Privacy notice

Last updated 18 August 2026

Who is responsible for your data

Your school (or local authority) is the data controller. It decides why and how pupil information is used, and it is accountable for it under the UK GDPR and the Data Protection Act 2018.

CLEARR LTD, trading as Clearrpath, is the data processor. We only process pupil information on the school's documented instructions, to provide the annual review platform. We do not sell personal data, and we do not use it for advertising.

CLEARR LTD is a company registered in England and Wales, company number 17187717. Registered office: 124 City Road, London, EC1V 2NX. Registered with the Information Commissioner's Office, reference ZC226311. Data protection enquiries: privacy@clearrpath.co.uk.

Your school's Data Protection Officer is named in your school's own privacy notice, usually on its website. Ask the school office if you cannot find it.

What information is processed

• Pupil identity: name, date of birth, year group and gender.
• Special category data: SEN diagnosis and needs, health and therapy provision (including speech and language therapy and occupational therapy), and the content of the pupil's Education, Health and Care Plan.
• Contact details: home address, home language, and parent or carer name, address, phone and email.
• School staff: name, email, role, and the comments staff write about a pupil's progress.
• Technical: a secure sign-in session and an audit record of key actions taken on a pupil's record.

Why it is processed, and the legal basis

The information is used to carry out the statutory annual review of an Education, Health and Care Plan, as required by the Children and Families Act 2014 and the SEND Code of Practice, and to keep teaching staff informed of a pupil's provision.

Because this includes health information, the school needs both a lawful basis under Article 6 and a condition for special category data under Article 9 of the UK GDPR. Schools carrying out a statutory annual review ordinarily rely on Article 6(1)(c), a legal obligation, and Article 9(2)(g), substantial public interest, together with the statutory purposes condition in Schedule 1 of the Data Protection Act 2018. Your school states the bases it relies on in its own privacy notice, and those are the ones that apply.

Artificial intelligence

To save staff time, the text of an uploaded EHCP is sent to Anthropic's Claude API, which returns a structured summary of the pupil's needs, provision and outcomes. Every point produced is linked back to the exact wording it came from so a human can verify it.

Anthropic does not use data submitted through its API to train its models. No decision about a pupil is made automatically by the AI: a SENCO reviews and edits everything before it is used.

Anthropic PBC processes this text in the United States, so the summary step involves a transfer outside the UK. It is made under the transfer safeguard recorded in our agreement with Anthropic and in our data processing agreement with your school, which the school can request in full. No other pupil information leaves the UK: the database, file storage and application servers are all in the United Kingdom.

How long it is kept

SEN records are retained until the pupil's 25th birthday, following records management guidance for schools, unless the school's own retention schedule sets a different period. When a record is erased, the EHCP file, the extracted summary and the underlying text are all deleted, and only a non-identifying record that an erasure took place is kept.

How it is protected

• Access is restricted by role. Teachers can only see the pupils assigned to them.
• Database access rules are enforced per row, so data cannot be read by the wrong account.
• EHCP documents are displayed inside the app and are never sent to a third party document viewer.
• Data is encrypted in transit and at rest, and application servers run in the United Kingdom.
• Key actions on a pupil record are written to an audit log.

Information we hold in our own right

Two things are ours rather than a school's, and for these CLEARR LTD is the controller.

• Website enquiries. If you use the contact form we receive your name, email address and message, so that we can reply. The lawful basis is our legitimate interest in answering people who contact us. The message is delivered to us by email through Resend and kept only as long as needed to deal with the enquiry and any resulting relationship.
• Staff accounts. To give a member of school staff access we hold their name, work email address, job title and role. The lawful basis is our legitimate interest in running a secure service that only named people can sign into. The account is removed when the school tells us the person has left.

Neither is used for advertising, sold, or shared with anyone beyond the suppliers described above.

Cookies

Clearrpath sets only strictly necessary cookies, which keep you signed in. There is no advertising, analytics or third party tracking, so no cookie consent banner is required.

Your rights

Pupils, and parents or carers acting on their behalf, have the right to ask for a copy of the information held, to have inaccurate information corrected, and in some circumstances to have it erased or its use restricted. You can also object to certain processing.

Because your school is the controller of pupil information, please make any request about a pupil to the school in the first instance, using the contact details in your school's own privacy notice. We will support the school in responding, and we will not act on a request about pupil data without the school's instruction.

For the information we hold in our own right — a website enquiry or a staff account — contact us directly at privacy@clearrpath.co.uk.

If you are unhappy with how your information has been handled you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this notice

If the way information is processed changes, this notice will be updated and the date at the top revised.