Privacy notice

Last updated 25 June 2026

Who is responsible for your data

Your school (or local authority) is the data controller. It decides why and how pupil information is used, and it is accountable for it under the UK GDPR and the Data Protection Act 2018.

Clearrpath is the data processor. We only process pupil information on the school's documented instructions, to provide the annual review platform. We do not sell personal data, and we do not use it for advertising.

Controller contact and Data Protection Officer: [SCHOOL TO COMPLETE]

What information is processed

• Pupil identity: name, date of birth, year group and gender.
• Special category data:SEN diagnosis and needs, health and therapy provision (including speech and language therapy and occupational therapy), and the content of the pupil's Education, Health and Care Plan.
• Contact details: home address, home language, and parent or carer name, address, phone and email.
• School staff: name, email, role, and the comments staff write about a pupil's progress.
• Technical: a secure sign-in session and an audit record of key actions taken on a pupil's record.

Why it is processed, and the legal basis

The information is used to carry out the statutory annual review of an Education, Health and Care Plan, as required by the Children and Families Act 2014 and the SEND Code of Practice, and to keep teaching staff informed of a pupil's provision.

Because this includes health information, the school relies on both a lawful basis under Article 6 and a condition for special category data under Article 9 of the UK GDPR: [SCHOOL TO COMPLETE].

Artificial intelligence

To save staff time, the text of an uploaded EHCP is sent to Anthropic's Claude API, which returns a structured summary of the pupil's needs, provision and outcomes. Every point produced is linked back to the exact wording it came from so a human can verify it.

Anthropic does not use data submitted through its API to train its models. No decision about a pupil is made automatically by the AI: a SENCO reviews and edits everything before it is used. This processing involves a transfer outside the UK, which is covered by an appropriate safeguard: [SCHOOL TO COMPLETE].

How long it is kept

SEN records are retained until the pupil's 25th birthday, following records management guidance for schools, unless the school's own retention schedule sets a different period. When a record is erased, the EHCP file, the extracted summary and the underlying text are all deleted, and only a non-identifying record that an erasure took place is kept.

How it is protected

• Access is restricted by role. Teachers can only see the pupils assigned to them.
• Database access rules are enforced per row, so data cannot be read by the wrong account.
• EHCP documents are displayed inside the app and are never sent to a third party document viewer.
• Data is encrypted in transit and at rest, and application servers run in the United Kingdom.
• Key actions on a pupil record are written to an audit log.

Cookies

Clearrpath sets only strictly necessary cookies, which keep you signed in. There is no advertising, analytics or third party tracking, so no cookie consent banner is required.

Your rights

Pupils, and parents or carers acting on their behalf, have the right to ask for a copy of the information held, to have inaccurate information corrected, and in some circumstances to have it erased or its use restricted. You can also object to certain processing.

Because your school is the controller, please make any request to the school in the first instance: [SCHOOL TO COMPLETE]. We will support the school in responding.

If you are unhappy with how your information has been handled you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this notice

If the way information is processed changes, this notice will be updated and the date at the top revised.