EN / ES
- For Institutions
- For EdTechs
- Company
- Blog
- Contact us
Effective date: November 2, 2026
Doctums Global LLC and its affiliated companies that do business under the Doctums name (together, “Doctums,” “we,” “us,” or “our”) provide consulting, implementation, and advisory services to colleges, universities, and the organizations that serve them. This Privacy Policy (this “Policy”) explains how we collect, use, disclose, and protect personal information, meaning information that identifies, relates to, or could reasonably be linked to an individual, and the choices and rights available to you.
1. Scope and Applicability. This Policy applies to personal information that Doctums handles for its own business purposes, including information about visitors to www.doctums.com and other websites that link to this Policy (the “Website”); representatives of our clients, prospective clients, partners, and vendors; people who subscribe to our communications, register for our events or webinars, or take part in meetings with us; and job applicants.
1.1. Client Data. When we provide services to a college, university, or other organization (a “Client”), we may receive or access data that the Client makes available to us, or create data on its behalf (“Client Data”), which may include personal information about the Client’s students, applicants, employees, and others. The Client decides how its Client Data is used, and our handling of it is governed by our agreement with the Client, the Client’s instructions, and Section 7. The Client’s own privacy notice explains how the Client handles personal information.
1.2. What this Policy does not cover. This Policy does not apply to personal information about Doctums employees, contractors, and other personnel, which we handle under separate notices provided to them. It also does not apply to websites, platforms, products, or services operated by others, including our partners and the technology providers whose platforms our Clients use.
2. Personal Information We Collect
2.1. Information you provide. Depending on how you interact with us, you may provide contact and professional information, such as your name, title, employer or institution, business email address, telephone number, and mailing address; the content of your inquiries, consultation requests, survey responses, and other communications; newsletter and event registrations and preferences, including any dietary or accessibility needs you choose to share; information about our business dealings, such as engagements, contracts, invoices, and payments and, for vendors, the banking details we need to pay you; and, if you apply for a position, the information described in Section 8. If you take part in a meeting we host, it may be recorded or transcribed, as Section 6.3 describes.
2.2. Information collected automatically. When you visit the Website or open our emails, we and our service providers collect information such as your IP address, browser and device type, operating system, the web page that referred you, pages viewed, links clicked, the date and time of your visit, approximate location derived from your IP address, and identifiers stored in cookies and similar technologies. Section 5 describes these technologies and your choices.
2.3. Information from other sources. We receive personal information from your organization, such as when a Client identifies its project contacts; from publicly available sources, such as institutional websites and professional networking profiles; from partners and other organizations that refer you to us or host events with us; from Doctums personnel who refer job candidates; and, with your authorization where the law requires it, from references and background screening providers.
2.4. Sensitive personal information. We do not seek sensitive personal information through the Website. We collect sensitive personal information about job applicants only as needed for recruiting or as the law requires, as Section 8 describes, and use it only for those purposes. Where we collect Social Security numbers, such as for employment, tax, or background screening purposes, we protect their confidentiality, limit access to personnel who need them for those purposes, and do not disclose them except as the law permits.
2.5. Biometric information. We do not collect or use biometric identifiers, such as voiceprints or scans of facial geometry, to identify individuals.
3. How We Use Personal Information. We use personal information to:
3.1. Communicate with you, respond to your inquiries and requests, and send newsletters, invitations, and other communications about our services and events, subject to your choices described in Section 12.
3.2. Provide and manage our services and our relationships with Clients, partners, and vendors, including contracting, project administration, invoicing, and payment, and plan and host events, webinars, and meetings.
3.3. Recruit and evaluate job applicants, as Section 8 describes.
3.4. Operate and improve the Website, understand how visitors use it, and measure the effectiveness of our communications and advertising.
3.5. Protect the security of our systems and information, prevent fraud, and investigate and respond to incidents.
3.6. Comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.
3.7. Evaluate and carry out a merger, acquisition, financing, reorganization, or sale of all or part of our business, and carry out other purposes that we describe when we collect the information or to which you consent.
4. How We Disclose Personal Information
4.1. Service providers. We disclose personal information to companies that perform services for us, such as website hosting and form processing; cloud productivity, collaboration, and storage; customer relationship management and email communications; project, time, and expense management; human resources, payroll, benefits, recruiting, and background screening; electronic signature; managed information technology and security; artificial intelligence tools; event and travel services; and banking and payments. Our service providers may use personal information only to perform services for us and are bound by written confidentiality and data protection obligations.
