Last updated: February 2026
DRAFT - FOR REVIEW This privacy policy should be reviewed by a legal professional before publishing.
Privacy Policy
JakTrack is built for families navigating the UK special educational needs system. We understand you're trusting us with sensitive information about your children, and we take that responsibility seriously.
Who We Are
JakTrack is operated by ContextEngine Ltd, registered in England and Wales (company number: 16536241).
Registered address: 20 Wenlock Road, London, England, N1 7GU
ICO registration number: [PENDING]
For any privacy-related queries, contact us at: [email protected]
Lawful Basis for Processing
We process your data under the following lawful bases (UK GDPR Article 6):
- Contract — Processing your account data and child profiles is necessary to provide the service you've subscribed to
- Legitimate interest — Security measures (IP logging, session management) to protect your account and our service
- Consent — Marketing communications (opt-in only, withdrawable at any time)
For special category data (health information about your children), we rely on explicit consent (UK GDPR Article 9(2)(a)), which you provide when entering this information into the service.
What Data We Collect
Account Information
- Email address — to create your account and send important notifications
- Name — to personalise your experience
- Password — stored securely using industry-standard hashing (we never store plain text passwords)
Child Profile Data
This is the core of what JakTrack does. You may choose to record:
- Names and dates of birth
- Diagnoses and medical information
- Strengths, challenges, and sensory needs
- Communication methods and triggers
- School and therapy information
Daily Observations & Tracking
- Diary entries and observations
- Sleep tracking data (settling time, interventions, care time)
- Meal tracking data (food acceptance, sensory responses, safe foods)
- Appointments and calendar events
- Evidence files you upload (documents, photos, EHCP PDFs)
EHCP & Benefits Data
- EHCP documents you upload for analysis
- Benefits eligibility assessments
- Process tracking data (EHCP stages, DLA applications)
Community Forum
If you participate in our community forum:
- Posts and replies you write
- Your display name (can be anonymous)
- Professional credentials if you choose to verify them
Technical Data
- IP addresses (for security purposes)
- Browser type and device information
- Session data (to keep you logged in)
How We Use Your Data
Providing the Service
- Storing and displaying your child profiles and observations
- Analysing patterns in your tracking data to surface insights (milestones, regressions, evidence strength)
- EHCP document analysis — identifying language issues, mapping evidence to sections, generating amendment letters
- Benefits eligibility assessment based on your child's profile
- Sending appointment reminders
AI-Powered Features
We use AI (provided by Anthropic) to help with:
- Extracting key information from diary entries
- Suggesting profile updates based on observations
- Onboarding conversations to build child profiles
- Quick capture — routing free-text input to the appropriate tracking category
- EHCP language analysis and amendment letter drafting
- Detecting milestones and regressions from your tracking data
- Evidence strength scoring for benefit applications
Important: Anthropic does not use your data to train their AI models. Your conversations and data are processed but not retained for training purposes. See Anthropic's Privacy Policy for details.
Payment Processing
Payments are handled by Stripe. We do not store your card details — Stripe handles all payment information securely. We receive:
- Confirmation of successful payments
- The last 4 digits of your card (for your reference)
- Subscription status
Where Your Data is Stored
All data is stored in the United Kingdom. Our servers are located in UK data centres. We do not transfer your data outside the UK except:
- When you use AI features (data is processed by Anthropic, who comply with GDPR)
- When you make payments (data is processed by Stripe, who comply with GDPR)
How Long We Keep Your Data
- Active accounts — We retain your data for as long as your account is active
- Deleted accounts — When you delete your account, we retain data for 30 days (in case you change your mind), then permanently delete everything
- Payment records — Retained for 7 years as required by UK tax law
Your Rights
Under UK GDPR, you have the right to:
Access Your Data
You can export all your data at any time from Settings → Privacy & Data → Export Data. This gives you a complete copy in JSON format.
Correct Your Data
You can edit any information in your account through the app.
Delete Your Data
You can delete your account from Settings → Privacy & Data → Delete Account. This will:
- Cancel your subscription
- Anonymise your forum posts (replace your name with '[deleted]')
- Permanently delete all your data after 30 days
Data Portability
The export feature provides your data in a structured, commonly-used format (JSON) that you can use with other services.
Withdraw Consent
You can withdraw consent for marketing communications at any time from your account settings. For special category data (health information), you can withdraw consent by deleting the relevant data or your account.
Object to Processing
Contact us at [email protected] if you have concerns about how we process your data.
Who We Share Data With
We only share data with:
- Anthropic — To provide AI features (diary parsing, EHCP analysis, profile suggestions)
- Stripe — To process payments
- Plausible Analytics — Anonymous, aggregated usage data only (page views, referral sources). No personal data is shared.
- You choose — When you share a child profile with another family member or professional
We never sell your data. We never share it with advertisers. We never use it for purposes other than providing the service.
Security
We protect your data with:
- Encryption in transit (HTTPS/TLS)
- Encryption at rest for sensitive data
- Secure password hashing
- Regular security reviews
- Access controls limiting who can see your data (only you and those you explicitly share with)
- Cross-family data isolation — users cannot access another family's data
Children's Data
JakTrack is designed for carers — parents, grandparents, foster carers, and kinship carers — to record information about the children in their care. Carers with appropriate legal authority are the data controllers for their children's information. We rely on explicit consent for processing children's special category data (health and disability information) as part of providing the service.
Children do not use JakTrack directly. The service is intended for adults aged 18 and over.
Cookies & Analytics
We only use essential cookies required for the service to work (session authentication). We do not use tracking cookies or advertising cookies.
We use Plausible Analytics to understand how people use JakTrack. Plausible is privacy-friendly — it does not use cookies, does not collect personal data (no IP addresses, no fingerprints), and is fully GDPR compliant. See our Cookie Policy for details.
Changes to This Policy
We'll notify you of significant changes via email before they take effect. Minor clarifications may be made without notice.
Contact Us
For any privacy questions or concerns:
- Email: [email protected]
Complaints
If you're not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113