This Privacy Policy describes how Special Pathways processes personal information in connection with CareJournal. It should be read with the Data Protection, Security, Cookie Policy and Terms of Service pages.
1. Definitions
In this policy: Special Pathways means Special Pathways, the operator of the Service, based in the United Kingdom. The Service or CareJournal means the CareJournal website, web platform and mobile app. School means the school or organisation that subscribes to the Service. User means an individual authorised to access the Service. Personal Data has the meaning given to it under UK GDPR.
2. Controller and processor
For pupil, parent, carer and school staff records held inside the Service, the School is the data controller and Special Pathways is the data processor, acting on the School's instructions under a written agreement.
For Personal Data arising from our own business activities, including enquiries, support correspondence and administrative records, Special Pathways acts as the data controller.
3. Scope
This policy applies to Personal Data processed in connection with the Service and our communications with Schools and prospective customers. It does not replace the School's own privacy notice.
4. Personal Data processed
Personal Data processed in connection with the Service falls into a small number of broad categories:
- School and account information — basic details about a School, its authorised Users and their access.
- Pupil and progress information — records that school staff choose to enter, including identity information, links to assigned staff and family members, and observations, evidence and progress information recorded over time. Where the School's policy allows, this may include photos or short videos.
- Family information — basic contact information for parents and carers, where family access is enabled.
- Enquiries and correspondence — information provided when a School or individual contacts Special Pathways, requests a walkthrough, or requests support.
- Operational information — limited information needed to keep the Service secure and reliable.
The School decides what information about pupils and families is entered into the Service.
5. Sensitive information
Records may include sensitive information, such as information relating to a child's health, disability, communication or care needs. This may amount to special-category data under UK GDPR.
The School, as controller, is responsible for identifying the appropriate lawful basis and any Article 9 condition for processing such information. Special Pathways processes it only as processor on the School's instructions.
6. Why we process information
Special Pathways processes Personal Data to:
- provide and support the Service to Schools;
- manage user accounts and permitted access;
- support school-led progress recording and review;
- keep the Service secure and reliable;
- respond to enquiries and provide support; and
- meet legal, contractual and regulatory obligations.
7. Lawful basis
For pupil, parent, carer and staff records held inside the Service, the School is responsible for identifying the appropriate lawful basis under UK GDPR. Special Pathways processes that information as processor under contract.
Where Special Pathways acts as controller, the lawful basis will typically be contract, legitimate interests, legal obligation, or consent where required.
8. Children's information
The Service handles Personal Data about children only for school-led education, progress recording, support and review purposes. The Service is not used to market to children, advertise to children, sell or commercially profile children's Personal Data, or train public AI models. Pupil photos and videos are not used in marketing without separate written permission.
9. Automated decision-making
The Service does not make automated decisions about children. Any interpretation of a record remains the responsibility of authorised school staff. If AI-assisted features are introduced in future, they will be documented before use and will not be used to make decisions about children without appropriate human review.
10. Sharing
Special Pathways does not sell Personal Data. Personal Data is shared only where necessary to provide the Service or where required by law. Recipients may include the School, authorised Users, parents or carers where the School enables family access, service providers acting on our instructions, and legal, regulatory or safeguarding bodies where required. Where the School is the controller, sharing decisions are made by the School.
11. Service providers
Special Pathways relies on a limited number of service providers to help operate the Service. Each provider acts on our instructions and is only permitted to process Personal Data for the services it provides to us. A current list is available to Schools on request.
12. Storage and international transfers
Personal Data is stored on UK-based infrastructure. Personal Data is not transferred outside the UK or EEA unless appropriate safeguards are in place. If this position changes, this policy will be updated and Schools will be informed.
13. Security
Special Pathways applies technical and organisational measures designed to protect Personal Data. A summary is available on the Security page. No online service can be guaranteed completely secure.
14. Retention
School records are retained for as long as the School uses the Service, unless agreed otherwise in writing or required by law. On termination, an export is provided and School records are deleted or anonymised within the agreed termination period.
Correspondence and business records may be retained for longer where necessary for legal, contractual, accounting or security reasons.
15. Your rights
Under UK GDPR, individuals have rights of access, rectification, erasure, restriction, objection and portability, and the right to complain to the Information Commissioner's Office.
Where the School is the controller, requests should be made to the School. Special Pathways will support the School in responding to valid requests. Direct queries may be sent to hello@carejournal.uk. Complaints may also be made to the ICO at ico.org.uk.
16. Safeguarding
The Service is not a replacement for a School's safeguarding system or emergency procedures. Where information relates to safeguarding, child protection or legal duties, the School remains responsible for handling it under its own policies. Special Pathways may disclose Personal Data where required by law, court order or lawful request from an authorised body.
17. Cookies
The Service does not use advertising or third-party tracking cookies. See the Cookie Policy for further detail.
18. Breach notification
If Special Pathways becomes aware of a personal-data breach affecting a School's records, the School's nominated contact will be notified without undue delay and provided with the information reasonably needed to meet its own obligations.
19. Changes to this policy
This policy may be updated as the Service develops or as legal, technical or operational requirements change. Material changes will be communicated to subscribing Schools. The current version is available on the CareJournal website.
20. Contact
Privacy queries: hello@carejournal.uk.
If a request relates to school records held inside the Service, contact the School in the first instance, as the School is usually the controller for those records.