4.2. Affiliates, Clients, and partners. We share personal information among Doctums affiliates for the purposes described in this Policy. We share business contact information with Clients, technology providers, and other partners when needed to coordinate our services, and with event co-hosts when we tell you so at registration.
4.3. Advertising and analytics providers. Our Website allows certain advertising and analytics providers to collect information through cookies and similar technologies, as Section 5 describes.
4.4. Legal and business reasons. We disclose personal information to our lawyers, accountants, auditors, and insurers; when required by law, legal process, or a lawful governmental request; when we believe disclosure is necessary to protect the rights, property, or safety of Doctums, our Clients, or others; in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to confidentiality obligations; and when you direct or consent to the disclosure.
4.5. No sale for money. We do not sell or rent personal information to anyone for money. Section 5 describes the advertising technologies on our Website and how to limit them.
5. Cookies and Similar Technologies
5.1. Technologies we use. The Website uses cookies, pixels, tags, and similar technologies. Some are necessary for the Website to function and stay secure. Others help us understand how visitors use the Website and measure our outreach. We use Google tag services to manage these technologies and, where enabled, to measure Website use. We also use the LinkedIn Insight Tag, which lets LinkedIn report to us on the results of our LinkedIn advertising and the professional characteristics of our visitors, and which can be used to show our advertisements to people who have visited the Website. Google and LinkedIn may collect information about your activity on the Website and on other websites over time and may combine it with information they already hold, such as your LinkedIn account information, as their own privacy policies describe.
5.2. Your choices. You can block or delete cookies through your browser settings, although some parts of the Website may not work properly if you do. You can manage LinkedIn’s use of your activity for advertising through your LinkedIn advertising preferences or, if you are not a LinkedIn member, through LinkedIn’s guest controls. You can manage Google’s use of your information for advertising at myadcenter.google.com and can prevent Google Analytics from collecting information about your visits by installing Google’s opt-out browser add-on at tools.google.com/dlpage/gaoptout.
5.3. Do Not Track and email. Because there is no common standard for responding to browser “Do Not Track” signals, the Website does not currently change its practices when it receives one. Our emails may contain technologies that tell us whether you opened a message or clicked a link; you can limit this by turning off the automatic loading of images in your email program.
6. Artificial Intelligence and Meeting Recordings
6.1. How we use AI tools. We use enterprise-grade generative artificial intelligence tools, approved under our internal AI policy, to support work such as research, analysis, drafting, and summarization. We use these tools only under terms or settings that prevent the provider from using the information we submit to train or improve its models, and we do not use consumer or personal AI accounts for Doctums work. Our personnel review AI-assisted work before relying on it or delivering it.
6.2. AI and Client Data. We use AI tools with Client Data only as our AI policy and the Client’s agreement permit. We do not enter student records or other sensitive personal information into an AI tool unless that use has been approved in writing as our AI policy requires and is permitted by the Client’s agreement. We do not use Client Data to train or improve AI models unless the Client authorizes it in writing.
6.3. Meeting recordings and transcripts. Meetings we host may be recorded or transcribed, and an AI tool may prepare a summary that the organizer reviews. We notify participants through the meeting invitation, the meeting platform’s own notice, or both, and a participant may ask the host to turn recording or transcription off, which the host will do. We do not record or transcribe a Client’s meeting if the Client has told us it does not permit it, and where a Client’s agreement requires its consent, we obtain that consent first. We keep recordings and transcripts only as long as needed for the purpose for which they were made.
6.4. Automated decision-making. For the personal information this Policy covers, we do not use software to make, or to perform tasks substantially and directly related to making, decisions that have legal or similarly significant effects on individuals. People make those decisions, including hiring decisions. If this changes, we will update this Policy before we begin.
7. Client Data
7.1. Our role. When we handle Client Data, we act as a service provider (sometimes called a processor) to the Client, which determines the purposes for which its Client Data is used. We handle Client Data under our written agreement with the Client and on the Client’s instructions.
7.2. Our commitments. We use Client Data only to provide services to the Client that made it available and as our agreement with that Client permits. We do not sell Client Data, use it for marketing or advertising, or combine it with other data except as needed to provide the services. We limit access to Client Data to personnel and service providers who need it to provide the services and who are bound by confidentiality obligations, and we engage service providers to process Client Data only under written terms that protect it and after giving any notice our agreement with the Client requires.
7.3. Education records. When an educational institution discloses education records to us as the Family Educational Rights and Privacy Act (FERPA) permits, including under its school-official exception, we remain under the institution’s direct control with respect to the use and maintenance of those records, use them only for the purposes for which the institution disclosed them, and do not redisclose them except as the institution authorizes or FERPA permits.
