Privacy Policy — EHCP Clarity

Data controller

The data controller for the personal data described in this policy is Ianson Systems Ltd (trading as EHCP Clarity), a company registered in England and Wales with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are registered with the UK Information Commissioner's Office under registration number ZC127831.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at any time. The ICO can be contacted via ico.org.uk/make-a-complaint or on 0303 123 1113.

For questions about how we handle your data, or to exercise any of your rights, contact us at support@ehcpclarity.co.uk. We aim to respond within 5 working days, and in any event within 1 calendar month of receipt as required by UK GDPR for data subject requests. For complex or numerous requests we may extend this period by up to 2 further months and will notify you of any extension within the first month.

This website does not send your information to OpenAI

EHCP Clarity is a prepared-pack service. You match your situation, pay, send documents and intake, and an assigned case professional prepares a draft pack for you to review, then send with our guidance.

The website does not include a feature that sends your files, intake answers, emails, or case notes to OpenAI or any other AI provider on your behalf. Uploaded files and structured intake are stored in our database so staff can prepare the pack. They are not forwarded to a model as part of using the site.

When staff prepare a draft, they may use AI writing tools as an internal staff aid only. If they do:

They paste short excerpts only — not your original files.
Names, addresses, dates of birth, NHS numbers, email addresses, phone numbers, and other identifying details are removed first.
The case professional remains the author of the pack. A person reviews it before you see it. You review it before you send it.

You do not use those writing aids on this website. That staff use does not make automated decisions about you or your child (UK GDPR Article 22). See How we handle your data.

Staff access to prepare your pack

If you purchase a prepared pack and send intake answers or documents, you will be asked for explicit consent before authorised EHCP Clarity staff can use that material to prepare a draft. That access may include special category information (for example educational and health-related details about your child).

Staff access is limited to people who need it to prepare or support your pack, and is logged. That includes a later stage on the same case (for example a refusal after a request letter). Included email support is 14 days after delivery; we keep the working file longer so it is still there if you come back. The service is case preparation only — it is not legal advice or representation.

You may withdraw consent by emailing support@ehcpclarity.co.uk; we will stop further preparation, subject to any retention required for disputes, accounting, or legal obligations.

What data we store

Account details: Your email address and name, provided when you create an account. Authentication is managed by Better Auth using secure, server-side HTTP-only session cookies. Credentials are held in our database.
Pack information: Child's name, your name, local authority, school or setting, optional address, the pack route, and other identifiers needed to prepare an accurate draft.
Intake answers: The structured questions you answer after payment about this situation — in your own words. These may include health, disability, and educational details about your child.
Documents you send: Files you upload in the portal or email to us (for example decision letters, EHCPs, school reports, professional reports). These often contain names and special category data. They are stored so staff can prepare the pack. They are not sent through this website to an AI provider.
Commentary and emails: Messages between you and staff about the pack, and emails we send or receive about your case (including if we need more information).
Draft we prepare: The letter or grounds we prepare for you to review and send.
Payment records: If you purchase a pack, we store a record of the payment (via Stripe) including the session reference and amount paid. We do not store card details.
Consent record: The date and time you gave consent to process your data, stored so we can demonstrate compliance.

Special category data

Preparing an EHCP pack almost always involves special category personal data as defined by UK GDPR Article 9 — including health conditions, disabilities, and educational psychology information about your child — in the answers you type and the documents you send.

We process this data under UK GDPR Article 9(2)(a) — your explicit consent, given before you use the service and again when you send intake or documents — and, where your use of the service is connected with preparing an application, appeal, or related claim, under Article 9(2)(f) (processing necessary for legal claims). Where the purpose is to help secure appropriate educational or therapeutic support for a child with special educational needs, we may also rely on Article 9(2)(g) (substantial public interest) read with Schedule 1 Part 2 paragraph 29 of the Data Protection Act 2018 (safeguarding of children and individuals at risk).

Please do not include sensitive personal data about third parties (such as other children or professionals) unless it is strictly necessary for the pack.

Lawful basis for processing

Performance of a contract (Art. 6(1)(b)): Processing your account, intake, documents, and the draft pack is necessary to deliver the prepared-pack service you have purchased or asked us to start.
Consent (Art. 6(1)(a) and Art. 9(2)(a)): We rely on your explicit consent to process special category data, including health and disability information about your child.
Legal obligation (Art. 6(1)(c)): We retain payment records for 7 years to comply with financial reporting and tax obligations.
Legitimate interests (Art. 6(1)(f)): We process limited technical data (error logs, usage metadata) to keep the service secure and working. We have assessed that this does not override your rights and interests.

How we use your data

We use your data to provide the EHCP Clarity service to you. Specifically:

To prepare the document you send (a request letter, appeal grounds, or plan letter) and guidance on how to send it and what to attach
To match common council responses and include relevant SEND law references in that draft
To ask you for missing information, and to email you about your pack
To process payments via Stripe
To troubleshoot technical issues and keep the service secure

We do not use your documents or intake to train AI models. We do not send the pack to the local authority or the Tribunal for you. You remain responsible for reviewing the draft and for what you send. We work from the information you provide and do not independently verify it.

