The SENDNest for Schools

Privacy notice: The SENDNest for Schools

Version: 5.4
Last updated: 31 October 2026

The SENDNest for Schools is operated by The SENDNest for Schools Ltd, a company registered in England and Wales under company number 17428150. Our registered office is 61 Bridge Street, Kington, United Kingdom, HR5 3DJ.

Privacy contact: privacy@sendnestforschools.co.uk

1. About this notice

This notice explains how personal data is handled when schools and their staff use The SENDNest for Schools. It covers:

  • staff accounts, training records and service administration;
  • practitioner tools that work from general descriptions of educational needs and support strategies;
  • documents created and exported by a school; and
  • sales, enquiries and subscription contacts.

Pupils do not have accounts on The SENDNest for Schools. The platform is not a pupil-record system.

2. The short version

  • The subscribing school, academy trust or other education provider is normally the controller of its staff account and training data. We process that data to provide the service under the organisation's instructions.
  • The practitioner tools do not ask for a pupil's name or other identifying details. They work from general descriptions of functional difficulty, educational need and support strategy.
  • The school may know which pupil it is supporting. The information received by The SENDNest for Schools does not include the information needed to connect the selected needs or strategies to that pupil.
  • Where an exported document needs a name, the user adds it at the export stage on the user's device. The name is not sent to or stored on our servers and is not included in an AI request.
  • A document or working file held by the school may be personal data in the school's hands because the school can connect it to a pupil. The school controls that document and must handle it under its own data-protection policies.
  • Staff names, work contact details, roles and training records are personal data and are handled as described below.

3. Who is responsible for personal data?

Data controlled by the subscribing organisation

The legal entity that subscribes to The SENDNest for Schools, such as an academy trust, local-authority-maintained school or proprietor, is normally the controller of staff account and training data. It decides why staff use the service, who is given access and how training results are used.

The SENDNest for Schools acts as the organisation's processor for that data. We process it only to provide, secure and support the service, in accordance with the organisation's documented instructions and a written data-processing agreement.

This notice supplements the subscribing organisation's staff privacy notice. Staff should ask their organisation about its lawful basis for requiring training and its use of training results.

Data controlled by The SENDNest for Schools

The SENDNest for Schools is a controller when we handle:

  • enquiries from prospective customers;
  • the name, work contact details and correspondence of subscription and contract contacts;
  • business administration, payment and legal records; and
  • information needed to protect and investigate the security of our service.

4. Staff and business-contact data

Depending on how a person deals with us, we may handle:

  • name, work email address, job title or role and organisation;
  • account and authentication details;
  • modules started and completed, assessment scores, and answers marked correct or incorrect;
  • certificate information, including name, module and completion date;
  • support requests and service correspondence;
  • subscription, order, billing and payment-administration records; and
  • technical and security information, such as login events, IP address, browser or device information, and security logs.

We obtain account information from the subscribing organisation or from the staff member when an account is activated. We obtain business-contact information from the person, their organisation, or their correspondence with us.

We use this information to:

  • create and administer accounts;
  • deliver training and calculate assessment results;
  • provide individual certificates and organisation-level evidence and training-needs reports;
  • provide support and service communications;
  • administer enquiries, subscriptions, contracts and payments;
  • maintain service availability, security and auditability; and
  • establish, exercise or defend legal claims and meet legal obligations.

When a person asks for a written quote, we use the name, work email address, school or trust, role, staff numbers and number of schools they give to prepare and send the quote. We do not add them to our mailing list.

When we are the controller, our lawful bases are:

  • contract or steps before a contract, where the individual is personally entering into a contract with us;
  • legitimate interests, to administer business relationships, respond to enquiries, operate and improve the service, and protect it from misuse, balanced against the individual's rights; and
  • legal obligation, where we must retain or disclose records to comply with law.

We do not rely on consent for these core activities. We do not use staff training data for advertising.

5. How the practitioner tools protect pupil identity

The practitioner tools are designed to work without The SENDNest for Schools receiving information that identifies a pupil.

The tools use predefined choices or brief general descriptions concerning matters such as:

  • a functional difficulty or barrier to learning;
  • a broad educational need;
  • a desired educational outcome; and
  • a teaching, classroom or support strategy.

The platform does not create pupil accounts or server-side pupil records. It does not ask users to enter a pupil's name, initials, date of birth, address, pupil number, class, named family members or other direct identifiers.

The tools' own predefined options include broad categories of educational need (for example, needs associated with autism, with attention and concentration, or with speech, language and communication). Selecting one of these general professional categories is part of how the tools work; it describes a type of need, not a named pupil, and is not the entry of a medical record. The restrictions below concern identifying details and copied records.

Users must not enter or paste:

  • names, initials, dates of birth, addresses, pupil or NHS numbers;
  • a school, class or other local reference that could identify the pupil;
  • medical records, diagnosis letters, EHC plan extracts or other professional reports;
  • detailed case histories, safeguarding information or descriptions of unique incidents; or
  • names or identifying details of relatives, staff or other pupils.