7.4. Student financial aid information. When we handle student financial aid information or other customer information that a Client must protect under the Gramm-Leach-Bliley Act, we act as the Client’s service provider and maintain safeguards designed to protect that information, consistent with the Client’s obligations under the Federal Trade Commission’s Safeguards Rule.
7.5. Client platforms. Much of our work takes place within systems that a Client licenses from third parties, such as its student information system. Those providers’ handling of Client Data is governed by their agreements with the Client, not by this Policy.
7.6. Retention, return, and destruction. We keep Client Data only as long as needed to provide the services and as the Client’s agreement permits. At the end of an engagement, or earlier at the Client’s request, we return or destroy Client Data as our agreement with the Client provides or, where the agreement is silent, destroy it under our records-retention practices, unless the law requires us to keep it. Copies in system backups are deleted on the backups’ normal schedule and remain protected until then.
7.7. Requests and incidents. If your personal information is part of Client Data, please direct requests about it to the Client, such as your institution. If we receive such a request, we will refer it to the Client and help the Client respond as our agreement provides. If we become aware of a security incident affecting Client Data, we notify the Client as our agreement and applicable law require and cooperate with the Client, which is generally responsible for notifying affected individuals and regulators.
8. Job Applicants
8.1. Information we collect. If you apply for a position or express interest in working with us, we collect the information you provide, such as your resume or curriculum vitae, work history, education, qualifications, references, work authorization, and compensation expectations, as well as information from interviews and assessments, from your references, and from Doctums personnel who refer you. If we invite you to provide voluntary self-identification information, providing it is optional, and we do not use it to make hiring decisions.
8.2. Background screening. At the appropriate stage of the hiring process, and only where the law permits and with your authorization, we may obtain a background report from a consumer reporting agency. We do so, and make any related decision, in accordance with the Fair Credit Reporting Act and applicable state and local laws, including laws that require an individualized assessment of criminal history and notice before an adverse decision. For candidates outside the United States, we conduct only the screening that local law permits.
8.3. Use and retention. We use applicant information to evaluate your application, communicate with you, comply with legal obligations, and, if you join Doctums, administer your relationship with us. People make hiring decisions; if software, including an AI tool, assists with a recruiting task, a person reviews its output, and we give any notice the law requires. If you are not hired, we keep your application information for as long as the law requires and our recruiting needs justify, which may include considering you for future openings unless you ask us not to.
9. Data Security. We hold personal information in our systems and in those of our service providers, and we maintain an information security program with administrative, technical, and physical safeguards designed to protect it against unauthorized access, use, alteration, disclosure, and loss. The program is designed with reference to recognized frameworks, including the NIST Cybersecurity Framework and the CIS Controls. Our safeguards include limiting access to personnel with a business need, multi-factor authentication for remote access to our systems, encryption of information in transit to and from the Website and our systems, confidentiality obligations and security and privacy training for our personnel, written data protection terms with our service providers, and incident response procedures. No method of transmission or storage is completely secure, and we cannot guarantee the security of personal information.
10. Data Retention. We keep personal information only as long as needed for the purposes described in this Policy, including to maintain our business relationships, meet our contractual obligations, comply with legal, tax, accounting, and regulatory requirements, and establish or defend legal claims. In setting retention periods, we consider the nature and sensitivity of the information, why we hold it, our agreements, and applicable law. Section 7.6 describes how long we keep Client Data. When we no longer need personal information, we delete it securely or de-identify it so that it can no longer reasonably be linked to an individual. We may use de-identified or aggregated information for our business purposes, but we use de-identified Client Data only as the Client’s agreement permits.
11. International Transfers. Doctums is based in the United States and works with Clients, personnel, and service providers in other countries. Personal information may be stored in, and accessed from, countries other than the one in which it was collected, including the United States, whose data protection laws may differ from those of your country. When we transfer personal information across borders, we use the safeguards that applicable law requires, such as the standard contractual clauses approved by the European Commission and the United Kingdom’s International Data Transfer Addendum. Where a Client’s agreement limits the places from which its Client Data may be accessed, we staff the engagement accordingly. You may ask us for more information about the safeguards we use.
12. Your Choices and Rights
12.1. Marketing communications. You can unsubscribe from our marketing emails at any time through the link in the email or by contacting us, and we act on unsubscribe requests within the time the law requires. We may still send messages about our services, our business relationship with you, or a request you made. Where Canada’s anti-spam law applies, we send commercial electronic messages only as that law permits.
