Permissions, Privacy and Maintenance

This guide is for site administrators. It covers four things that keep a Training Hub site safe and tidy:

Roles and capabilities: who can open which Training Hub screens, and how to give trainers access.
Privacy requests: how the WordPress Export Personal Data and Erase Personal Data tools work with Training Hub data.
Retention: what is kept after an erasure request, and (Pro) how to extend or override that.
Maintenance tools: integrity checks, database indexes and purging a course’s data.

Uninstalling is covered in 01 — Installation.

Roles and capabilities

Training Hub uses WordPress roles. It adds three of its own capabilities (permissions) to the roles you choose:

Capability	What it opens
`dthub_manage_tutorials`	The Training Hub menu itself, Mark Attendance, Manage Sessions, Classes, and searching for students when adding attendees. With Pro: Assignments, Grade Criteria, Action Plans, Follow-ups, Overdue Assignments and the rubric marking screens.
`dthub_manage_clinics`	Clinic roster actions on Manage Sessions (allocating, approving preferences, waitlists) and the Clinic Report. The screens use your configured term for “clinic”.
`dthub_view_reports`	Course Report, Student Report, Session Notes. With Pro: Analytics, Student Feedback, Audits and the Attendance Audit Trail.

Some screens are administrators only (manage_options), whatever capabilities a user holds: Settings, the Email Log, Clinic Cancellations, CSV Import (Pro), File Operations (Pro), the Drive Archive tab of the Student Report (Pro), and every maintenance tool in this guide.

Who gets the capabilities

All three capabilities are granted together to:

Administrators, always.
Your LMS’s instructor role, automatically: tutor_instructor with Tutor LMS and instructor with LifterLMS. With the standalone (no LMS) mode there is no automatic instructor role.
Every role ticked under Backend Access (Trainers) in Training Hub → Settings → Access & Privacy → Access Control.

Training Hub keeps the roles in step with your settings. If you untick a role under Backend Access (Trainers), the three capabilities are removed from it. Only these three Training Hub capabilities are ever removed; nothing granted by WordPress, your LMS or another plugin is touched.

There is no screen for granting the capabilities one at a time. If you need a finer split (for example, reports only), use a role-editor plugin, but note that Training Hub will remove the capabilities again from any role that is not in its configured list.

Giving a trainer access, step by step

Decide which role your trainers use (for example, Tutor LMS’s Tutor Instructor, or a custom “Clinical Supervisor” role).
Go to Training Hub → Settings → Access & Privacy.
Under Access Control → Backend Access (Trainers), tick that role and press Save Changes.
The role can now open the Training Hub menu, and its users appear in the Trainer dropdown when you schedule sessions.

Non-administrators who open Training Hub are taken to Mark Attendance (the Admin Calendar landing page is for administrators).

Instructors only see their own courses

Holding a capability opens a screen. It does not reveal every record on it. Wherever a record belongs to a course, Training Hub also checks that the user instructs that course (or is an administrator). For example:

An instructor can review an extension request, or download a student’s assignment file, only for a course they teach. An allocated trainer for that assignment can also review the request.
The Student Report’s student picker lists only students enrolled in the instructor’s courses.

So two instructors at the same college, both with dthub_manage_tutorials, cannot see each other’s cohorts.

Tutor LMS’s own capabilities

Tutor LMS has its own capabilities, such as edit_tutor_courses and manage_tutor. They do not open any Training Hub or Pro screen by themselves. Training Hub relies on its own three capabilities plus Tutor’s record of who instructs each course. To give a Tutor instructor access, make sure their role is the Tutor instructor role or is ticked under Backend Access (Trainers), and add them as an instructor of their course in Tutor.

Setting	What it controls	Default
Backend Access (Trainers)	Roles that receive the three capabilities and can be chosen as a session trainer	Administrator + your LMS’s instructor role
Student Email Recipients	Only users in these roles get student-facing plugin emails	None ticked = all enrolled users
Student Roles	Which roles count as students in pickers, reports and recording claims	None ticked = built-in learner role defaults
Ad-hoc Eligible Roles	Who can be added to a session as an ad-hoc attendee	None ticked = same as Student Roles

If your students use a custom role, you must tick it under Student Roles, or they will not appear in any picker.

