Privacy Notice

1. Who We Are

OKAYiT is a digital wellbeing platform designed for young people living in residential children's homes in the United Kingdom. The platform is operated by OKAYiT Ltd ("we", "us", "our"), acting as the Data Controller.

Contact: privacy@okayit.uk

2. What Information We Collect

We collect the minimum information needed to provide you with a safe, personalised experience:

• Account information, your name, email address (staff) or invite code (young people), and care home assignment.
• Wellbeing check-ins, your daily mood rating and any notes you choose to add. These are only stored if you explicitly consent to share them.
• Journal entries, entirely private to you. Stored encrypted. Staff cannot access them.
• Safety plan, your trusted adults, safe places and coping strategies. Only visible to you.
• Usage data, anonymised analytics (pages visited, features used) to improve the platform. No tracking cookies are used.

3. Lawful Basis for Processing

Under UK GDPR, we process your data on these legal bases:

• Legitimate interest (Article 6(1)(f)), providing the core wellbeing service and safeguarding support.
• Explicit consent (Article 9(2)(a)), for processing special category health/wellbeing data. Consent is freely given, specific, informed and can be withdrawn at any time.
• Vital interests (Article 6(1)(d)), where a safeguarding concern is identified and immediate action is needed to protect you.

4. Children's Data & Age Appropriate Design

OKAYiT is designed for users aged 8-17. In accordance with the UK Children's Code (Age Appropriate Design Code), we:

• Default to the highest privacy settings.
• Minimise data collection to only what is strictly necessary.
• Present privacy information in age-appropriate, plain language.
• Do not use nudge techniques, profiling, or behavioural tracking.
• Do not share data with third parties for marketing or commercial purposes.

5. How We Protect Your Data

• All data is transmitted over encrypted HTTPS connections (TLS 1.2+).
• Database access is restricted to authorised systems only.
• Staff access is controlled by role-based permissions (RBAC), key workers only see data for young people at their home.
• Sessions automatically expire after 30 minutes of inactivity.
• All cache and local storage is cleared on logout.
• Safeguarding records are immutable, they cannot be edited or deleted once created.

6. Your Rights

Under UK GDPR, you have the right to:

• Access, request a copy of the personal data we hold about you.
• Rectification, ask us to correct inaccurate data.
• Erasure, ask us to delete your data (subject to safeguarding obligations).
• Restrict processing, ask us to limit how we use your data.
• Data portability, receive your data in a machine-readable format.
• Withdraw consent, at any time, without affecting the lawfulness of prior processing. You can stop sharing your check-in data by choosing "keep private" on your check-in.

To exercise any right, speak to your key worker or email privacy@okayit.uk.

7. Data Sharing & International Transfers

We do not sell or share your data with third parties for marketing. Data may be shared:

• With authorised staff at your care home (only data you consent to share).
• With safeguarding authorities if there is a risk of harm, this is a legal obligation.
• With our hosting provider (Abacus.AI, based in the US) under appropriate safeguards including Standard Contractual Clauses (SCCs).

8. Data Retention

We keep your data for no longer than necessary:

• Active accounts: data retained while you use the platform.
• Leavers: core profile anonymised or deleted within 90 days of leaving care, unless required for safeguarding records.
• Safeguarding records: retained for the period required by local authority policy (typically until the young person reaches 25).

9. Complaints

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO):

ico.org.uk/make-a-complaint • Helpline: 0303 123 1113

10. Changes to This Notice

We may update this privacy notice from time to time. Significant changes will be communicated through the platform. The "last updated" date at the top will always reflect the current version.