For colleges: data protection, accessibility and IT

Data protection

No student personal data by default. Students don't have accounts. Lecturers present the simulators; nothing is collected about the learners in the room.
Staff accounts hold only what's needed: name, work email address and role.
Hosted in the UK. Backups are kept in the UK or EU. We don't plan any transfers outside the UK and EU.
No third-party scripts, fonts, analytics or trackers, on this site or in the platform.
Strictly necessary cookies only, so there's no cookie banner. See the cookie policy.
For the platform, we act as a data processor for your organisation, and we'll provide a data processing agreement.

The platform is designed to meet WCAG 2.2 level AA. In practice that means:

Every control works with a keyboard or a presentation clicker, with a visible focus ring.
Each simulator has a text description of what it shows, kept up to date for screen readers.
Colour is never the only signal: states also use text, icons or patterns.
Animation can be reduced, following the device setting or a setting in the presenter.
Text and buttons are sized to be read and used on a large screen across a classroom.

We test with automated checks and by hand with a keyboard and a screen reader. Read the accessibility statement.

Accounts are by invitation only. Staff set their own password, and administrators must use two-factor sign-in.
Passwords are stored with a modern one-way hash, and sign-in attempts are rate limited.
Everything is served over HTTPS only.
Every simulator file is checked on the server against your organisation's licence before it is sent.
Each organisation's data is kept separate, and that separation is tested automatically.
Invitations, simulator launches and content publishing are recorded in an audit log.

What	Requirement
Browser	Microsoft Edge or Google Chrome from the last two years, on Windows 10 or 11. Other modern browsers are supported on a best-effort basis.
3D simulators	WebGL 2 with graphics acceleration. PCs without it, including most virtual desktops, get a 2D view automatically.
Installs	None. No plug-ins, extensions, downloads or pop-ups.
Cookies	First-party only. Works with third-party cookies blocked.

Domain	Used for	Protocol
`hemminglearning.co.uk`	This website and enquiries	HTTPS (443)
`app.hemminglearning.co.uk`	Sign-in, the presenter and the simulators	HTTPS (443)

HTTPS on port 443 only. No WebSockets and no other ports.
No content from third-party domains or content delivery networks.
Works with TLS inspection: no certificate pinning.
If your web filter blocks new or uncategorised domains, allowing *.hemminglearning.co.uk covers everything.