12.2. Your rights. Depending on where you live and the laws that apply to our handling of your personal information, you may have the right to (a) know whether we process your personal information and access it; (b) receive a copy in a portable format; (c) correct inaccurate information; (d) delete your information; (e) object to or restrict certain processing; (f) withdraw consent where we rely on it; (g) opt out of targeted advertising, sales, or profiling where the law provides that right; and (h) not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
12.3. How to make a request. To make a request, email privacy@doctums.com or write to us at the address in Section 17. We may need to verify your identity before we respond, and we use the information you provide for verification only for that purpose. An authorized agent may make a request for you if we can verify the agent’s authority and your identity. We respond within the time applicable law requires. Some rights are subject to exceptions, and if we cannot fulfill a request, we will explain why. Requests about Client Data are handled as Section 7.7 describes.
12.4. Appeals and complaints. If we deny your request, you may appeal by replying to our response or by emailing privacy@doctums.com with “Appeal” in the subject line, and we will respond in writing. If you have a concern about how we handle personal information, please contact us; we acknowledge complaints within 30 days, look into them, and tell you the outcome. You may also contact a data protection authority, as Section 14 describes. We will not discriminate or retaliate against you for exercising your privacy rights.
13. Children’s Privacy. Our Website and services are intended for institutions and professionals, not children. We do not knowingly collect personal information from children under 16 through the Website. If you believe a child has provided personal information to us through the Website, please contact us and we will delete it. Client Data may include information about students who are minors, and we handle it as Section 7 describes.
14. Additional Information for Certain Locations
14.1. United States. Several states give their residents privacy rights such as those described in Section 12.2. Where a state’s law applies to our handling of your personal information, you may exercise those rights as Section 12.3 describes. You may limit the advertising technologies described in Section 5 at any time by using the choices described there. We do not sell covered information as Nevada law defines that term; Nevada residents may submit a request to opt out of sales to privacy@doctums.com.
14.2. European Economic Area, United Kingdom, and Switzerland. Where the EU or UK General Data Protection Regulation or the Swiss Federal Act on Data Protection applies, the Doctums entity that collects your personal information is its controller, except for Client Data, for which the Client is the controller. We process personal information to perform a contract with you or take steps you request before entering into one; for our legitimate interests in operating our business, managing our relationships, communicating with business contacts about our services, and securing our systems, where your rights do not override those interests; to comply with legal obligations; and with your consent, which you may withdraw at any time. You may object at any time to processing based on our legitimate interests, including direct marketing. Providing personal information is generally voluntary, but without it we may be unable to respond to you, provide services, or consider your application. You may lodge a complaint with your local supervisory authority, such as the UK Information Commissioner’s Office (ico.org.uk).
14.3. Canada. We handle the personal information of individuals in Canada in accordance with the Personal Information Protection and Electronic Documents Act and applicable provincial law. You may request access to and correction of your personal information and may withdraw your consent, subject to legal and contractual restrictions. Our Privacy Officer is accountable for our compliance and can be reached as Section 17 describes. You may also contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or your provincial privacy commissioner.
14.4. Australia. We handle the personal information of individuals in Australia in accordance with the Australian Privacy Principles. You may request access to or correction of your personal information. If you are not satisfied with our response to a complaint within 30 days, you may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au).
14.5. Latin America. If you are in Mexico, Colombia, Chile, or another country in Latin America, local law may give you rights of access, rectification, cancellation or deletion, objection, and portability, and the right to revoke your consent. We process personal information with your consent or on another basis that local law permits, such as performing a contract or complying with a legal obligation. You may exercise your rights as Section 12.3 describes and may contact the data protection authority in your country, such as Mexico’s Secretariat of Anti-Corruption and Good Governance, Colombia’s Superintendence of Industry and Commerce, or Chile’s Personal Data Protection Agency once it begins operating. Where local law requires a privacy notice in a particular language or form, we provide it when we collect your personal information.
15. Third-Party Websites and Services. The Website links to websites and services operated by others, such as our pages on professional networking and video platforms. This Policy does not apply to them, and their own privacy policies govern how they handle your information.
16. Changes to This Policy. We update this Policy from time to time. When we do, we post the updated Policy on the Website with a new effective date. If we make a material change, we will give additional notice, such as a notice on the Website or by email, before the change takes effect. We will not use personal information we collected before a material change in a materially different way without notice and, where the law requires, your consent.
17. Contact Us. Please direct questions, requests, and complaints about this Policy or our handling of personal information to our Privacy Officer at privacy@doctums.com or by mail to Doctums Global LLC, Attention: Privacy Officer, 119 S. Emerson Street, No. 186, Mount Prospect, Illinois 60056, USA.
Adopted 2024. Amended October 2026.