PRIVACY POLICY
Last Updated: October 29, 2025
1. Introduction
This Privacy Policy ("Privacy Policy" or "Policy") applies to the website () and platform operated by Learn Care Together LLC doing business as CNA Simulations ("us," "our," "we"), and any other interactions we have with you online, over the phone, or in person (collectively, the "Services"). By using our Services, you accept this Privacy Policy and Terms of Use, which are hereby incorporated. If you disagree with this Privacy Policy, please do not use the Services.
Below, we describe the personal data we collect, your privacy choices, and other relevant details about how we handle your information.
1.1 FERPA Compliance for Educational Institutions
When an educational institution subject to FERPA (34 CFR § 99.31(a)(1)) designates CNA Simulations as a "school official" and requests that we process student education records on its behalf, we do so solely under that institution's direction and in accordance with FERPA requirements. Such designation must be explicit in a written agreement that identifies CNA Simulations as a school official and specifies (1) the legitimate educational interest for data use, (2) restrictions on re-disclosure, and (3) obligations for secure destruction of education records at the institution's direction.
In all other cases, such as when institutions purchase access without such designation or when learners access CNA Simulations independently, FERPA does not apply, and data are handled in accordance with this Privacy Policy and applicable state privacy laws.
2. Information Collection: Categories and Sources
2.1 Categories of Personal Data Collected
We collect the following categories of personal data:
(a) Identifiers: Contact information such as your name, email address, and phone number; user name and password.
(b) Educational and Professional Information: Caregiver type (for example, home healthcare provider); status as student, instructor, or administrator; title; name of school or organization; courses taken on our platform and grades received; completed hours of coursework; performance data for classes taken on our platform; and information about in-person courses taken in educational institutions in connection with certifications we facilitate, including hours completed.
(c) Financial Information: Payment information necessary to process purchases of our services.
(d) Electronic and Network Information: IP address and other electronic information collected about your interactions with our platform and courses.
2.2 Sources of Personal Data
We may collect personal data from the following sources:
Visits to and interactions with our website or platform.
Purchases and use of our Services, including our courses.
Instructors or educational institutions we partner with.
Governmental entities or their contractors, in connection with programs such as Caring4Cal.
Referral agencies or organizations.
Inquiries or requests for a demo of our Services.
Questions, requests, or feedback submitted directly to us.
Attendance at events we sponsor or participate in.
Sign-ups for our waitlist or interest in future products or services.
Sign-ups for our email newsletter and alerts.
Purchase of access codes through bookstores or third-party course materials platforms.
2.3 FERPA Context for Institutional Use
When explicitly designated as a school official by an educational institution subject to FERPA, CNA Simulations acts as a service provider processing student data solely on behalf of and under the direction of the educational institution. The institution retains all ownership and control rights over student education records.
3. Third-Party Service Providers
We use third-party service providers (such as cloud hosting) who may access data only to perform services on our behalf. When processing education records, these providers are bound by written agreements requiring compliance with FERPA's limitations on use and re-disclosure, including a prohibition on any use of education records for non-institutional purposes. We do not sell or share education records with third parties for their own purposes.
A complete list of our current third-party subprocessors (including Heroku/AWS, Google Workspace, Mailgun, ActiveCampaign, and others) is provided in Section 12B of our Terms of Use and is available upon request.
ActiveCampaign is used only for marketing communications to institutional administrative contacts. Student education records are never processed through ActiveCampaign. We do not send marketing communications to students through ActiveCampaign.
4. Use in Academic Settings (Bookstore Access Model)
If you access CNA Simulations using a code purchased from a bookstore or institutional course materials platform, your personal data will be collected and used by CNA Simulations in accordance with this Privacy Policy. If the platform is assigned by your instructor as part of a course, your performance and simulation usage data may be shared with your instructor to support educational outcomes.
When the platform is assigned by your instructor at an educational institution that has executed an agreement with CNA Simulations that explicitly designates us as a "school official" under FERPA (such as a FERPA Addendum), we act as a service provider processing student data under the institution's direction and in accordance with FERPA requirements. For bookstore access without such explicit designation, data handling is governed by applicable state privacy laws.
