Privacy Policy
Effective
This policy explains what personal information Object Relations Institute for Psychotherapy and Psychoanalysis (Training Foundation) ("ORI", "we", "us") collects through this website and our courses, how we use it, who we share it with, and the choices and rights you have. It applies to everyone who visits the site, registers for a course, buys a course as a gift, or receives our emails.
In short
- We collect what we need to register you, take payment, run the course, issue certificates and CE credits, and keep in touch with you about our courses.
- Card and bank details are handled by Stripe and PayPal. We never see or store your full card number. If you choose automatic payments for a payment plan, Stripe keeps your card so the later installments can be charged; we keep only its brand, last four digits and expiry date, and what you agreed to.
- We do not sell your personal information, and we do not share it for other organisations' advertising.
- You can ask to see, correct or delete your information at any time by writing to admin@orinyc.org, and you can ask us to delete your account (see Deleting your account).
Who we are
Training Hub at ORI is run by Object Relations Institute for Psychotherapy and Psychoanalysis (Training Foundation), a nonprofit educational organisation chartered by the Board of Regents of the New York State Education Department (EIN 133697333). We are responsible for the personal information described here. You can reach us about anything in this policy at admin@orinyc.org.
What we collect
What you give us
- Your details: first and last name, email address and, when a course asks for it, phone number, city, country, profession and how you heard about us.
- Registration answers: your answers to a course's registration form, such as whether you are an ORI candidate in training, and, if you ask for CE credits, your profession, license type and license number and state.
- Your account: your email address. There is no password: you sign in with a link or code we email you, which we store only in a scrambled (hashed) form that cannot be read back.
- Payments: what you bought, the amounts, dates and status of each payment, and the last four digits and brand of the card used, as reported by the payment provider. For checks, the amount and the date it arrived.
- Gifts: if you give a course, the recipient's name and email address and any message you write to them.
- Scholarship applications: what you tell us in the application.
- During and after a course: your answers to notes, feedback forms and CE evaluations, and any messages you send us, including a report that your attendance for a session is wrong.
- Problem reports: what you write, any screenshot you attach, the page you were on and the name of your browser.
- Registrations on our previous website: if you registered for a course on our previous website, we keep a record of those registrations (the course, the date, your name, email address and telephone number, your answers and your payments) for reference. Only our staff see it; it is not shown in your account.
What we collect automatically
- Technical information: your IP address, browser and device type, and the pages you visit, kept in our server logs for security and to fix problems.
- Where you came from: the website or campaign link that brought you here (for example a newsletter or an advertisement), so we know which of our announcements reach people.
- Email activity: whether a link in one of our emails was clicked, so we know the emails work.
- Cookies: see Cookies below.
What we receive from others
- Payment providers tell us whether a payment succeeded, failed or was refunded.
- Zoom, for courses that meet on Zoom, tells us who joined each session: the name you joined with, your email address when Zoom has it, and when you joined and left. See Live sessions and attendance.
- CE providers may tell us whether the credits you asked for were approved.
- A friend or colleague may give us your name and email address to send you a course as a gift.
How we use it
| Why | What we use |
|---|---|
| To register you, take payment and send receipts | Your details, registration answers, payments |
| To run the course: joining details, recordings, materials, notes and reminders | Your details, registration |
| To record attendance at live sessions, and look into it when you tell us a mark is wrong | Your name and email address, when you joined and left each session, your report |
| To issue certificates of completion and arrange CE credits | Your name, attendance, CE answers, license details |
| To review scholarship applications | Your application |
| To answer your questions and fix problems you report | Your messages and reports |
| To tell you about future courses and events | Your name and email address |
| To understand which pages and announcements work, and improve them | Technical information, cookies, where you came from |
| To keep the site and your account secure and prevent fraud and spam | Technical information, account details |
| To meet our legal, tax and accreditation obligations | Payments, registrations, CE records |
If you are in the European Union or the United Kingdom, our legal bases are: performing our agreement with you when you register; our legitimate interest in running and improving our courses, keeping the site secure and telling past participants about similar courses; your consent, where we ask for it; and complying with the law.
Who we share it with
We share personal information only with the people and services that need it to do the jobs above, and each service may use it only for that job.
- Instructors and course staff see the names, email addresses and registration answers of the people on their own courses, and the answers given to that course's notes, feedback forms and CE evaluations.
- CE providers that approve credits for a course receive the attendance, license details and evaluation answers of the people who asked for credits, as their rules require.
- Payment providers: Stripe and PayPal process card and PayPal payments under their own privacy policies.
- Email: our transactional emails are delivered by an email delivery service, and our newsletters and course announcements by Mailchimp. Everyone who registers is added to our mailing list; every announcement has an unsubscribe link. If you are already on the mailing list of another ORI organisation, your registration and payment are recorded there too, so it can tell which of its announcements led to it; you are never added to a list you were not already on.
- Live sessions: for courses that meet on Zoom, Zoom receives your name and email address to give you a personal link to the course's meetings, under its own privacy policy. If our team invites you to a session as a guest, Zoom receives your name and email address to give you a link for that session; we keep only the invitation, and your attendance is not recorded.
- Recordings: recordings of sessions are hosted on Vimeo or YouTube as private or unlisted videos.
