1. Who We Are
lern.life ("we", "our", "us") is an AI-powered education platform operated from the United Kingdom. Our services are accessible at lern.life and our sub-domain portals including uni.lern.life, pharma.lern.life, school.lern.life, and redcross.lern.life.
We are committed to protecting the privacy of all users — students, teachers, institutional administrators, and visitors. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For data protection enquiries, contact us at: privacy@lern.life
2. Data We Collect
2.1 Account and Identity Data
- Full name, email address, and password (hashed)
- Profile photograph (optional, uploaded by the user)
- Institution name and role (student, teacher, administrator)
- OAuth profile data if you sign in via Google, LinkedIn, or GitHub (name, email, profile picture)
- Date of birth (where required for age verification)
2.2 Learning Activity Data
- AI tutoring and conversation history
- Assignment submissions and AI-generated feedback
- Quiz responses, scores, and performance analytics
- Career pathway progress and completion records
- Interview practice session recordings and feedback
- Resume and cover letter content you create on the platform
2.3 Technical and Usage Data
- IP address, browser type, operating system, and device type
- Pages visited, features used, and session duration
- Cookies and session tokens (see Section 7)
- Error logs and performance data
2.4 Files and Uploads
- Documents uploaded to the platform (PDFs, DOCX, TXT) for assignment review or knowledge base training
- Images uploaded for AI headshot generation
- Course materials uploaded by teachers to train the platform's AI knowledge base
3. How We Use Your Data
- Delivering the service: authenticating your account, providing AI tools, storing your progress, and generating personalised content
- Personalisation: our AI tutoring remembers your learning history and struggles to give contextually relevant support — this is core to the product's value
- Assessment and feedback: processing submitted assignments through our AI grading pipeline and returning feedback to you and, where applicable, your teacher
- Analytics and improvement: understanding how the platform is used to improve features and fix issues. We use aggregated, anonymised data for this purpose
- Communication: sending service notifications, grade alerts, deadline reminders, and account security messages
- Security and fraud prevention: detecting and responding to unauthorised access, abuse, or security threats
- Legal compliance: meeting our obligations under UK law, including responding to lawful requests from authorities
We do not use your personal data for advertising. We do not sell, rent, or trade your personal data to any third party.
4. Legal Basis for Processing
Under UK GDPR, we process personal data on the following legal bases:
- Contract performance: processing necessary to provide the service you have signed up for (Articles 6(1)(b))
- Legitimate interests: analytics, platform improvement, and security monitoring, where these do not override your fundamental rights (Article 6(1)(f))
- Consent: for optional cookies and marketing communications, where we ask for your explicit consent (Article 6(1)(a))
- Legal obligation: retaining records as required by applicable law (Article 6(1)(c))
For users under 18, we rely on the additional safeguards described in Section 9 (Children's Privacy).
5. Data Storage and Security
All data is stored on Amazon Web Services (AWS) infrastructure, with servers in the eu-west-1 (Ireland) and ap-south-1 (Mumbai) regions. We apply the following security measures:
- HTTPS-only encrypted transmission (TLS 1.2+) for all data in transit
- AES-256 encryption for sensitive data at rest
- JWT-based authentication with automatic session expiry
- Role-based access control — student data is never accessible to users of a different organisation
- Two-factor authentication (2FA) available for all accounts
- Regular security assessments and penetration testing
- File storage in private S3 buckets — not publicly accessible
In the event of a personal data breach, we will notify affected users and the UK Information Commissioner's Office (ICO) within 72 hours where required by law.
6. Data Sharing
We share personal data with third parties only in the following circumstances:
- AI model providers: prompts and responses are processed through large language model APIs (such as those operated by Anthropic or OpenAI) under strict data processing agreements. We do not permit these providers to use your data to train their models.
- Cloud infrastructure: AWS provides our hosting, storage, and content delivery infrastructure
- Your institution: where you are enrolled via an institution (university, school, or employer), that institution's administrators may view your learning progress and grades as part of their subscription
- Legal requirements: we may disclose data to law enforcement or regulatory bodies when legally required to do so
We do not share your data with advertisers, data brokers, or any commercial third parties for their own purposes.
7. Cookies
lern.life uses cookies and similar technologies to operate the platform:
- Essential cookies: session tokens required for authentication and secure platform access. These cannot be disabled without breaking the service.
- Functional cookies: remembering your preferences (theme, language, layout settings)
- Analytics cookies: understanding how the platform is used (aggregated, anonymised). You can opt out at any time via your account settings.
We do not use advertising or tracking cookies. We do not use third-party analytics services that transfer data outside the UK or EU without adequate safeguards.
8. Data Retention
- Active accounts: data is retained for as long as your account is active
- Deleted accounts: personal data is deleted within 30 days of account deletion. Anonymised learning analytics may be retained for platform improvement.
- Uploaded files: assignment submissions and course materials are retained for 12 months after the relevant course or engagement ends, then deleted unless the institution requests extended retention
- Conversation history: AI conversation logs are retained for 90 days by default to support the AI tutoring memory feature, then deleted. You can clear your conversation history at any time in Settings.
- Backup data: encrypted backups are retained for up to 30 days
9. Children's Privacy
lern.life's core platform (uni.lern.life) is designed for users aged 16 and over. For the school.lern.life portal, which serves learners under 16, we apply additional safeguards:
- Parental or guardian consent is required for users under 13
- Age-appropriate content filters are applied across all AI tools
- AI conversation history for under-16 users is retained for 30 days only
- School administrators (not individual teachers) hold responsibility for student data under their institution's Data Protection agreement with lern.life
- We comply with the UK Children's Code (Age Appropriate Design Code) for any service likely to be accessed by children
10. Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right to access: request a copy of the personal data we hold about you
- Right to rectification: request correction of inaccurate or incomplete data
- Right to erasure ("right to be forgotten"): request deletion of your personal data where there is no overriding legal basis for continued processing
- Right to restriction: request that we limit how we process your data while a dispute is resolved
- Right to data portability: receive your data in a machine-readable format to transfer to another service
- Right to object: object to processing based on legitimate interests, including profiling
- Rights related to automated decision-making: not to be subject to decisions made solely by automated processing that significantly affect you, without human review
To exercise any of these rights, email us at privacy@lern.life. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
11. International Transfers
Our primary data storage is within the EU/EEA (AWS eu-west-1, Ireland), which provides adequate protection under UK GDPR. Where data is processed by AI providers whose infrastructure operates outside the UK/EEA, we ensure adequate safeguards are in place via Standard Contractual Clauses (SCCs) or equivalent mechanisms.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-platform notification at least 14 days before the change takes effect. The "Last updated" date at the top of this page indicates when the policy was most recently revised. Continued use of the platform after a change constitutes acceptance of the updated policy.
13. Contact Us
For any privacy-related questions, requests, or complaints:
- Email: privacy@lern.life
- General enquiries: hello@lern.life
- Website: lern.life