This Privacy Policy describes how CareJournal collects, uses, stores and shares personal information through the CareJournal website, web platform and mobile app. CareJournal is a Special Pathways product designed, built and operated with UKSkyTech Ltd. It should be read with the Data Protection, Security, Cookie Policy and Terms of Service pages.
1. Definitions
In this policy: Special Pathways means the operator of the Service, based in the United Kingdom. The Service or CareJournal means the CareJournal website, web platform and mobile app. School means the school or organisation that subscribes to the Service. User means an individual authorised to access the Service. Personal Data has the meaning given to it under UK GDPR.
2. Controller and processor
For pupil, parent, carer and school staff records held inside the Service, the School is the data controller and Special Pathways is the data processor, acting on the School's instructions under a written agreement.
For Personal Data arising from our own business activities, including enquiries, support correspondence and administrative records, Special Pathways acts as the data controller.
3. Scope
This policy applies to Personal Data processed in connection with the Service and our communications with Schools and prospective customers. It does not replace the School's own privacy notice.
4. Personal Data collected and processed
Personal Data processed in connection with the Service falls into a small number of broad categories:
- School and account information — basic details about a School, authorised Users and their access, including names, work email addresses, roles, account status and authentication information. Passwords and PINs are stored only in hashed form.
- Pupil and progress information — records that school staff choose to enter, including identity information, links to assigned staff and family members, and observations, evidence and progress information recorded over time. Where the School's policy allows, this may include photos or short videos.
- Family information — basic contact information for parents and carers, where family access is enabled.
- Enquiries and correspondence — information provided when a School or individual contacts Special Pathways, requests a walkthrough, or requests support.
- Operational information — limited technical and security information needed to keep the Service secure and reliable, including IP address, device or browser user-agent information, sign-in and verification events, timestamps, account-lock events and application error details.
The School decides what information about pupils and families is entered into the Service.
5. Mobile-app permissions and media
The mobile app may request access to the device camera, microphone, photos or videos only when an authorised User chooses to take a photo, record a video, or select existing media for an observation. Camera access is used to capture photos and videos; microphone access is used for audio recorded as part of a video; and photo or video library access is used to select evidence the User chooses to upload.
The app does not continuously access these device features or upload other media in the background. A selected file is uploaded to the School's CareJournal records and becomes part of the relevant pupil observation. Users can refuse these optional permissions, but the related media feature will then be unavailable.
6. Sensitive information
Records may include sensitive information, such as information relating to a child's health, disability, communication or care needs. This may amount to special-category data under UK GDPR.
The School, as controller, is responsible for identifying the appropriate lawful basis and any Article 9 condition for processing such information. Special Pathways processes it only as processor on the School's instructions.
7. Why we process information
Special Pathways processes Personal Data to:
- provide and support the Service to Schools;
- manage user accounts and permitted access;
- support school-led progress recording and review;
- keep the Service secure and reliable;
- respond to enquiries and provide support; and
- meet legal, contractual and regulatory obligations.
8. Lawful basis
For pupil, parent, carer and staff records held inside the Service, the School is responsible for identifying the appropriate lawful basis under UK GDPR. Special Pathways processes that information as processor under contract.
Where Special Pathways acts as controller, the lawful basis will typically be contract, legitimate interests, legal obligation, or consent where required.
9. Children's information
The Service handles Personal Data about children only for school-led education, progress recording, support and review purposes. The Service is not used to market to children, advertise to children, sell or commercially profile children's Personal Data, or train public AI models. Pupil photos and videos are not used in marketing without separate written permission.
10. Automated decision-making
The Service does not make automated decisions about children. Any interpretation of a record remains the responsibility of authorised school staff. If AI-assisted features are introduced in future, they will be documented before use and will not be used to make decisions about children without appropriate human review.
11. Sharing
Special Pathways does not sell Personal Data, use it for advertising, or share it with data brokers. Personal Data is shared only where necessary to provide the Service or where required by law. Recipients may include the School and its authorised Users; parents or carers where the School enables family access; infrastructure, storage, database, email-delivery and technical-support providers acting on our instructions; and legal, regulatory or safeguarding bodies where required. Where the School is the controller, sharing decisions are made by the School.
12. Service providers
Special Pathways relies on a limited number of service providers to help operate the Service. These include Amazon Web Services for UK-hosted application infrastructure, databases and private media storage; Twilio SendGrid for transactional emails such as sign-in codes, invitations and password resets; and UKSkyTech Ltd for software development, operation and technical support. Each provider is contractually restricted to the services it provides. A current subprocessor list is available to Schools on request.
13. Storage and international transfers
Core School records and uploaded media are stored on UK-based infrastructure. Some support or email-delivery providers may process limited Personal Data from other countries. Where Personal Data is transferred outside the UK, appropriate legal safeguards are used, such as an adequacy regulation or approved contractual clauses with the UK Addendum, as applicable.
14. Security
Special Pathways applies technical and organisational measures designed to protect Personal Data. A summary is available on the Security page. No online service can be guaranteed completely secure.
15. Retention and deletion
School records are retained for as long as the School uses the Service and according to the School's instructions and retention policy, unless a written agreement or law requires otherwise. Schools can archive records during the subscription and request correction, export or deletion. On termination, records are returned, deleted or anonymised within the period agreed with the School; residual encrypted backups expire under the applicable backup-retention schedule.
Security logs are kept only as long as reasonably needed to protect accounts, investigate misuse and meet contractual or legal obligations. Correspondence and business records may be retained for longer where necessary for legal, contractual, accounting or security reasons.
CareJournal accounts are created and managed by Schools rather than by public self-signup. A User who wants their account or Personal Data deleted should contact their School administrator. A deletion request may also be sent to hello@carejournal.uk. We will route School-controlled requests to the relevant School and assist it in responding.
16. Your rights
Under UK GDPR, individuals have rights of access, rectification, erasure, restriction, objection and portability, and the right to complain to the Information Commissioner's Office.
Where the School is the controller, requests should be made to the School. Special Pathways will support the School in responding to valid requests. Direct queries may be sent to hello@carejournal.uk. Complaints may also be made to the ICO at ico.org.uk.
17. Safeguarding
The Service is not a replacement for a School's safeguarding system or emergency procedures. Where information relates to safeguarding, child protection or legal duties, the School remains responsible for handling it under its own policies. Special Pathways may disclose Personal Data where required by law, court order or lawful request from an authorised body.
18. Cookies and tracking
The Service does not contain advertising SDKs and does not use advertising or third-party tracking cookies. See the Cookie Policy for further detail.
19. Breach notification
If Special Pathways becomes aware of a personal-data breach affecting a School's records, the School's nominated contact will be notified without undue delay and provided with the information reasonably needed to meet its own obligations.
20. Changes to this policy
This policy may be updated as the Service develops or as legal, technical or operational requirements change. Material changes will be communicated to subscribing Schools. The current version is available on the CareJournal website.
21. Contact
Privacy queries: hello@carejournal.uk.
If a request relates to school records held inside the Service, contact the School in the first instance, as the School is usually the controller for those records.