The Data Controller responsible for the personal data collected through the Platform is Agência de Investigação Clínica e Inovação Biomédica (Agency for Clinical Research and Biomedical Innovation - AICIB), with headquarters at Rua Direita do Viso, 120, 4250-198 Porto. For privacy matters, you can contact AICIB at capacitarmais@aicib.pt (preferred) or its Data Protection Officer at privacy@aicib.pt.

AICIB is committed to the protection of your personal data and respects your privacy on all its websites within the aicib.pt domain.

This privacy policy on the protection of individuals with regard to the processing of personal data is based on the Regulation (EU) 2016/679 (GDPR).

The e-service on the AICIB website or platform is a service or resource that improves communication between the community and AICIB.

Purposes of processing

 

Types of e-services offered on AICIB website and platform:

• Information services that provide easy and effective access to information.
• Interactive communication services for training and feedback regarding progress and scores.

The AICIB-CAPACITAR+ online learning platform is designed for external stakeholders, students, working professionals, and public in general, interested or involved in Clinical Research and Biomedical Innovation. The platform offers tools for providing learning materials and resources (e.g., online courses and events, interactive live webinars, skills assessments). To delivering learning services, the platform brings together content providers/publishers, teachers, mentors, learning managers, programme and platform administrators, who collectively provide the learning experience on the platform to their learners and visitors. The various roles that convene to design, deliver and manage the learning experiences on the platform are performed by AICIB staff or approved contractors.

 

Information storage

 

The platform, its content and the user data are stored on Pantheon Systems, Inc.'s infrastructure, which was contracted by AICIB to provide the Online Learning Platform. The data is stored in Pantheon Systems, Inc.'s data centres, which comply with the European Union's security requirements regarding the transfer and protection of personal data. Pantheon Systems, Inc. has also provided AICIB with the necessary legal compliance guarantees.

 

Data subjects 

 

Data subject(s) are

Internal to the organisation

• Staff who are interested in or need to publish, consume, or manage platform content.

External to the organisation

• External professionals, students and citizens from around the world who are interested in participating in courses and events within the CAPACITAR+ platform.
• External professionals, such as content providers, teachers, mentors, programme managers, platform administrators and learning managers, who have been contracted by the AICIB-CAPACITAR+ to provide and manage content, or to manage the platform.
• External entities and professionals, such as content providers, teachers, mentors, programme managers, and learning managers, who contract the platform to provide and manage content.

 

Description of the data categories that will be processed

 

In order to carry out the processing operations described in this privacy statement, AICIB collects and processes the following categories of mandatory and non-mandatory personal data:

I. Mandatory data collection:

– Required data for AICIB-CAPACITAR+ Login:

• Username or e-mail address, and password.

– Data pertaining to individual and group user behaviour and content-related activity:

• Content enrolled, started, finished, certificates and badges awarded, and score achieved.

– Log files.

– Data pertaining to the capture of personal data (image/ video and/or voice) during the provision of educational content:

• Agreement to record and store data pertaining to image/ video and/or voice (authorisation forms).

– Data pertaining to the collection of consent from users aged 13 or older, including adults:

• Name, surname, country, region, employer, organization type, and occupation.

– This platform is not intended for use by persons who, under Regulation (EU) 2016/679, are considered minors.

II. Non-mandatory data collection:

– Data pertaining to user participation necessary to provide a satisfactory user experience.

– Identification data used to facilitate the experience of returning users:

• Cookies and IP address.

– Identification data used to provide a seamless user experience related to platform content provisioning:

• Preferred language of communication, topics of interest, professional summary, experience level, highest level of education attained, industry, and motivation for learning.

– Identification data used to provide services in conjunction with other AICIB platforms and initiatives:

• Users who have given consent to receive newsletters, share progress information, badges, certificates awarded with other websites and platforms.
• Identified by first name, last name, and e-mail address.

III. Other types of data specific to the processing operation:

• Educational or instructive interactive videos and capture of image and/or voice for which the provision of personal data is not mandatory, and the collection and processing of such data will be based on prior consent. 

IV. Data collected for the purposes of providing helpdesk services:

• First name, last name, and e-mail address.

 

Safeguards in place to ensure data minimization

 

– Pseudonymisation of data, where needed.

– Restriction of access:

The platform employs a “need to know” approach to data provision for the various roles that convene to design, deliver and report on educational content provision on the platform. Content publishers need to know about the learners following their courses (e.g., where they are from, professional level etc.) in order to tailor learning resources appropriately. More background administrative roles only need aggregated information, such as information of how many learners followed a particular course at a particular time, how many completed it, etc. The platform development team works carefully to ensure that only the minimum amount of data necessary to provide the service is collected, and that it is retained only for as long as needed. In addition, statistics may be necessary to assess the provision of helpdesk services (in an aggregated manner).

 

Modes of processing

 

Automated processing operations:

– To identify returning visitors and ensure a good user experience.

– To identify logged-in users and provide them with the necessary tools and dashboards.

– To provide learning content that is appropriate to the user’s role and interests.

– To provide on-platform personalised recommendations and learner journeys.

– To ensure that the user’s activity history is easily accessible to the user.

– To generate or provide users with certificates and badges related to learning progress.

– To manage online subscriptions to newsletters and their dissemination.

– To manage the generation and transmission of automated messages.

 

Manual processing operations:

The AICIB-CAPACITAR+ platform management tools allow certain higher-level roles (e.g., site managers and administrators) to access lists of all users and user profiles on the platform, filter and query these lists by user fields (such as name, last logged in, etc.), and perform block operations  (e.g., sending messages, emails, etc., whenever the user’s notification settings permit this). At the level of programmes, programme managers will only have access to aggregated user data. For the content delivery itself, content owners, teachers, mentors and other delivery roles can similarly access course participant lists and perform similar block operations, but only on data relevant to the delivery of the platform and its services.

These manual processing operations are performed for the purpose of:

– Ensuring a satisfactory user experience when using the platform.

– Ensuring satisfactory individual and social learning experiences when consuming platform content.

– Collecting information related to the use of the platform by individuals and groups for compiling aggregated reports.

– Ensure correct management and monitoring of training objectives of the courses available on the CAPACITAR+ platform.

– Monitoring the type of users enrolled in learning content.

– Monitoring the number or type of users registered on the platform.

– Organising trainings, including management of participants lists.

– Ensuring efficient management and resolution of platform incidents, user-reported issues, and associated helpdesk operations.

– Performing backup and restore operations related to the platform or its content.                 

– Resolving platform or content technical issues reported by users involving user-level configurations.

– Generating individual or aggregated reporting related to user behaviour and content adoption on the platform.

– Communicating with users through the platform regarding content they are subscribed to or have access to, or related initiatives of potential interest.

 

Your rights as a data subject

 

You have the right to obtain access to your personal data, to request its rectification or erasure, the restriction of its processing or, where applicable, object to its processing or request data portability. When the processing is based on your consent or explicit consent, you also have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

For any request concerning the processing of your personal data, we invite you to use the contacts provided in the 1st paragraph of this notice.

 

Security measures

 

Short summary of overall Technical and Organisational measures implemented to ensure Information Security:

Provisions are in place to ensure professional management of IT-related assets (e.g., hardware, software, cloud infrastructure) underpinning the proper delivery of the AICIB-CAPACITAR+ platform and the services outlined. 

 

Disclaimer

 

This platform is not intended to be used by people who, under Regulation (EU) 2016/679, are considered minors.

Last update: 8th of January 2026