Who this notice is for
This notice explains how your personal information is used when you use AI Pulse, the AI training, assessment and guidance platform provided to you by your organisation. It covers everyone with an account: staff, volunteers, contractors and administrators.
Who is responsible for your information
your organisation decides why and how your information is used on AI Pulse, so it is the controller of your information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Blenheim Innovation builds and runs the platform for your organisation. It acts as a processor: it handles your information only on your organisation's instructions, to provide and look after the service, and for no other purpose.
If you have a question about your information, contact your organisation's data protection lead.
What information we hold about you
- Your account: your name, work email address, role on the platform, department, job title (if given), and whether your account is active.
- How you sign in: a securely scrambled (hashed) password if you use one, a link to your organisation's single sign-on account if you use that, and your two-factor authentication settings. We never store your password in a readable form, and recovery codes are stored hashed.
- Your learning: the modules you start and finish, your answers to activities and assessments, your scores, the levels and certificates you earn, training assigned to you, and your answers to surveys.
- The AI tools you use: which tools you have access to, any tools you told us you already have when you first signed in, and any access requests you make, including the reason you gave and the reviewer's reply.
- Things you create or share: outputs you choose to save, posts and comments you share in Knowledge Share, and files you upload.
- Group activities: the group sessions you're booked on or attend, and for hackathons your group, attendance and your group's scores and feedback.
- Quizzes: your answers and times. Leaderboards show your first name, the initial of your surname and your department to other people in your organisation.
- AI coach and sandbox: what you type is sent to the AI service so it can reply (see “Who we share it with”). We keep a record of how much you used these features, but not the conversation itself, unless you choose to save an output.
- Security and audit records: a log of changes administrators make, such as adding people or changing access, so that changes can be checked.
We don't ask for sensitive information such as health, religion or ethnicity, and you shouldn't enter it into the platform or into AI tools.
Why we use it, and our lawful basis
your organisation uses your information to:
- give you access to the platform and keep your account secure
- provide training suited to your role, level and the tools you have
- record your progress, results and certificates
- let your managers and the platform's administrators support your learning and see how training is going across the organisation
- manage access to AI tools and the rules that keep work information safe
- run group sessions, hackathons and quizzes
- keep the platform working, secure and improving.
The lawful basis is legitimate interests: helping staff use AI safely and well, meeting your organisation's responsibilities for how information is handled, and supporting your development. Where your training is a requirement of your job, it may also be needed to carry out your employment contract. You can ask your organisation's data protection lead for more detail about how these interests were balanced against your rights.
Who can see your information
- You can see your own learning, results and progress at any time.
- Administrators in your organisation can see the people in the organisation, their progress and results, so they can support learning, assign training and report on how it's going. Depending on how your organisation has set up reporting, wider reports show people by name or only as totals for groups large enough that no one can be singled out.
- Editors and authors see what's needed to review shared posts and to build and run training.
- Other colleagues see only what you choose to share, such as Knowledge Share posts, and quiz leaderboards as described above.
- Blenheim Innovation support staff can access the platform only to provide, support and secure the service for your organisation.
People in other organisations that use AI Pulse cannot see your information. Each organisation's information is kept separate by the database itself.
Who we share it with
We don't sell your information or use it for marketing. We share it only with these service providers, under contracts that require them to protect it:
- Microsoft Azure hosts the platform and its database in the United Kingdom.
- Anthropic provides the AI that powers the coach, the sandbox and some activity marking. When you use these features, what you type is sent to Anthropic to generate a reply. Under its commercial terms, Anthropic doesn't use this information to train its models. Anthropic may process it outside the UK, protected by UK-approved safeguards.
- Your organisation's sign-in provider, such as Microsoft Entra ID, if your organisation uses single sign-on.
How long we keep it
We keep your information for as long as you have an account with your organisation on AI Pulse. When an administrator removes you, your learning records, saved outputs, tool access, certificates and posts in your organisation are deleted. Your account itself is deleted too, unless you also belong to another organisation on the platform. Training that you set up for others is kept so that it keeps working for them.
Backups are kept for a short period for disaster recovery and are then overwritten.
Cookies
We use only the cookies needed to sign you in and keep you signed in securely. Your sign-in lasts up to 12 hours. We also remember whether you prefer the light or dark theme on your own device. We don't use advertising or tracking cookies.
Keeping it secure
Your information is encrypted while it travels over the internet and is stored in a private database that can't be reached directly from the internet. your organisation can require single sign-on or two-factor authentication, and administrator changes are logged.
Your rights
You have the right to
- ask for a copy of the information we hold about you
- ask us to correct anything that's wrong
- ask us to delete your information, or to stop or limit how it's used
- object to how it's used, where we rely on legitimate interests
- receive your information in a format you can move elsewhere, where that applies.
To use any of these rights, contact your organisation's data protection lead. You won't normally be charged, and you'll get a reply within one month.
If you're unhappy with how your information has been handled, please contact your organisation's data protection lead first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this notice
We'll update this notice when the way we use your information changes. The date it was last updated is shown at the top.