# Data protection, answered for your DPO

Where plan text is processed, who can see it, who decides, and what has to be in place before a real plan is used.

## Who decides

Sendix reads and drafts; staff decide; only the council can amend an EHCP. The school or trust is the data controller for pupil data (in Scotland, the school or council); Sendix is the processor and acts on its instructions.

## In place now

- Hosted and processed in the UK: the app, its database and backups run in Azure UK South; the AI model runs on Amazon Bedrock in AWS London, which keeps no inputs or outputs for the model Sendix uses.
- Plan text stays with school staff: only the school's SENCOs and SEND leads, its trust's SEND lead, and SEND assistants on the plans assigned to them can see it in the app. Sendix administrator accounts cannot open it. Who could reach it underneath the app is answered in full at https://sendix.ai/trust.md.
- Identifiers minimised, not anonymised: Sendix removes the pupil's name, pupil number, NHS number, postcode and labelled full dates of birth before an AI model sees the text. Other names can remain.
- Deleted on the organisation's schedule: a daily job (running since 3 October 2026) deletes records when the retention period ends, and from backups within 35 days. It is not a zero-retention service.
- On the organisation's instructions, under a DPA: Sendix processes pupils' plans only on the school's or trust's instructions (in Scotland, the school's or council's), under a data processing agreement (DPA) signed in the Sendix app by someone the organisation has authorised, and countersigned by Sendix. In Scotland, the DPA and the impact assessment cover Child's Plans and IEPs, and delivery records for Co-ordinated Support Plans.
- Only what staff add: Sendix does not connect to a school's MIS or to SEEMiS. It holds only the plans and reports your staff choose to add.
- ICO registration ZC264381; data processing agreement version 1.4, approved on 6 November 2026, which covers review preparation in England.

Data protection impact assessment v0.7 is approved by Sendix and provisional, with consultation (Step 3) outstanding. The school's DPO completes the school's sections, with a template for each type of controller at https://sendix.ai/trust.md.

## What your DPO will ask

- **Where is plan text processed, and by whom?** In the UK: Azure UK South for the app, database and backups; minimised passages of the plan and reports go to an AI model on Amazon Bedrock in AWS London, which keeps no inputs or outputs for that model and does not use them for training. The DPA lists the sub-processors (Microsoft Azure, AWS Bedrock and AWS SES, all processing in the UK). Suppliers may give support from outside the UK under their own terms. The website is hosted in West Europe and never handles pupil data.
- **Who at Sendix can see plan text?** In the app, no one: only the school's SENCOs and SEND leads, its trust's SEND lead, and SEND assistants on the plans assigned to them can, with multi-factor authentication. Underneath the app, one person at Sendix, the founder, holds administrative access to the Azure infrastructure, which could reach the database; we don't use it to read plan text, and individual database queries are not logged. The full answer is in the assurance pack: https://sendix.ai/trust.md.
- **On what terms do you process our pupils' plans?** Only on the organisation's instructions, under a DPA signed in the Sendix app by someone it has authorised, and countersigned by Sendix. Real plans can be uploaded only by an organisation with a countersigned DPA that Sendix has released for real plans; until Sendix's independent penetration test is complete, no more than 3 organisations are released, and only when Sendix holds a current Cyber Essentials certificate. Staff add plans and reports as they are. Sendix removes the pupil's name, pupil number, NHS number, postcode and labelled full dates of birth before an AI model sees the text. The walkthrough uses fictional plans.
- **What do parents see?** Nothing goes to families from Sendix. It is a tool for school staff: its emails go to staff, and its drafts and exports go to the staff who use them. In England any change to an EHCP goes through the council, which consults the family; in Scotland Child's Plans and IEP targets are agreed with the child and family. The organisation is the controller, so its own privacy notice tells families; a model paragraph for its DPO to adapt (v2, 6 November 2026): "We use Sendix, a service from Sendix AI Ltd, to help our staff prepare for reviews. Sendix reads the plan, reports and staff notes, sets out evidence about each outcome and suggests next steps. A member of staff checks everything and decides; Sendix makes no decisions about your child. Sendix removes your child’s name, pupil number, NHS number, postcode and labelled full dates of birth before an AI model sees the text. Information is kept in the UK and is not used to train AI systems. Sendix acts only on our instructions, under a written data processing agreement, and the information is deleted on our retention schedule: [period]. Questions: [DPO name and contact details]."
- **Why so few pilot places?** Until Sendix's independent penetration test is complete, no more than 3 organisations use real plans. Sendix adds organisations carefully, a few at a time, so each gets close support. Staff check every suggestion during the pilot, and Sendix reports how many they accepted and rejected.
- **What happens to our data after the pilot?** At the end of the contract the organisation chooses return, deletion or both; Sendix does it within 30 days and confirms deletion in writing, unless the law requires otherwise. Deleted records leave the encrypted backups (in UK South) within 35 days.

## Talk it through with your DPO

- Book a 30-minute walkthrough with Marcus Kamuntu, founder, on a fictional plan (no pupil data, on the call or before it): https://cal.com/sendix/30min
- Questions: privacy@sendix.ai. Please do not send pupil information by email.
- Privacy notice: https://sendix.ai/privacy
- Terms of service: https://sendix.ai/terms
- Assurance pack (DPA, DPIA templates, sub-processors, break-glass, DfE self-assessment, exit plan): https://sendix.ai/trust