- Analytics and advertising measurement: when switched on, Google Analytics, Microsoft Clarity, the Meta Pixel and the LinkedIn Insight Tag measure how the site is used and whether our announcements lead to registrations. Microsoft Clarity may record how pages are used, with the text you type hidden. When you register or pay, Meta and LinkedIn may also be sent your email address in a scrambled (hashed) form, and the reference their advertisement added to the link you followed, so they can tell us which of our advertisements led to it. They cannot read your email address from it.
- Security: Cloudflare Turnstile checks that a real person, not an automated program, is filling in our forms.
- Hosting: the site and its database run on cloud hosting providers who store the data on our behalf.
- When the law requires it, or to protect the rights, property or safety of our participants, staff or others.
We do not sell your personal information, and we do not share it with other organisations for their own marketing.
Cookies
A cookie is a small file your browser keeps for a website. We use:
| Cookie | What it does | How long |
|---|---|---|
| lh_session | Keeps you signed in to your account. Essential. | Until you sign out, or 90 days after your last visit |
| lh_signin, lh_link | While you sign in: which sign-in email this browser asked for, and the link you opened, so the link leaves the address bar at once. Essential. | Up to an hour |
| lh_change | Holds the link that confirms a new email address while you confirm it, so it leaves the address bar at once. Essential. | Up to an hour |
| lh_ev | Remembers that you confirmed your email address with the registration form's code, so you can register from this browser. Cleared when you sign out. Essential. | 24 hours |
| lh_attr | Remembers which website or campaign link brought you here, so we can tell which announcements work. | 90 days |
| Google Analytics, Microsoft Clarity, Meta Pixel | Measure visits and registrations, when switched on. | Set by each service, up to two years |
| LinkedIn Insight Tag | Measures visits and registrations from our LinkedIn advertisements, when switched on. | Set by LinkedIn, up to six months |
| Cloudflare Turnstile | Tells people and automated programs apart on our forms. Essential. | The visit |
You can block or delete cookies in your browser's settings. If you block the essential ones, you will not be able to sign in. Blocking the others does not affect what you can do on the site.
How long we keep it
- Registrations, payments, certificates and CE records: for seven years after the course, to meet tax and accreditation requirements, and certificate details for as long as the certificate can be checked.
- Your account: until you ask us to delete it.
- Answers to notes and feedback, and attendance: for as long as the course's records are kept.
- Problem reports and server logs: up to two years.
- Mailing list: until you unsubscribe.
How we protect it
The site is served only over an encrypted connection. We store no passwords, and the sign-in links and codes we email are stored only hashed and work once, for a short time. Staff access is limited to what each role needs and is recorded, and personal files such as screenshots and exports are never public. No system is perfectly secure. Because your email signs you in to this site, please keep your email account secure, and tell us at once at admin@orinyc.org if you think someone has used your account. If your account's email address is changed, we tell the old address and sign out every other device.
Your rights and choices
- See and correct: your name, email address and registrations are in your account. You can change your name and email address under Details, or ask us to correct anything else.
- A copy: ask us for a copy of the personal information we hold about you.
- Delete: ask us to delete your account and your personal information, as described in Deleting your account.
- Stop emails about future courses: use the unsubscribe link in any announcement. You will still receive emails about courses you are registered for.
- Object or withdraw consent: to any use based on our legitimate interests or your consent.
To use any of these, write to admin@orinyc.org. We will reply within 30 days and may ask you to confirm who you are first. Depending on where you live, including California and other US states, the European Union and the United Kingdom, the law may give you further rights, and you may complain to your local data protection authority. We will not treat you differently for using any of your rights.
Deleting your account
You may ask us to delete your account at any time. To do so, write to admin@orinyc.org from the email address associated with your account on our platform. We act only on requests from that address, so that nobody else can delete your account; if you write from another address, we will ask you to confirm from the one on your account first. We will confirm by email once your account has been deleted, normally within 30 days of your request.
When we delete your account:
- your personal information is permanently removed from our systems: your name, email address, telephone number and other contact details, your sign-in, what you wrote in registration forms and applications, the documents you uploaded, our notes about you, and the records of your registrations on our previous website;
- your course activity is anonymized: records of your registrations, attendance, answers and payments are kept only in a form that no longer identifies you, so that our course records and accounts remain complete;
- any certificates of completion we issued to you are deleted: their links and verification codes stop working, and they can no longer be checked or reissued.
Deleting your account is permanent and cannot be undone. Before you ask, please save or print any certificates and receipts you wish to keep. CE certificates issued by an approving body are theirs and are not affected; to have your details removed from their records, contact them directly.
Where the law requires us to keep a record, for example of a payment for tax purposes, we keep only what that record requires, for as long as it is required, and use it for nothing else. Deleting your account does not cancel an unfinished registration or a payment still due; we will let you know if anything must be settled first.
Children
Our courses are professional education for adults. The site is not meant for children under 13, and we do not knowingly collect their personal information. If you believe a child has given us their details, write to us and we will delete them.
Links to other sites
Course pages and emails may link to other websites, such as a video conferencing service or an instructor's reading list. Those sites have their own privacy policies, and we are not responsible for them.
Where your information is kept
We are based in the United States and your information is stored and processed here. If you live elsewhere, by using the site you understand it will be transferred to the United States, where the law may differ from yours. We choose service providers who protect it as this policy describes.
Changes to this policy
When we change this policy, we update the date at the top of the page. If a change affects how we use information we already hold, we will tell you by email before it takes effect.
Contact us
Questions, requests and complaints about privacy: admin@orinyc.org. See also our Terms of Use.