A record about a child deserves care

Document parsed from: Individa_Privacy_Policy.pdf

Who we are

Individa is run by Individa Ltd, company number 17454403, registered at 71-75, Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are registered with the Information Commissioner's Office under number ZC282309. Individa is the data controller for the information described here. Write to hello@individa.app about anything in this notice, including any request about your data.

What we hold

Your name and email, your plan, your phone number if you log by WhatsApp (used only to match your messages to your account), the children you add and their age and location if you give them, the moments you log (including any you send by WhatsApp), and the readings, reports and briefs Individa generates from those moments, including patterns it notices in your child's learning and behaviour.

Information about your child comes from you. We need your name and email to run your account. Everything else is optional, and you decide what goes in. The moments you log may mention other people, such as a sibling who isn't on your account, a friend or another parent or caregiver. We hold only what you write, use it only to build your child's record, and remove names where we can before our team reviews readings. Keep details about other people to what you need to describe the moment. We hold these mentions on the basis of our legitimate interests, and your family's, in keeping a full learning record. If you have been mentioned in a family's record, you have the rights set out below, and you can contact us at hello@individa.app.

Why we hold it

Account details and the learning record are processed to deliver the service you asked for, and that includes the behaviour analysis, which is part of the core service. Product improvement, security and abuse prevention rest on our legitimate interests, balanced against your family's privacy, which is why anything a reviewer sees is pseudonymised. Health context is special-category data and is processed only on your explicit consent, which you can withdraw at any time by clearing those fields.

Health information

You can choose to add health or neurodevelopmental information about your child, such as a diagnosis or a suspected condition. It's optional, and Individa works without it.

It helps Individa tailor its suggestions to how your child learns. Health information is special category data, which the law protects more strongly. We only save it after you tick a box agreeing to it, and we record when you did. Agreeing to this policy when you sign up doesn't count as that consent.

Anyone who signs in to your family's account can see the health data. It's stored separately from the learning record.

You can clear the health section at any time. That deletes the information and ends your consent.

Who can see it

You, and anyone who signs in to your family's account. Access rules at the database level mean a record can only be read by the account that owns it. A brief link you create yourself is read-only, expiring and revocable, and carries health context only if you separately allow it. Our own team can see

pseudonymised readings for quality checking: children appear as a letter and an age band, health flags are not shown at all, and we remove names, addresses and contact details automatically. This catches most identifying details, but it can miss something like a name typed into a log, so only a small team bound by confidentiality carries out these checks.

AI processing

When you log a moment, the text is sent to a hosted AI model to be read and mapped to skills and interests. The model provider does not use your content to train its models. Readings our team judges correct may be kept as worked examples to improve future readings, only after names and other direct identifiers have been removed. The AI only ever suggests: every reading, report and brief is reviewed and accepted by you, and no decision about your child is ever made automatically.

Children's data

Accounts are held by adults. Children do not sign in and are not users of the service. We collect the minimum needed to build a useful record, and you decide what goes in. Individa is not a diagnostic, medical, legal or educational-compliance service.

How long we keep it

For as long as your account is open. Delete your account from the Account page and your login, children, moments, reports and share links are removed. Readings previously approved for quality survive only in anonymised form, with no link to you or your child.

Your rights

You can access, correct, erase or restrict our processing of your data, and take your data elsewhere. Download and deletion are self-service on the Account page and take effect immediately. If you would rather we handled something, email us and we will respond within one month.

Your right to object. You can object to anything we do on the basis of our legitimate interests, such as product improvement. Tell us and we will stop, unless we have compelling grounds to continue.

Who processes data on our behalf

Database and authentication through Supabase, hosted in London; the website through Lovable; AI processing through Google's Gemini models, reached through Lovable; and WhatsApp message delivery through Meta's WhatsApp Business platform. Data is processed in the UK, the EEA and the United States. The UK has approved data protection in the EEA, so no extra safeguard is needed there. For the United States, Lovable and WhatsApp use the UK International Data Transfer Addendum to the EU standard contractual clauses, and Google is certified under the UK-US data bridge. Email us for a copy of these safeguards. We will tell you before adding a processor that changes this picture.

Security and cookies

Access is enforced per account at the database layer rather than in the interface alone, health context is stored separately, share links expire and can be revoked, and admin actions are logged. No system is perfect, so tell us at once if you think something is wrong. We set only the cookies needed to keep you signed in: no advertising or third-party tracking cookies.

Changes

This notice will grow as the service grows. If we change anything material we will write to you before it takes effect.

Complaints

If you are unhappy with how we have handled your data, tell us first at hello@individa.app. We will acknowledge your complaint within 30 days, keep you updated, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, if you are unhappy with how we handle your data, at ico.org.uk/make-a-complaint or on 0303 123 1113.