5. Instructor Access
Access to student data is controlled by the educational institution. The institution designates which instructors and administrators may access student performance data through our platform. Instructors and administrators designated by the institution can view data for students at their institution in accordance with the institution's determination of legitimate educational interest and FERPA requirements. All users with access to student data are subject to the same FERPA confidentiality requirements as the educational institution and may not disclose student information to unauthorized parties.
6. Cookies and Other Tracking Technologies
6.1 Distinction Between Public Website and Student Platform
CNA Simulations operates both (a) a public informational website at , and (b) a secure learning platform for registered users at (or equivalent).
Marketing and advertising cookies (such as Meta/Facebook Pixel, Google Analytics, or ActiveCampaign) are used only on the public website for outreach and communications with educators or institutional partners. These tools are never deployed within the student learning platform or any environment where education records are processed.
Within the learning platform, only cookies and analytics essential to service performance, security, and technical support are used, and those do not collect or share personally identifiable student information.
Note: The analytics and marketing tools described below apply only to our public-facing website, not to the student learning platform.
6.2 Categories of Cookies and their Purpose
We collect information about your visit to our website and platform using cookies and similar technologies. A "cookie" is a small data file sent from a website to your device's browser. Cookies help us personalize your online experience, recall your preferences for future visits, analyze how you use our site, and improve our services.
We may use, now or in the future, the following categories of cookies on our website (including, but not limited to, the examples below):
(a) Strictly Necessary Cookies: These are essential for the operation of our site. They allow you to move around the site, log in, use secure areas, and access core features.
(b) Performance Cookies: These collect information about how you use our website, such as which pages you visit and how you arrived here. They help us understand and improve site performance. We may use analytics tools, currently including, but not limited to, Google Analytics and Microsoft Clarity, to better understand user behavior and optimize our Services.
(c) Functionality Cookies: These remember your preferences and choices on our site (for example, your preferred language or region). They may also be used to provide enhanced features and tailor your visit.
(d) Marketing Cookies: Marketing cookies are used only on our public-facing marketing website () for outreach and engagement with educators and institutional partners. These cookies may help us understand how visitors interact with our public website and email campaigns, measure campaign effectiveness, and provide content relevant to educators.
On the authenticated student learning platform (app.cnasimvr.com), we do not use any marketing cookies. The platform uses only essential cookies necessary for authentication, session management, and platform security. We never deploy tracking pixels, analytics cookies, or third-party advertising cookies in any environment where education records or student data are processed.
6.3 Managing Cookie Preferences
For residents of states requiring opt-in consent (including California, Colorado, Connecticut, and Virginia), we obtain affirmative consent before placing any non-essential cookies and provide clear mechanisms to accept, reject, or customize cookie preferences. All users can manage their cookie preferences at any time through our cookie settings tool or opt out of certain advertising cookies via industry association opt-outs.
Declining these cookies will not affect essential site functionality.
7. Analytics and Tracking Tools
Note: The analytics and marketing tools described below apply only to our public-facing website, not to the student learning platform.
7.1 Tracking Practices in the Learning Platform
Within the secure learning platform, tracking technologies are used only to support platform operations, security, and user experience. We do not use, share, or disclose student education records for advertising, cross-site tracking, or marketing analytics. All tracking technologies used in connection with education records are limited to functional, performance, and security purposes only.
7.2 Tracking Practices in the Public-Facing Website
On our public-facing website, we may use, now or in the future, third-party analytics and tracking tools to better understand how visitors interact with our site, improve our services, and support marketing and outreach to educators and institutional partners. These tools can help us measure site usage, identify trends, and enhance your experience.
(a) Google Analytics: We may use Google Analytics to understand how users interact with our website and improve our services. Google Analytics can collect information such as pages visited, time spent on pages, and how you arrived at our site. Google Analytics does not collect personal information unless you provide it to us. For more details on how Google collects and uses your data, please review Google's Privacy Policy.
(b) Microsoft Tools: We may use Microsoft Clarity and Microsoft Advertising to capture behavioral metrics, heatmaps, and session replay to improve and market our Services. Website usage data may be captured using first- and third-party cookies and similar technologies to determine how frequently our Services are accessed and how users navigate our site. This information may also be used for site optimization, fraud and security purposes, and, where permitted, limited outreach to institutional partners in accordance with state privacy laws. We do not use analytics data for targeted advertising to individuals.
