Privacy and data handling
Sara Fullwood Online
This private website is administered by Sara's parent or carer to organise her education and provide limited evidence to the local authority.
Information held
- Sara's name, date of birth and intended progression route.
- Curriculum completion, session times, learning outcomes and evidence descriptions.
- Weekly reflections and parent reviews.
- Qualification status and limited physical-education benchmark results.
- Short-lived authentication and authority-access records.
Why it is used
The information is used to administer a genuine home-study programme, support Sara's learning, and demonstrate post-16 participation and achievement when reasonably requested.
Who receives it
- Named local-authority staff: only through an expiring, revocable read-only link.
- Nous Research: receives the tutor question, limited recent chat and current lesson context when Sara chooses to use the tutor. Tutor chats are not placed in the authority record.
- Vercel and the connected Postgres provider: host the application and educational record.
No data is sold or used for advertising by this application.
Security and minimisation
The parent area uses an HTTP-only signed session cookie. Authority links contain a high-entropy secret; only its hash is stored, and links can be revoked. Medical records, application passwords and unnecessary identity documents must not be entered.
Retention and corrections
Records should be reviewed when Sara enters training or turns 18, then retained only while they remain necessary for education or an active authority query. Sara and her parent can correct inaccurate entries. Authority links should be revoked as soon as the review is complete.
Cookies
The site uses a strictly necessary sign-in cookie. It contains a signed expiry value, not Sara's education record. No advertising or analytics cookies are configured.
Contact
The data controller for this family-run record is Sara's parent or carer. The local authority should use the parent contact details through which its review link was supplied.
Before production deployment, the parent should review the privacy terms and data-processing/hosting regions offered by Vercel, the selected Postgres provider and Nous Research. This page records the application's intended handling; it is not legal advice.