Privacy Notice

Zifankrah Ltd ("we", "us", or "our") is the Data Controller for all personal data processed through the SENDSerene web application.

• Company Registration: Zifankrah Ltd (Company No: 17375851)
• ICO Registration: To be confirmed
• Data Protection Contact: privacy@sendserene.co.uk

To provide our core services, SENDSerene processes sensitive records concerning children and individuals with special educational needs and disabilities. Under UK GDPR (Article 9), this constitutes Special Category Health and Educational Data.

We collect and process:

• Child Details: Name, date of birth, and educational background.
• Health & Need Records: Medical diagnosis letters, Speech & Language Therapy reports, Occupational Therapy assessments, Individual Education Plans (IEPs), and EHCP drafts.
• Parent/Carer Account Data: Name, email address, billing details, and login credentials.
• Voice Recordings: Ephemeral audio used strictly for immediate text transcription.

Our Legal Basis for Processing:

We process standard personal data under Article 6(1)(b) (Performance of a Contract) and Special Category Data under Article 9(2)(a) of UK GDPR (your explicit consent, given upon account creation).

• 18+ Requirement: SENDSerene is currently restricted to adults aged 18 or older who are the parent, legal guardian, or authorized carer for the child or young person named on the account.
• Account Ownership: The registering parent or guardian is the primary Account Owner and controls all data access, file uploads, and collaborator invitations.
• Dispute & Capacity Policy: If a young person or third party demonstrates legal Court of Protection Deputyship or legal authority regarding a child's records, SENDSerene will follow formal verification procedures to manage, transfer, or close the associated account.

SENDSerene utilizes automated language processing and Optical Character Recognition (OCR) to decode documents and categorize voice notes. We enforce strict data protection safeguards across all AI interactions:

• Zero Model Training: Your uploaded documents, audio recordings, and extracted text are never used to train third-party AI models.
• Data Anonymisation Layer: Before text passages are processed for jargon decoding, personally identifiable information (such as full names, home addresses, and NHS numbers) is automatically scrubbed or masked where technically feasible.
• Secure UK Infrastructure: All database records, OCR data, and file storage buckets are hosted strictly within the AWS London region (eu-west-2) under AES-256 server-side encryption.

Under UK GDPR, you retain full ownership and control over your family's data:

• 1-Click Data Portability: You may export a complete, zipped archive of all uploaded files, voice transcripts, and decoded summaries at any time via your Account Settings.
• Audio Deletion: Source audio files recorded via the browser are permanently erased from our servers within one hour of processing.
• Account Erasure (Right to be Forgotten): If you cancel your subscription or request account closure, all associated child records, uploaded PDFs, OCR extractions, and user profiles will be permanently deleted from active databases within 30 days.