Privacy Policy

This policy applies to the CareWays Collaborative web platform ("Careways", "we"): the public site, the educational module (courses, assessments, telesimulation, certificates and forums) and the clinical data module (patient registry and network indicators).

By creating an account or using the platform you accept the processing described here. If you use the platform on behalf of a healthcare institution, this policy is complemented by any agreements your institution has with the Collaborative.

We only collect what we need to run the platform:

• Account data: name, email address and password. The password is never stored in plain text, only as a hash.
• Professional profile: profession, specialty, institution, intensive care unit, country, city, phone, time zone and preferred language.
• Learning activity: video progress, assessment answers and scores, telesimulation participation and evaluations, issued certificates, forum posts and personal notes.
• Clinical data that authorized clinicians record about pediatric ICU patients. How it is handled is described on the "HIPAA & health data" page.
• Technical and usage data: IP address, browser, pages visited and interactions with the interface, which we use for security, auditing and product improvement.
• Messages you send us through the contact form.

We use your data to:

We do not sell personal data or use it for advertising.

• Create and protect your account: verify your email with a code and let a lead from your network approve your access.
• Give you access to the modules that match your role and your institution.
• Track your progress, issue your certificates and let third parties verify that they are authentic.
• Send you service emails: verification, password resets, telesimulation invitations and reminders, and forum notifications.
• Compute aggregated network indicators and support research aimed at reducing preventable mortality in pediatric ICUs.
• Keep the platform secure, audit access to sensitive data and understand which parts of the product need improvement.

Your data is only shared in these cases:

• Within the network: the Collaborative's champions, educators and analysts see your profile and progress in order to approve accounts, support your training and measure the program.
• With providers that run the platform on our behalf: web hosting (Vercel), database (Oracle), transactional email (Resend), product analytics (PostHog) and video hosting. They only access what they need to provide their service.
• When required by law, by a competent authority or to protect people's safety.
• Indicators presented to the network or in publications are aggregated and do not identify clinicians or patients.

Each certificate has a verification code. Anyone who has it can confirm on the platform that it is authentic, along with the holder's name, the program and the issue date. Your email and institution are not shown.

We use the following cookies:

The session and language cookies are required for the platform to work. You can delete the others from your browser and the platform will keep working.

• cw-session: keeps you signed in. It is essential, it is signed, and page scripts cannot read it.
• cw-locale: remembers the language you chose.
• cw-sidebar-collapsed: remembers whether you collapsed the side menu.
• PostHog cookies and local storage: measure product usage and may record browsing sessions outside the screens that show patient data. See the "Security" section.

All communication with the platform is encrypted (HTTPS). Access to each module depends on your assigned role and institution, and critical changes to patient data are written to an audit log.

On screens that show patient data, analytics does not record clicks or text, session recording is turned off and URLs are sent without identifiers. No system is infallible: if you spot a security issue, let us know right away.

We keep your data while your account is active and for as long as needed for the purposes described here, including verifying certificates that have already been issued.

If you ask us to delete your account, we will delete or anonymize your personal data, except what we must keep by law, for the traceability of the audit log, or so that an issued certificate can still be verified.

Depending on the data protection law that applies to you, you can ask to access, correct or delete your data or to receive a portable copy, and you can object to or restrict certain uses.

You can update most of your information from your Profile. For anything else, write to us through the contact form; we will respond within the time frames set by the applicable law.

The Collaborative's network brings together institutions from several countries, and some of our providers process data outside your country, for example in the United States. In those cases we require protections equivalent to those in this policy.

The platform is intended for healthcare professionals and, in some programs, for adult parents and caregivers. It is not directed at minors and we do not knowingly collect their account data. Clinical data about pediatric patients is recorded by authorized clinicians under their institution's responsibility.

We may update this policy. We will publish the current version on this page with its update date and, if the change is significant, we will let you know by email or within the platform.

For any question about this policy or about your data, write to us through the site's contact form.