EHCP Compass — free EHCP guidance and SEND support for families in England
← Back to home

Privacy Policy

Last updated: 6 July 2026

EHCP Compass is available in 7 languages: English, Punjabi, Urdu, Hindi, Bengali, Polish and Arabic. For case-specific legal advice in your language, always contact IPSEA on 0300 222 5899.

Who we are

EHCP Compass CIC is a Community Interest Company registered in England and Wales (company number 17240537). Our website is ehcpcompass.co.uk. We provide free workflow tools, letter templates, and legal-rights guidance for parents of children with special educational needs and disabilities (SEND) in England.

If you have any questions about this policy or about how we handle your data, email us at help@ehcpcompass.co.uk. We are the data controller for the personal data we collect.

What data we collect

We collect:

  • Information you give us — when you sign up for our email list, contact us, or use any forms on our site. This may include your name, email address, and the content of your messages.
  • Information collected automatically — basic technical data (IP address, browser type, pages visited) via our hosting platform and any analytics we use. We aim to keep this minimal.
  • Cookies — see “Cookies” below.

If you create an account or use the case-management features, we also process the data described under “User accounts” and “Evidence uploads” below — including information about your child’s SEND needs that you choose to save. We do NOT collect payment information: our tools are free for parents.

User accounts

If you sign up for an account, we store the following in our backend database (Lovable Cloud, powered by Supabase, hosted in the EU):

  • Account details — your email address, a password hash, your name (if you provide one), and your role (parent or adviser).
  • Case information you save — the child’s first name or nickname (as you enter it), key EHCP dates (e.g. assessment requested, final plan issued), and the deadlines we calculate from those dates.
  • Letters you draft or save — text you write or generate using our letter templates.

Access is protected by row-level security so only you can read or edit your own account data. If you delete your account, we delete your profile, saved cases, deadlines, letters and uploaded evidence within 30 days.

Evidence uploads

The case-management area lets you upload files and notes about your child — for example professional reports, school letters, photos, or your own notes. This will normally include special category data under UK GDPR (information about your child’s health, disability or SEND needs).

  • Lawful basis — Article 6(1)(a) consent and Article 9(2)(a) explicit consent. You choose what to upload; you can delete it at any time.
  • Where it’s stored — in a private, access-controlled storage bucket on Lovable Cloud. Files are encrypted in transit (HTTPS) and encrypted at rest by the storage provider.
  • What we do with it — nothing except display it back to you inside your own account. We do not read it, analyse it, share it, or use it to train any AI model.
  • Deletion — you can delete any file at any time from your case. When you delete your account, all uploaded evidence is deleted within 30 days.

AI-powered tools

Several tools — Translate a letter, Grants Match, and the Annual Review helper — send text you paste in to a large language model to generate a plain-English explanation, suggestion, or draft. When you use one of these tools:

  • The text you paste is sent through the Lovable AI Gateway to an underlying model provider (currently OpenAI and Google Gemini).
  • Under the Lovable AI Gateway terms, the text you submit is not used to train AI models and is not stored beyond the time needed to process your request.
  • We do not store the content you paste on our servers. We keep a minimal anonymised log (a one-way hash of your IP, timestamp, chosen language, and input length) for abuse prevention.
  • Please remove your child’s name and any identifying details (school name, case reference, addresses, date of birth) before pasting. The tools work just as well with “my child” in place of a name.
  • AI output is information, not legal advice. Always consult IPSEA, SOS!SEN, or a qualified SEND professional for advice on your specific case.

Why we collect data, and our lawful basis

  • Newsletter sign-ups — to send you the resources you requested and occasional updates. Lawful basis: consent (you can withdraw at any time).
  • Contact form messages — to answer your questions. Lawful basis: legitimate interest.
  • Anonymous analytics — to understand which pages help parents most. Lawful basis: legitimate interest.
  • Essential cookies — to make the site work. Lawful basis: strictly necessary.
  • Analytics cookies (if any) — to improve the site. Lawful basis: consent.

Who we share data with

We share your data only with:

  • Resend — our email service provider, who sends emails on our behalf.
  • Lovable Cloud — our website hosting and storage provider.
  • OpenAI and Google — as upstream providers for our AI-powered tools, accessed via the Lovable AI Gateway (see “AI-powered tools” above).
  • Other service providers necessary to run the website (e.g. hosting, security, error logging).

We do NOT sell, rent, or trade your data. We do NOT share your data with advertisers, third-party marketers, or anyone outside the services that actually keep the site running.

If we ever needed to share data with a regulator, a court, or to prevent fraud or abuse, we would do so only where the law requires it.

International transfers

Some of our service providers may store data on servers outside the UK. Where this happens, we ensure appropriate safeguards are in place — including standard contractual clauses approved by the UK government.

How long we keep data

  • Newsletter subscribers — until you unsubscribe, or 3 years of inactivity, whichever comes first.
  • Contact form messages — 2 years after the last exchange, then deleted.
  • Anonymous analytics — up to 26 months.
  • Bengali audio waitlist — if you join the Bengali audio waitlist, we store your email address until the Bengali audio launches (estimated 2026), after which we will delete the list. We will only email you about Bengali audio availability — never marketing.
  • Account data, saved cases, letters and evidence uploads — kept for as long as your account is active. Deleted within 30 days of you deleting your account.

Your rights under UK GDPR

You have the right to:

  • Access the personal data we hold about you.
  • Rectification — correct anything inaccurate.
  • Erasure (“right to be forgotten”) — ask us to delete your data.
  • Restriction — limit how we use your data.
  • Objection — tell us to stop processing your data in certain circumstances.
  • Portability — receive your data in a portable format.
  • Withdraw consent — at any time, for anything you previously agreed to.

To exercise any of these rights, email help@ehcpcompass.co.uk. We’ll respond within one month.

Cookies

Our site uses:

  • Essential cookies — required for the site to function. These can’t be switched off.
  • Analytics cookies (if any) — only set with your consent.

You can manage cookies in your browser settings or via the cookie banner on our site.

Children

Our site is for parents, carers, and professionals supporting SEND families. We do not knowingly collect data from children under 13. If you believe a child has provided us with data, please email help@ehcpcompass.co.uk and we will delete it.

Complaints

If you believe we’ve mishandled your data, please contact us first at help@ehcpcompass.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO):

Changes to this policy

We may update this policy as our service grows or laws change. The “Last updated” date at the top will reflect the most recent version. Significant changes will be flagged on the homepage.