We may add or remove analytics and tracking tools over time and will update this Privacy Policy to reflect any material changes in how we collect or use analytics data. If you wish to limit analytics tracking, you can manage or decline optional cookies through our cookie settings tool or adjust your browser's privacy settings.
8. How We Use Your Personal Data
We process personal data as necessary to provide our services, comply with legal obligations, and perform our contracts with institutions and users.
We collect and use your data for purposes including, but not limited to:
to provide you with our Services;
to process your payments for goods or services;
to communicate with you;
to provide assistance in obtaining financial incentives in connection with our Services;
to respond to your queries or requests;
for marketing and advertising solely on our public website, never using student education records or learner activity data.
to conduct surveys and market research;
to manage our business operations and to improve our Services;
to investigate any wrongdoing or abuse in relation to our Services or relating to our rights or property; and
for legal purposes, including obtaining legal advice, managing disputes and risks, and complying with any laws.
Marketing and advertising activities are conducted only in accordance with your stated preferences and only on our public-facing website.
When explicitly designated as a school official by an educational institution subject to FERPA, we use student education records solely for the authorized educational purposes described in our agreement with your institution. We do not use education records for marketing, advertising, or other commercial purposes.
9. SMS Communications & Privacy
By providing your phone number, you consent to receive SMS/MMS messages from CNA Simulations for essential service communications (password resets, access expiration notices, security alerts). You may separately opt-in to receive marketing communications via SMS/MMS. In states requiring opt-in consent for marketing messages, we will obtain affirmative consent before sending marketing communications.
Your phone number will be used solely to communicate important information about our services. We handle your information responsibly and do not share or sell mobile phone numbers to third parties for marketing purposes.
You may opt out of receiving SMS messages at any time by replying 'STOP' to any message or contacting us at hello@cnasimvr.com. Standard message and data rates may apply.
We comply with all applicable laws and regulations, including the Telephone Consumer Protection Act (TCPA).
If you need assistance or have questions about our SMS service, reply with 'HELP' to any SMS message you receive, or contact our customer support team at (240) 213-3050.
10. Data Sharing
We share personal data in the following circumstances:
10.1 Training Institution or Program Sponsor
With your training institution or program sponsor and their authorized instructors, who can view your performance data for educational and program management purposes.
10.2 Third-Party Service Providers
With third-party service providers (such as cloud hosting or analytics platforms) who process data on our behalf under written contracts that prohibit use or re-disclosure of personal data, including education records, except to provide contracted services.
10.3 Legal Obligations
As legally required to comply with legal obligations, court orders, or to protect safety and security.
10.4 Business Transactions
In business transactions such as mergers, acquisitions, or asset sales.
10.5 Educational Institutions Subject to FERPA
When explicitly designated as a school official by an educational institution subject to FERPA, we limit data sharing to only those purposes permitted under FERPA and act solely as a service provider under the institution's direction. We do not share education records from educational institutions subject to FERPA for commercial or marketing purposes.
11. Third-Party Access Platforms
If you access CNA Simulations through a third-party bookstore or course materials platform (such as RedShelf, VitalSource, or a similar service), we may exchange limited information with that platform to facilitate access and user authentication. However, CNA Simulations is not responsible for the privacy practices or data handling of such third-party platforms. We encourage you to review their privacy policies directly.
If your institution integrates CNA Simulations with a learning management system (LMS), such as Canvas, Moodle, or a similar platform, we may share limited personal data with the LMS to support account syncing, authentication, grade reporting, or other instructional functions. This may also apply to future integrations that facilitate delivery or tracking of course activities.
12. Third-Party Websites
Our Services provide links to websites and online resources. These links are provided for your convenience, but this Privacy Policy does not govern these websites and resources. You should carefully review the privacy policy and terms of use for any website you access through a link from our website.
Unless specifically stated, we do not intend to imply any approval, association, sponsorship, endorsement, or affiliation with any linked website. We are not responsible for examining or evaluating, and we do not warrant the offerings of, any businesses or individuals or the content of their websites. We do not assume any responsibility or liability for any other third parties' actions, products, services, and content.
13. International Transfers
CNA Simulations operates entirely within the United States. We do not transfer personal data outside the U.S. for processing or storage. All data collected through our Services, including education records, are hosted and processed on servers located in the United States.