Privacy: exporting and erasing personal data

Training Hub works with WordPress’s built-in privacy tools: Tools → Export Personal Data and Tools → Erase Personal Data. Enter the person’s email address, confirm the request, then run the export or erasure as usual.

Training Hub also adds a section to WordPress’s privacy policy guide (Settings → Privacy → Policy Guide). It describes what the plugin collects; use it when drafting your own policy.

What is exported

Source	Shown in the export as	Includes
Free	Dantian Training Hub	Tutorial attendance, clinic attendance, email notification preferences, clinic cancellations, class memberships, tutorial registrations, recording claims, quiz extensions, email communication log
Free	Training Hub Student Notes	Reasonable-adjustments notes about the student
Pro	Dantian Training Hub Pro	Recording claims, assignment and quiz extensions, extension requests, attendance audit trail, activity timing, action plans, administration follow-ups, timetable-planner records (subgroups, subject-outline reviews and comments), rubric comment data, Pro user settings, and the privacy erasure decisions recorded about the person
Pro	Authenticity Declaration Records	Assignment authenticity declarations

What erasure does (Free)

Training Hub keeps attendance and reporting accurate, so erasure redacts personal free text rather than deleting every row:

Deleted: email communication log entries, email notification preferences, class memberships.
Kept, with notes or free text cleared: tutorial and clinic attendance (the status stays; notes are cleared), clinic cancellations, tutorial registrations, recording claims (the reflection is cleared) and quiz extensions.

The erasure report lists each of these, for example “Tutorial attendance notes cleared for 12 records. Status records retained for course reporting integrity.”

🔒 Pro feature — requires Dantian Training Hub Pro.

What erasure does (Pro): retention holds

With Pro, every Pro record is checked against a retention hold before it is erased. A record under hold is kept. The administrator’s erasure report and the person’s confirmation email both say how long it is held and why. For example: “Action plan #42 retained until 14 March 2032 — …”. Every keep-or-erase decision is written to a privacy decision log.

Default holds:

Record type	Default hold
Assessment outcomes (grades, competency status, rubric results)	7 years
Attendance records (recording claims)	7 years
Coaching and intervention records (action plans and evidence)	7 years
Operational admin records (extension requests, webhook logs)	3 years
Trainer working notes	Until course completion, plus 1 year
Audit trails (attendance audit log, privacy decision log)	Indefinitely, with the person’s identity anonymised
Calendar feed tokens, activity-timing data	No hold; erased on request

These defaults are built in. Settings let you extend them (below); shortening them is a developer-level change.

Secure files and Google Drive copies:

When a student’s secured file is erased, its encrypted backup copy in Google Drive is deleted permanently, whatever the backup’s trash setting.
The Student records archive in Google Drive is not erased. The confirmation says archived copies remain. Remove them deliberately from File Operations if your institution has no basis to keep them. See 27 — Secure Files and Records Archive.

Extended Data Retention

Some institutions, such as clinical placement providers and accredited professional programmes, must hold records longer than the defaults. You’ll find this at Training Hub → Settings → Access & Privacy → Extended Data Retention.

Setting	What it does	Default
Enable extended retention — “Apply extended retention to all records institution-wide”	Holds all records of the selected types for the extended period, regardless of other characteristics	Off
Extended retention period (years)	The hold period. Common values: 7 (general academic), 15 (clinical placement)	15 (allowed 1–50)
Apply to record types	Assessment outcomes · Attendance records · Coaching & intervention records · Operational admin records · Trainer working notes	The first three ticked

The setting applies institution-wide, not per course. Press Save Changes at the bottom of the Settings page.