You can match your situation on the checker without creating an account. We ask you to sign in when you pay, save a case, send documents, or continue a pack in the dashboard.

Authentication is handled by Better Auth using secure, server-side HTTP-only cookie sessions. Your email and password are stored in our database. See Sub-processors below.

Session duration. Once signed in, your session remains active for up to 7 days of inactivity. If you do not use the service for 7 days your session will expire and you will be asked to sign in again. Sessions are held as HTTP-only cookies and are invalidated server-side on sign-out.

Names and identifiers on the pack

A usable pack needs real identifiers on the letters — typically the child's name, your name, the local authority, and the school or setting. We store those on the case record so staff can prepare an accurate draft. You choose how much address detail to give.

Please do not send more identifying information than the pack needs (for example, full documents about another family). You can delete a pack from your dashboard. That removes associated files and intake from the live service, subject to the retention rules below.

No automated decisions

In accordance with UK GDPR Article 22, EHCP Clarity does not make solely automated decisions that produce legal or similarly significant effects about you or your child. Draft packs are prepared and checked by people. You decide what, if anything, you send.

We use a small number of trusted sub-processors. Some are based in the United States. Data transfers to US-based processors are covered by the UK-US Data Bridge (a UK adequacy decision) where the processor is certified, and by standard contractual clauses or the UK International Data Transfer Agreement where required. Contact us at support@ehcpclarity.co.uk to request details of specific transfer safeguards.

Better Auth (United Kingdom / EU (database)): Session-based authentication. Session tokens are stored as HTTP-only cookies. Credentials are held in our database (Neon, EU region).
Neon / PostgreSQL (European Union): Database storage for accounts, case records, intake answers, commentary, and uploaded files. Files are not sent from this database to an AI provider as part of using the website.
Vercel (United States / European Union): Application hosting and infrastructure. Transfer covered by UK-US Data Bridge where applicable.
Stripe (United States / European Union): Payment processing when you purchase a pack. Transfer covered by UK-US Data Bridge and EU adequacy. We do not store card details.
Resend (United States): Transactional email (for example pack updates, requests for more information, and replies). Transfer covered by appropriate UK transfer safeguards.
Google (Analytics) (United States): Only if you accept analytics cookies. Page-view analytics. Not used for advertising. See Cookies below.
OpenAI (internal staff writing aid only) (United States): Not used via this website to process your files or intake. Staff may paste short, de-identified excerpts into AI writing tools as an internal aid when preparing a draft. Identifying details are removed first. Original documents are not uploaded. If that aid is OpenAI, transfer is under OpenAI’s terms for that use; content is not used to train their models under standard API terms where we use the API.

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes. We do not send your pack to the local authority or the SEND Tribunal unless you ask us to in writing — and the ordinary service is that you send it.

How long we keep your data

Intake, uploaded files, case messages, and names on the pack: Held while we prepare the pack and for 12 months after the last activity on the case, so a later refusal or appeal can reuse the same file. Included email support is 14 days after delivery — that is not when we delete the documents. You can delete a pack from your dashboard at any time.
Email support window: 14 days of email support after delivery is included. The working file stays available after that window.
Payment records: Retained for 7 years to meet legal and accounting obligations.
Account details (email, name): Removed within 30 days of receiving and processing an account closure request.
Consent records: Retained for 3 years from the date of consent as evidence of compliance, then deleted.

Your rights under UK GDPR

Under UK GDPR, you have the following rights. To exercise any of them, email support@ehcpclarity.co.uk with the subject line Data rights request. We will respond within 30 days.

Right of access (Subject Access Request): You can ask us to confirm what personal data we hold about you and receive a copy of it.
Right to rectification: You can ask us to correct any inaccurate or incomplete personal data we hold about you.
Right to erasure ("right to be forgotten"): You can ask us to delete your personal data. You can also delete individual packs yourself from your dashboard — this removes associated documents, intake, and draft materials from the live service. For full account deletion, email us.
Right to restriction of processing: You can ask us to restrict how we use your data — for example, while you contest its accuracy.
Right to data portability: You can request a machine-readable copy of the personal data you have provided to us. Use the "Download my data" button in your account settings if shown, or email us to request a full export.
Right to object: You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests.
Right to withdraw consent: Where we rely on consent (including for special category data), you can withdraw it at any time by contacting us. Withdrawal does not affect the lawfulness of processing before the withdrawal. If you withdraw while a pack is in preparation, we may not be able to finish it.
Right to lodge a complaint with the ICO: If you believe we have handled your data unlawfully, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Cookies

Essential cookies keep you signed in and let the service work. These are set by our server (via Better Auth) as HTTP-only session cookies and are always used when you use the platform.

Analytics cookies are optional. If you choose Accept on our cookie banner, we load Google Analytics (GA4) to understand how visitors use the site — for example which pages are viewed. Google may set cookies such as _ga. We do not use advertising cookies.

If you choose Essential only or Decline, analytics cookies are not loaded. You can change your mind by clearing site data in your browser and revisiting the site.

Changes to this policy

If we make material changes to this policy, we will notify you by email at least 15 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy. The "Last updated" date at the top of this page always reflects the most recent version.

Contact

If you have questions about this policy or how we handle your data, email support@ehcpclarity.co.uk.