Privacy Notice
Introduction
This Privacy Notice explains how AI and Metaweb Technologies ("we", "us", "our") collects, uses, stores and protects personal data. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you are a parent or carer using our MySENn platform, a separate, dedicated MySENn Privacy Notice is provided in the app and explains that processing in full. This notice covers our processing as a company, including MySENn, our website, and our business operations.
Who we are
Our role
Depending on the circumstances, we act as:
Personal data we process
The MySENn platform (as controller)
MySENn supports parents and carers of children with Special Educational Needs (SEN) in recording and understanding their child’s wellbeing. MySENn is currently operating as a private, limited pilot with a tightly controlled group of parents and carers from the SEN community; it is not yet publicly available. As controller we process:
All MySENn data is provided directly by the parent or carer; we do not obtain it from the NHS, schools or any other source. Full details, including retention and your rights, are in the MySENn Privacy Notice in the app.
Where we act as a processor for healthcare organisations
Where we are engaged by a healthcare organisation, we may process on its behalf: patient identification data (such as NHS number, name and date of birth), clinical and diagnostic data, device usage data, and healthcare professional identifiers. This may include special category health data. We process such data strictly under the controller organisation’s documented instructions.
Business operations (as controller)
AI-specific processing
Lawful bases for processing
Where we process health data as controller outside MySENn, we rely on the applicable Article 9 UK GDPR condition and, where required, Schedule 1 of the DPA 2018.
Data sharing
We may share personal data with:
All third parties handling personal data for us are contractually bound to protect it. We do not sell personal data.
International transfers
Data is stored and processed in the UK. Limited support access from our software vendor’s team in India is a restricted transfer under UK GDPR Chapter V and is protected by a data processing agreement incorporating the UK International Data Transfer Agreement (IDTA), alongside encryption, access controls and audit logging. Any other transfer outside the UK will only occur with appropriate safeguards in place.
Data security
We implement appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls and least privilege, multi-factor authentication for administrative access, audit logging, pseudonymisation of child profiles, secure hosting environments, and model governance controls.
Data retention
Your rights
Where we act as controller, you have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time where processing is based on consent. For MySENn, parents and legal guardians exercise these rights on their child’s behalf. Contact us using the details in section 2; we respond within one month.
Where we act as processor, please contact the relevant healthcare organisation (the controller); we will support it in responding.
Complaints
You may complain to the Information Commissioner’s Office (ico.org.uk). We encourage you to contact us first so we can try to resolve your concern.