Force Erase (Override Retention)

Occasionally a held record must go anyway, for example by order or after an institutional review. The Force Erase (Override Retention) section of Access & Privacy handles this:

Override notification email: if set, an email goes to this address every time a record is force-erased, so a second person can review it. Leave it blank to disable. The subject is “[Your Site] Training Hub Pro: Retention Override — Force Erase executed”. The email names the administrator, record type, table, record ID, data subject and the reason given.
Currently Retained Records: a table of every record held during an erasure request, showing Record Type, Table / Record ID, Subject Email, Hold Reason, Held Until, and a Force Erase button. Audit-trail rows show Protected (anonymise only) and cannot be force-erased.

To force-erase a record:

Press Force Erase on its row.
Enter a Reason for override of at least 20 characters.
Tick I confirm institutional approval has been obtained for this erasure.
Press Confirm Force Erase.

The record’s row is permanently deleted and the override is logged permanently in the privacy decision log. This cannot be undone. Force Erase removes the database record only. Remove any related records-archive copy separately in File Operations.

Activity Timing

The Activity Timing section of the same tab controls an optional record of when enrolled students engage with course activity. It is off by default; confirm your privacy notice covers it before enabling. Activity data retention (months) defaults to 24. Activity data is always deleted immediately on an erasure request.

Maintenance tools

All maintenance tools are administrator-only. Most live on Training Hub → Settings → Debug & Maintenance → Maintenance Tools. Purge Course Data lives on the Access & Privacy tab, next to the other destructive data settings.

Automated Maintenance

Setting	What it does	Default
Scheduled Integrity Cleanup — “Automatically remove orphaned records weekly”	Runs the orphaned-record cleanup (below) once a week in the background	Off

Referential Integrity Check

Orphaned records point at something that no longer exists, such as a deleted user, a deleted course, a removed session, a removed clinic roster or a removed action plan. They usually appear when users or courses are deleted outside the plugin (for example, in Tutor LMS or the Users screen).

Press Scan for Orphaned Records. The scan is read-only. A table shows each category (Orphaned Student References, Orphaned Course References, orphaned session and clinic-roster references, Orphaned Action Plan Items) with a count and the affected tables.
If any are found, a Remove Orphaned Records button appears. Press it and confirm “This will permanently delete all orphaned records. Continue?”
The result shows how many records were removed, and the scan runs again to confirm.

When to use it: after deleting users, deleting or merging courses, or before an end-of-year export. The cleanup is permanent, so take a backup first. The bulk cleanup is recorded in the plugin’s internal security log.

Database Index Audit

Press Run Index Audit to check and add the database indexes that keep large attendance tables fast. Each index is listed as Added, Already exists or Skipped. It is safe to run repeatedly; existing indexes are left alone. The same check runs once automatically after installation or update, so you normally only need this if reports become slow after a host migration or database restore.

Cron Schedules

The Debug & Maintenance tab also lists the plugin’s scheduled jobs (event name, next run, schedule and status). Use it to confirm that reminders and maintenance jobs are actually scheduled.

Purge Course Data

Training Hub → Settings → Access & Privacy → Purge Course Data permanently deletes all Training Hub data for one course: sessions, attendance, clinic rosters, allocations and cancellations, recording claims, assignment extensions and attendance audit history. The course in your LMS, its enrolments and its lessons are not touched.

Choose the course under Select Course.
The Preview shows how many rows of each kind will go, with a total. The delete button stays disabled if there is nothing to delete.
Tick I understand this permanently deletes all Dantian Training Hub data for the selected course.
Press Permanently Delete All Course Data and accept two confirmation dialogs.
The result reads “Purged N records for this course.”

Warning: Purging cannot be undone, and it removes attendance history you may be required to keep. Use it only for test courses, courses created by mistake, or after you have exported everything you need (09 — Attendance Export). Take a full database backup first.

Datetime integrity check

Each session stores its date and time twice: once as you entered it, and once converted to universal time for reminders and calendars. Once a day, Training Hub checks upcoming sessions to confirm the two still agree. It also adds a test to Tools → Site Health called “Training Hub session datetime integrity”.