Any text field is for a short, general description of a need or strategy only. It must not be used for a pupil narrative, evidence log, case note or copied school record.

The same restriction applies to support requests, screenshots and attachments sent to us. Users must remove pupil names and identifying case details before contacting support.

The school may know which pupil it has in mind because of information it holds separately. The SENDNest for Schools does not receive that separate information or the school's link between the general descriptors and the pupil. On that operating basis, the needs and strategy content received by The SENDNest for Schools is not linked within our systems to an identified or identifiable pupil.

This separation is essential. If the service is changed to accept identifying details, diagnoses, detailed pupil histories or identifiable documents, the change must undergo a fresh data-protection review before release and this notice must be updated.

6. Exporting a named document

Some tools allow the school to create a document for its own records. If a pupil's name is required, the user adds it only during the export process on the user's device.

The export-only identity field is not:

  • sent to our servers;
  • saved in our database;
  • included in an AI request;
  • placed in analytics, error reports or security logs; or
  • retained by us after export.

The named document is created for and saved by the school. The school is the controller of that document and is responsible for its access controls, secure storage, accuracy, retention, sharing and deletion.

Local export does not mean that data-protection law stops applying to the school. It means that our servers and personnel do not receive or have access to the pupil's identity.

7. Working files

Some tools may allow a user to download a working file so that work can continue later. The file contains general needs and support selections, but no field for a pupil's name or other identifier. It is saved by the school and opened locally in the user's browser. The working file is not uploaded to or stored on our servers.

If the school can connect the working file to a pupil using information it holds separately, the school should treat that file as pupil personal data. The school's own retention, access and security rules apply.

If a connected tool offers AI drafting, only the permitted non-identifying needs and strategy fields are submitted. The complete working file, the locally held identity and the named export are not submitted.

At the date of this notice, working files may be used by the EHC needs assessment request builder and, when released, the Pupil SEND Overview. The same restrictions apply to both tools.

8. Individual tools

Practitioner drafting tools

Where a practitioner asks for an AI-generated draft, only the permitted non-identifying needs and strategy content is sent for drafting. The returned text is a starting point for professional review. A member of school staff must check its suitability, accuracy and context before using it.

SEND information report tool

The SEND information report tool stores the school's selected options, approved public links, report dates and the SENCO's professional contact details so the report can be reviewed in future years. Those inputs are processed to generate the report. The tool does not ask for or store information about individual pupils, and generated report text is not saved. The SENCO's professional contact details may appear in the generated report, which the school may choose to publish on its own website.

Costed provision map

The costed provision map operates in the user's browser. It does not use AI drafting and does not store its contents on our servers.

Training videos

Training videos are streamed from Cloudflare Stream (see the provider list below). Playback needs a short-lived signed token that the platform issues only to signed-in accounts of subscribing organisations; the token names the video, not the viewer. We do not track how much of a video a person watches, and watching a video adds nothing to a person's training record beyond the module progress and completion described in this notice.

Browser-only pickers and settings

Some option pickers operate only in the browser. Accessibility and display preferences may also be stored locally on the device so that the service displays as requested. These preferences do not contain pupil information and can be reset by the user.

9. AI drafting

We use Anthropic's commercial API to produce drafts in the practitioner tools.

Under the permitted use described in this notice:

  • Anthropic receives only the non-identifying prompt content required to produce the draft;
  • Anthropic does not receive the pupil's name, school-held link to the pupil, named export or working file;
  • staff account data is not included in the prompt; and
  • inputs and outputs are not used to train Anthropic's models by default under its commercial terms. We do not opt production API content into model training or submit it as feedback.

Anthropic states that standard commercial API inputs and outputs are automatically deleted from its backend within 30 days. Longer retention can apply where the customer has selected a service with different retention, the parties have agreed different terms, content is retained to enforce Anthropic's usage policy, or retention is required by law. We do not use an API feature that intentionally extends prompt retention. Current information is available in Anthropic's commercial data-retention notice. This is service-provider retention of non-identifying drafting content, not storage of a pupil record by The SENDNest for Schools.

The school remains responsible for professional decisions. The generated draft must not be treated as a diagnosis, legal determination, statutory assessment or substitute for professional judgement.

10. Training results and automated processing

The platform automatically marks assessments, calculates scores and produces training reports. Authorised administrators in the subscribing organisation can see completion records, scores and the individual questions marked correct or incorrect. Staff can see their own results.

This processing helps the organisation identify training needs and maintain evidence of completion. We do not use the results to make employment, capability or disciplinary decisions. We do not make solely automated decisions that produce legal or similarly significant effects on staff. Any decision made by the subscribing organisation using the results is the organisation's responsibility and should include appropriate human review.