14. Information Security
We implement reasonable and appropriate administrative, technical, and physical security measures to protect your data, including encryption of data in transit and at rest, access controls, regular security assessments, and monitoring for potential vulnerabilities. While no system is completely immune to security risks, we continuously monitor and update our security practices to meet or exceed requirements under FERPA and applicable state privacy laws.
You also share responsibility for maintaining the security of your information. We encourage you to use strong, unique passwords, avoid sharing login credentials, and promptly notify us if you suspect any unauthorized use of your account.
14.1 Data Retention and Deletion
We retain personal data as long as necessary to provide our services, including training delivery, progress tracking, and certification preparation. For educational institutions subject to FERPA that have designated CNA Simulations as a school official, data retention and deletion are governed solely by the institution's written direction.
14.2 Data Breach Notification
In the event of a confirmed data breach affecting your personal information, CNA Simulations will notify affected parties without unreasonable delay and in accordance with applicable law. For institutions in states with data breach notification requirements, notification will be provided in accordance with applicable state law without unreasonable delay. For institutions subject to FERPA that have designated CNA Simulations as a school official, notification will be provided without unreasonable delay and in coordination with the educational institution, consistent with FERPA and applicable federal and state data-breach laws.
CNA Simulations will work with the institution to determine the appropriate timing, content, and method of notice to affected individuals or regulators. Each notice will include a general description of the incident, categories of data affected, mitigation steps taken or planned, and recommended actions, to the extent known at the time.
For all institutions not subject to specific statutory requirements, notification will be provided no later than 30 days after discovery. Notifications will include a description of the breach, types of data affected, mitigation steps taken, and recommended actions. For detailed breach response procedures, see Section 12B of our Terms of Use.
14.3 Educational Institutions Subject to FERPA
When serving educational institutions subject to FERPA that have designated CNA Simulations as a school official, CNA Simulations retains student education records only as directed by the institution. Upon written direction from the institution, student data will be retained for up to 6 months following course completion to allow continued student access for certification exam preparation. Absent written direction to retain data, CNA Simulations will delete or return student data within 30 days of course completion or access termination. Institutions in states with comprehensive privacy laws must provide specific written authorization for any retention period exceeding 30 days. The institution may direct earlier deletion at any time, and CNA Simulations will complete deletion within 30 days of such request.
During any post-course access period authorized by the institution, CNA Simulations continues to act under the institution's direction as a school official with respect to the student's education records. The institution maintains control over the records and may direct deletion at any time.
After the authorized retention period, or upon the institution's written instruction, CNA Simulations will delete or anonymize student education records.
Anonymization Standards: Data that has been anonymized cannot reasonably be used to identify individuals and is no longer considered personal data. Anonymization will comply with industry standards to ensure data cannot reasonably identify individual students. For education records subject to FERPA, anonymization will meet the requirements for non-identifiable information under 34 CFR §99.31(b)(1), ensuring data cannot be used to identify students either alone or in combination with other information.
14.4 Deletion Rights
All users may request deletion of their personal data at any time by contacting hello@cnasimvr.com. Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws have the right to request deletion in accordance with applicable state law. We will honor deletion requests for identifiable data within the timeframe required by applicable state law (typically 45 days for residents of California, Colorado, Connecticut, and Virginia; 60 days for residents of other states). Once data has been anonymized, it can no longer be deleted, as it cannot be linked to any individual.
15. Your Privacy Rights
15(a) FERPA and General Access Rights
The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords parents, or students over the age of 18, the right to have access to certain education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records.
For students using CNA Simulations at educational institutions subject to FERPA that have explicitly designated CNA Simulations as a school official, you may contact your institution to exercise rights under FERPA.
CNA Simulations supports educational institutions in fulfilling their FERPA obligations by providing timely access to, correction of, or deletion of education records upon the institution's verified request. CNA Simulations typically fulfills such requests through the educational institution, unless the institution has delegated CNA Simulations to respond directly as a school official under written agreement.
Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws may also contact us directly at hello@cnasimvr.com to exercise state privacy rights, including rights to access, correct, delete, obtain a copy of your data, and opt out of sales/sharing. We will respond within the timeframe required by applicable state law (typically 45 days).
For all other users: You may contact us directly at hello@cnasimvr.com to request access, correction, or deletion of your personal data in accordance with applicable privacy laws and our retention practices.