If they disagree, administrators see a warning: “Dantian Training Hub: N scheduled session(s) have a stored UTC datetime that no longer matches their local date/time.” The check is read-only and changes nothing. A mismatch means something wrote to the sessions without going through the plugin. Re-saving an affected session from Manage Sessions stores it correctly again. If the warning keeps coming back, contact support.

Shortcode Scan and Auto-create page

Two tools help when front-end pages go missing or have been rebuilt:

Shortcode Scan (Settings → Setup & Enrolment → Shortcode Scan → Run Scan) looks through your pages and posts, including drafts, private and scheduled ones (up to the 1,000 most recently modified that contain a shortcode). It finds the Training Hub shortcodes for Mark Attendance, Student Report, Course Report, Student Calendar and Instructor Calendar. A pop-up lists each shortcode with Found Pages, the Mapped Setting and a Suggested Mapping. Press Apply Suggestions, then Save Changes to keep them. The clinic student dashboard page is not reliably detected by the scan, so nominate it by hand under Pages & Reports.
Auto-create page (next to each page selector under Settings → Pages & Reports → Frontend Pages, and in the Getting Started setup guide) publishes a new page with the right shortcode already in it and selects it straight away. The message “Created and selected “Student Report”.” confirms the choice is already saved. If WordPress cannot create the page you will see “Could not create the page. Please create it manually.”

Both tools are administrator-only.

Automatic background jobs

You do not need to set these up:

Daily cache cleanup: removes expired cached data the plugin created. It runs once a day.
One-time data upgrades: when the plugin is updated, any required data changes run automatically once (for example, combining older clinic roster data into the unified session tables). They are recorded so they never run twice.

Uninstalling

Deactivating either plugin keeps all data. Deleting the plugin removes data only if you opted in beforehand:

Free: Access & Privacy → Uninstall Behaviour → Delete all plugin data on uninstall (off by default).
Pro: Access & Privacy → Pro Data Removal on Uninstall → Permanently delete all Pro data when the Pro plugin is uninstalled (off by default). Free’s data is never touched by this setting.

Pro’s secure-file store is never deleted. Restore secured files to public storage before uninstalling Pro (see 27 — Secure Files and Records Archive). Full steps are in 01 — Installation.

Worked example

Riverside Institute of Health Sciences uses Tutor LMS with three campus coordinators and twelve instructors.

Instructors already have the Tutor Instructor role, so they received the three capabilities automatically. The coordinators use a custom “Campus Coordinator” role. The administrator ticks it under Backend Access (Trainers) and saves.
A coordinator reports that a new instructor cannot see last term’s submissions. The administrator adds that instructor to the course in Tutor LMS, and the files open.
A former student emails asking to be forgotten. The administrator runs Tools → Erase Personal Data. The report shows email preferences and log entries deleted, attendance notes cleared, and two action plans retained until 2032 under the 7-year coaching hold. The student’s confirmation email explains the hold.
At year end the administrator runs Scan for Orphaned Records, finds 37 references left by deleted test users, takes a backup, and removes them. They also purge a sandbox course that was used for training staff.

Troubleshooting

A trainer gets “Sorry, you are not allowed to access this page” from the Training Hub menu. Their role is not in Backend Access (Trainers) and is not your LMS’s instructor role. Tick the role and save. Settings, the Email Log, Clinic Cancellations and the maintenance tools are admin-only by design.

A trainer is missing from the Trainer dropdown. Only users in Backend Access (Trainers) roles, and administrators, can be chosen. Tick their role.

Students don’t appear in pickers. They probably use a custom role. Tick it under Student Roles.

The erasure report says records were “retained”. That is Pro’s retention hold working as intended. If the record must go anyway, use Force Erase with institutional approval.

“Confirmation required. Type PURGE to confirm this irreversible deletion.” The purge request reached the server without the confirmation step, usually because of a stale page. Reload the Settings page and try again, completing both confirmation dialogs.

Was this helpful?