11. Service providers and sharing

We use a limited number of contracted service providers:

  • Supabase, for database and authentication services. It handles staff account and training information, the school-level SEND information report inputs described above, and the details people give us when they place an order or ask for a written quote, and problem reports staff send us. Project data is stored in London, United Kingdom (AWS eu-west-2).
  • Netlify, for application hosting and delivery. It may process technical connection and security information.
  • Resend, for transactional emails such as account invitations, password or access messages, service reminders, order confirmations, and the notice we receive when someone places an order or asks for a written quote. It processes the recipient's name, work email address and delivery information, and, in that notice, the details the person gave us.
  • Anthropic, for AI drafting. Under the product restrictions described above, it receives non-identifying drafting content and not staff account data or pupil identity.
  • Cloudflare, for streaming the training videos. When a video plays, the viewer's browser connects to Cloudflare, which processes technical connection information (such as an IP address) in the way any content-delivery service does. Video access is controlled by short-lived signed tokens; we do not send Cloudflare the viewer's name or account details.
  • Mailchimp (Intuit Inc.), to send the demo email and a small number of follow-up emails to people who ask for a demo. It processes the name, work email address, school, role and delivery information of the person who asked. Every email carries an unsubscribe link.
  • Calendly, if a person chooses to book a call with us. It processes the name, email address and booking details the person enters.
  • Microsoft 365, for our company email. It processes correspondence sent to or from our addresses.

We may also disclose personal data where required by law, to protect legal rights or service security, or in connection with a corporate transaction subject to appropriate safeguards.

We do not sell personal data. We do not share staff training data with advertisers or data brokers.

Our data-processing agreement identifies the processors used for school-controlled personal data and explains how subscribing organisations will be informed of relevant changes.

12. International transfers

Some service providers may process personal data outside the United Kingdom. Where UK personal data is transferred to a country without UK adequacy regulations, we put in place an approved transfer safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and carry out the required risk assessment. Where an adequacy route is available, we verify that it applies to the provider and the relevant processing.

A subscribing organisation or affected individual may contact us for information about the safeguard used for a relevant transfer and how to obtain a copy, subject to necessary redactions.

13. Retention

We keep personal data only for as long as needed for the purpose for which it was collected, our contractual commitments, security, and applicable legal requirements.

  • Individual assessment-answer detail: up to two years from the date of the assessment, unless the subscribing organisation instructs earlier deletion or longer retention is legally required.
  • Module completion records, scores and certificates: for the subscription term and a limited offboarding period so that the organisation can export its records, after which they are returned or deleted in accordance with the data-processing agreement. The organisation can export its evidence records at any time during the subscription and the offboarding period, and exported records remain valid in the organisation's own systems after deletion from ours.
  • Staff account data: until the account is deleted on the subscribing organisation's instruction or as part of service offboarding.
  • SEND information report inputs: for the subscription term so that the organisation can update its report, then returned or deleted with the organisation's other service data.
  • Support and security records: for the period reasonably required to resolve the request, maintain an audit trail or investigate a security event, in accordance with our retention schedule.
  • Unsuccessful sales enquiries: normally for up to two years after the last meaningful contact.
  • Contract, subscription and financial administration records: normally for six years after the end of the relevant relationship, unless law requires a different period.

The SENDNest for Schools does not retain the pupil's name, named export or school-held working file. Retention of documents and files kept by the school is determined by the school's own policies.

Deletion from live systems and deletion from protected backups may occur on different schedules. Backup copies are isolated from normal use and are removed in accordance with our backup-retention schedule.

14. Individual rights

Under data-protection law, individuals may have rights to:

  • be informed about the use of their personal data;
  • request access to it;
  • have inaccurate or incomplete information corrected;
  • request erasure in certain circumstances;
  • request restriction of processing in certain circumstances;
  • object to processing based on legitimate interests;
  • receive certain information in a portable format where the right applies; and
  • complain to the Information Commissioner's Office.

For school-controlled staff data, requests should normally be sent to the subscribing organisation. We will assist it in responding. If a request is sent to us, we will direct it to the appropriate controller and support the response.

For personal data controlled by The SENDNest for Schools, contact us using the privacy email at the top of this notice. We may need to verify identity before acting on a request.

The Information Commissioner's Office can be contacted through www.ico.org.uk or by telephone on 0303 123 1113.

15. Security

We use technical and organisational measures intended to protect personal data. These include role-based access, separation of each subscribing organisation's data, server-side protection of assessment answers, access controls, service monitoring and testing of the controls that keep export-only identity and local working files out of server requests, analytics and error reports.

Schools must also protect their accounts, devices, downloaded documents and working files, restrict access to authorised staff, and report suspected security incidents promptly.

No online service can promise absolute security. If a personal-data breach affects school-controlled data, we will notify and assist the controller in accordance with the data-processing agreement and applicable law.

16. Cookies and local storage

We use authentication and security technologies that are necessary to provide the service. Browser-local storage may be used to remember an accessibility or display setting requested by the user. We do not use advertising cookies in the service.

If we introduce optional analytics, advertising technologies or any non-essential storage, we will update our information and obtain consent where the Privacy and Electronic Communications Regulations require it before those technologies are used.

17. Changes to this notice

We will update this notice when our processing, providers or legal obligations change. We will notify subscribing organisations of material changes before they take effect where appropriate. The version and last-updated date at the top will show when the notice changed.