California's "Shine the Light" law permits California residents to request, once a year, free of charge, information about certain categories of personal data we disclosed to third parties in the preceding calendar year for those third parties' direct marketing purposes. If you are a California resident, you may have this information emailed to you by sending a letter to the address listed in Section 19 with your email address and a request for this information, or by emailing your request to hello@cnasimvr.com.
To exercise your rights, contact us at hello@cnasimvr.com.
15(b) State Privacy Rights
Depending on your location and how you access our services, you may have rights to access, correct, delete your data, and opt out of certain data sharing practices. Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, Virginia, and other states with privacy laws can exercise these rights by contacting hello@cnasimvr.com.
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, Virginia, or another state with a comprehensive privacy law, you have specific rights, including:
Right to Know/Access: Confirm what personal data we process and access that data
Right to Correct: Correct inaccuracies in your personal data
Right to Delete: Request deletion of your personal data
Right to Data Portability: Obtain a copy of your data in a portable format (where applicable)
Right to Opt Out: Opt out of (1) the sale of your personal data, (2) sharing for targeted advertising, and (3) profiling for automated decisions with legal or significant effects.
To exercise these rights, email hello@cnasimvr.com with your state and specific request in the subject line (e.g., 'California Opt-Out Request'). We will respond within the timeframe required by applicable state law (typically 45 days).
We do not currently engage in targeted advertising or automated decision-making based on profiling. If our practices change, we will update this policy and provide clear opt-out mechanisms before implementing such practices.
For detailed information about state privacy law compliance, including response timelines, appeal procedures, and verification methods, see Section 12C and Section 25 of our Terms of Use.
15(c) Consent and State-Specific Privacy Laws
Where required by applicable state privacy laws, including those of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, Virginia, and any other state that enacts a similar law, we will not collect, use, or disclose personal data for purposes considered a "sale," "targeted advertising," or processing of "sensitive data" without providing clear notice and, where required, obtaining your prior consent.
When we rely on consent, you may withdraw it at any time by emailing hello@cnasimvr.com or by adjusting preferences through our cookie or privacy settings tool.
15(d) State Privacy Law Procedures
For residents of states with comprehensive privacy laws:
Response Timelines: We will respond to verified requests within the timeframe required by your state's law:
California, Colorado, Connecticut, Virginia: 45 days (with possible 45-day extension)
Other states: As specified by applicable law
Verification: We use reasonable methods to verify your identity, which may include matching at least two data points you provide with data we maintain.
Appeal Process: If we deny your request, residents of Colorado, Connecticut, Montana, Oregon, and Virginia may appeal by emailing hello@cnasimvr.com with '[State Name] Privacy Appeal' in the subject line. We will respond within 60 days. If your appeal is denied, you may contact your state attorney general.
Business Transactions: In the event of a merger, acquisition, or asset sale, residents of states with comprehensive privacy laws will receive notice at least 30 days in advance and may opt out of data transfer by submitting a written request. See Section 24.5 of our Terms of Use for details.
For complete state privacy compliance procedures, see Sections 12C and 25 of our Terms of Use.
16. Children's Information
CNA Simulations is designed for students enrolled in certified nursing assistant (CNA) or related healthcare training programs, which generally serve learners aged 14 and older. Our Services are not directed to children under 14, and we do not knowingly collect or maintain personal information from anyone under that age.
When CNA Simulations is used by an educational institution subject to FERPA that designates CNA Simulations as a school official, all learner data are treated as Education Records and handled in accordance with the institution's written direction and our obligations as a school official under FERPA.
When learners access CNA Simulations independently (outside an institutional agreement), any personal data they provide is processed in accordance with this Privacy Policy and applicable state privacy laws, consistent with the data classification framework described in Section 12A of our Terms of Use.
If we become aware that information from a person under 14 has been collected outside an institutional program, we will promptly delete it and prevent future collection.
17. Accessibility
If you need accessibility assistance, please contact us at hello@cnasimvr.com.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will notify you about material changes to this Policy by placing a notice on our website. We encourage you to periodically review this Policy to stay informed about our current privacy practices.
19. Contact Us
If you have any questions about this Policy, please contact us at:
Learn Care Together LLC
d/b/a CNA Simulations
Mailing Address:
4600 Powder Mill Road, Suite 450 #1069
Beltsville, MD 20705
Email: hello@cnasimvr.com
Phone: (240) 213-3050
Website: www.cnasimvr.com