Privacy policy

Who we are

Fern Learning is run by CompasCare, a New Zealand business. In this policy, “we”, “us” and “Fern” mean CompasCare. Fern is used by homecare and disability support providers to train their teams. When a provider sets up accounts for its staff, we hold that information on the provider’s behalf. The provider decides who is enrolled and what happens to their records, and we only use it to run Fern for them. When you visit our website, sign up for a free trial or send us an enquiry, we collect that information for ourselves.

What we collect

Account details

• Your name, email address, role, and the job title, region and work type (field or office) your organisation gives us

Training records

• Courses you’re enrolled in, the pages you’ve completed and how long you spent on them
• Your quiz answers and scores
• Certificates, badges and any skills sign-offs from an assessor

Sign-in and security information

• When you use a sign-in link, we record your IP address and browser details to protect your account
• Records of sign-ins and account changes, kept in a security log

Free trial sign-ups

• Your name, email address, how you found us and your browser details
• A scrambled version of your IP address, used to stop misuse

Enquiries

• What you tell us in the contact form

Emails we send

• The address, subject and delivery status of emails Fern sends you

We don’t ask for your date of birth, home address, phone number, health information or bank details.

How we use it

• To give you access to Fern and the courses you’ve been assigned
• To show your organisation who has completed their training and when it’s due again
• To issue certificates and badges, and send reminders when training is due
• To keep accounts secure and stop misuse
• To reply to your enquiry or follow up on your free trial
• To fix problems and improve Fern

We don’t sell personal information, and we don’t use it for advertising.

Who can see it

• Your organisation: managers and assessors at your organisation can see your account and training records. Other providers can’t see them.
• Fern staff: only when needed to support your organisation or keep Fern running.
• Service providers: the companies listed below, only so they can provide their service to us.
• If the law requires it: for example, if we receive a lawful request from a government agency.

Where your information is stored

Fern’s accounts and training records are stored in Australia (Sydney). We use these service providers:

• Vercel: hosts the Fern website and app (Sydney)
• Neon: stores our database (Sydney)
• Cloud file storage: holds certificates and course files (Sydney)
• Resend: sends Fern’s emails (United States)
• Tally: provides our website contact form (European Union)
• Cloudflare Turnstile: checks free trial sign-ups are from a real person (global)
• Google Workspace: lets our team know when someone starts a free trial (global)

Where information goes outside New Zealand, we choose providers that protect it in ways comparable to the Privacy Act.

Cookies

Fern only uses cookies it needs to work:

• lms_session: keeps you signed in
• lms_mfa: used briefly while a manager enters a sign-in code
• fern_trial: remembers that you’ve used the free trial

Your browser also stores a few preferences, like narration speed and how the menu is laid out. We don’t use analytics or advertising cookies. Tally and Cloudflare may set their own cookies when you use the contact form or trial sign-up.

How long we keep it

• Training records: at least 7 years, so providers can show audit evidence. When someone leaves, their account is switched off, not deleted.
• Security logs: 2 years.
• Detailed page-timing data: 90 days. After that we only keep totals.
• Free trial accounts: closed after 90 days. We keep your sign-up details so we can follow up, unless you ask us to delete them.

Your organisation can ask us to delete its records when it stops using Fern, unless we need to keep them by law.

How we protect it

• Each organisation’s records are kept separate at the database level
• Passwords and sign-in links are stored in a scrambled (hashed) form
• Managers and administrators confirm sign-ins with a code sent by email
• Accounts lock after 5 failed sign-in attempts
• Information is encrypted when it travels between your phone and Fern

If a privacy breach is likely to cause serious harm, we’ll tell the people affected, their organisation and the Privacy Commissioner, as the Privacy Act requires.

Your rights

You can ask to see the personal information we hold about you, and ask us to correct it. If your organisation set up your Fern account, you can ask your manager, or contact us and we’ll work with your organisation to respond. We’ll reply within 20 working days. If you’re not happy with how we’ve handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

We may update this policy as Fern changes. The date at the top shows when it was last updated. If we make a significant change, we’ll let provider administrators know.

Contact us

For privacy questions or requests, use the form on our Contact page (fernlearning.co.nz/contact) and tell us it’s a privacy request. Our privacy officer will reply.