Legal & Trust

Privacy, terms and how your family's information is handled.

Template drafts — not legal advice. NESTA processes information about children, which is special category data under UK GDPR. Before launch, these documents must be reviewed and approved by a qualified UK legal / GDPR professional, and you should register with the ICO as a data controller. Replace the placeholder contact email with your real address.

Important Information

NESTA is designed to help parents organise, understand and navigate their child's SEND journey.

NESTA does not replace professional advice or services. Information and guidance provided through NESTA, including AI-generated information, is for general informational and organisational purposes only and should not be relied upon as legal, medical, educational or financial advice.

Where you require advice specific to your child or your circumstances, you should seek guidance from an appropriately qualified professional or relevant organisation.

NESTA does not make decisions on behalf of parents, schools, local authorities or other professionals. Any information provided should be considered alongside professional advice and your own circumstances.

If you are unsure about an important decision concerning your child, we recommend seeking advice from a suitably qualified professional.

NESTA is a tool for parents and carers of children with special educational needs and disabilities (SEND). This policy explains what information we hold, why, and your rights.

What we collect

  • Account email address (used to sign you in).
  • Child profiles you add: name, date of birth, diagnosis, EHCP status and dates, local authority and school contacts, notes and photo.
  • Documents you upload to the vault, appointments, school incidents, progress notes and saved emails.
  • Security audit logs (e.g. sign-in, data export, deletions) linked to your account.

Why we use it

To provide the service you have requested (UK GDPR Art. 6(1)(b) — contract) and with your consent (Art. 6(1)(a)). Health and diagnosis information about a child is special category data, processed only with your explicit consent (Art. 9(2)(a)). You can withdraw consent at any time by deleting the data.

How long we keep it

Only until you delete it. You can delete individual documents, a child profile, or your whole account at any time from Settings → Privacy & Security.

Sharing & sub-processors

We do not sell your information. It is shared only with the sub-processors listed in the Third-Party Services section, and only the minimum needed to run the service.

Your rights

  • Access, rectify, port or delete your data.
  • Restrict or object to processing.
  • Withdraw consent at any time.
  • Complain to the ICO (ico.org.uk) if you have concerns.