host and technical support providers help run and secure the site. Google services support website analytics, form spam prevention and delivery of fonts or embedded content. Content delivery services such as jsDelivr deliver website files. These services may receive technical information, including your IP address, when your browser connects to them.
Where necessary, authorised staff, tutors and course venues receive limited information to administer attendance, access and agreed support. We may also share relevant information with accountants, professional advisers, insurers, payment providers and authorities where needed for their role or required by law. An employer funding your place may receive necessary booking and invoice information; this does not give them unrestricted access to your learning account.
Information processed outside the UK
Our providers and their subcontractors may store or access information outside the UK, including in the United States, Canada, New Zealand and other countries where they operate. We do not promise that all information stays in the UK.
Where UK transfer rules apply, we use a recognised legal safeguard. This may be a UK adequacy regulation, covering an eligible country or recipient, or approved contractual safeguards such as the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. Additional protections are used where required.
The providers’ standard terms describe their transfer arrangements. Thinkific and Xero provide UK contractual safeguards for restricted transfers. Mailchimp describes the Data Privacy Framework and contractual safeguards, including the UK Addendum where applicable. Ticket Tailor requires safeguards for relevant overseas subcontractors. You can ask us for details or a copy of the safeguards relevant to your information, with confidential details removed where necessary.
Cookies and linked services
We use essential technologies for functions such as security, remembering preferences and running bookings. Our cookie controls offer a choice about Google Analytics. Optional analytics is used with your consent, and you can change your choice through Cookie settings in the website footer.
Our separate cookie policy explains the technologies, providers and durations. Booking windows, learning platforms and videos may connect to other services when you use them. Their own notices explain their processing; this policy still applies to information SMUG controls. You can visit linked resources without subscribing to our marketing.
Keeping information secure
We use appropriate technical and organisational measures to protect personal information, including secure connections, access controls and limiting access to those who need it for their work. Our providers also operate security measures under their contracts. No online service can guarantee complete security. We assess suspected breaches and notify affected people and the regulator where legally required.
How long we keep information
We keep information only for as long as needed for its purpose and any applicable legal requirements. We then delete it securely or anonymise it. Different records may have different retention periods.
- Enquiries – normally up to 12 months after our last contact, unless an ongoing booking, complaint or other issue requires longer.
- Routine course administration – normally up to 12 months after the course. Financial records, learning records and information needed for a dispute are considered separately.
- Invoices and accounting records – normally six years from the end of the relevant accounting year, or longer where tax rules, an investigation or another legal requirement requires it.
- Learning accounts and certificates – while we provide your agreed resource access and for as long afterwards as necessary to administer completion, verify attendance or certificates, and deal with related enquiries or claims. We review whether identifiable records are still needed; we do not keep every account indefinitely simply because deletion has not been requested.
- Marketing – while we have a valid basis to contact you, subject to periodic review. We stop marketing when you opt out and retain only the limited information needed to honour that choice and demonstrate compliance.
- Website analytics – the website’s stated retention period for identifiable analytics event data is up to 14 months. Cookie lifetimes are separate and are described in the cookie policy. Security logs are retained for the period needed to detect and investigate misuse. Health or support details are deleted when arrangements and any related issues have been resolved, unless a lawful reason requires longer retention.
We may retain relevant information longer for an unresolved complaint, legal claim or other legal duty. Deleted data may remain in restricted backups until the provider’s normal backup cycle replaces it.
Your rights and how to use them
Depending on the circumstances, you can ask for a copy of your information, correction of inaccurate information, deletion, restriction of use, or transfer of certain information to you or another provider in a usable format. You can object to use based on legitimate interests and object to direct marketing at any time. You can withdraw consent without affecting the lawfulness of earlier use.
Email info@ultrasoundtraining.co.uk. We may ask for information to verify your identity. Requests are normally free and answered within one month. If the law allows extra time or an exception applies, we will explain this and tell you about your complaint rights.
We do not use solely automated decisions that have legal or similarly significant effects on you.
Complaints and policy updates
Please contact us if you have a concern on info@ultrasoundtraining.co.uk. You can also complain to the Information Commissioner’s Office at any time through its complaints page. You do not need our permission to do so.
Our services are aimed at adults and healthcare professionals. If we learn that we have collected children’s information inappropriately, we will take appropriate steps to remove it. We update this policy when our practices change and show the revision date at the top. We will provide additional notice where a significant change requires it.