DRAFT — for legal review before launch
Privacy notice
Last updated 6 October 2026
SEN Patterns helps parents and carers of autistic children and children with ADHD keep track of how things are going, and find support. To do that it holds information about you and about your child, some of it about your child’s health. This notice says what we hold, why, who else handles it, how long we keep it, and what you can do about it.
SEN Patterns is run by [owner to confirm: legal name, company number and registered address]. We decide how your information is used, which makes us its controller under UK data protection law. Our registration number with the Information Commissioner’s Office is [owner to confirm].
Questions about your information go to privacy@senpatterns.com.
The short version
- We hold what you choose to tell us, and use it to run SEN Patterns for you.
- Children do not have accounts. A parent or carer enters everything about a child.
- We never sell your information, and SEN Patterns never shows adverts.
- AI features only run while you have them switched on.
- We count how the website is used only if you say yes.
- You can download everything we hold, or delete your account, at any time from inside the app.
What we hold
About you
- Your email address, name and password, and how you sign in. Your password is held by our sign-in provider, Clerk. We never see it.
- How you would like to be addressed: your name and your relationship to your child, and, only if you choose to add them, your gender and a photo.
- Your settings.
If you sign in with Google or Apple
With Continue with Google, Google tells us your name, your email address and your profile picture. With Sign in with Apple, Apple tells us your name and either your email address or a private address that forwards to it. We use these only to create your account, sign you in, and show your own name and picture to you in the app. We do not ask Google or Apple for anything else, such as your contacts, calendar or files, and we never sell or share what they send us.
SEN Patterns’ use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
About your child
- Their name, the name they go by and their date of birth, and, only if you choose to add them, their gender and a photo or cartoon avatar.
- What you tell us about their needs: their diagnosis or where they are with an assessment, how they communicate, their sensory needs, what can be too much and what helps, how distress shows, their routines, their interests and strengths, and what you would most like help with.
- School: the school’s name and contact details, the SENCO’s details, the type of school, whether there is an EHCP, and how your child gets on there.
What you record
- Sleep, mood, meals (with any photos you add), behaviour, meltdown support, daily check-ins and reflections, notes, progress, routine ticks and calendar events.
- School days, incidents, school events, teacher notes and behaviour plans.
- Medicines you list for your child: the name, the dose and any notes, and the times you want reminding. The reminders are set on your phone itself and say only that it is time for medication.
- Documents you upload, such as a behaviour plan.
- Voice logs. What you say becomes entries that you check before anything is saved. The words themselves are kept with the entries unless you switch off “Save raw transcript” in Settings.
- Contacts you add: the support and emergency contacts on the meltdown support page, and the address book in the information hub.
Other things
- Location: the postcode or area you set, and its position on a map, to find services near you and, unless you switch it off in Settings, to show the weather there on the daily overview. On the website you can choose to share your device’s position instead of typing a postcode.
- Subscriptions: your plan, any trial, and the reference numbers Stripe, Apple or Google give a subscription. We never receive your card details.
- Phones: if you turn notifications on, a code that identifies your phone for them, the phone’s name and type, and a record of each notification sent.
- A record of access, to keep your information safe: when it is downloaded, printed as a report or summary, or sent to the AI service; when a carer in your household opens one of your children (at most once a day); when a child is deleted; and when our staff look your account up. It says who did it and when, never what your records say.
- The half-price year: if you send us proof of benefits, the email and the letter or screenshot with it. A letter about Disability Living Allowance or Personal Independence Payment says that you or your child is disabled, which is health information. We use it only to check that you can have the half-price year, and we delete the email and the letter as soon as we have checked them. What we keep is the date we checked and how long your offer is open, never which benefit you get.
- The feedback board: posts you write, your votes, posts you report and people whose posts you have hidden. Posts are shown to other parents without your name.
- AI: notes and summaries written for you by AI, any of those notes you report to us (with your reason, if you give one), and how many AI requests your account makes each day, so that they can be limited.
- If you say yes, how the website is used: which pages you open, where you click and the kinds of entry you save. See cookies and similar storage.
Information about your child’s health
Much of what you record about your child, such as a diagnosis, how they communicate, meltdowns or sleep, is information about their health. UK data protection law gives it extra protection as special category data. We use it only to provide SEN Patterns to you, and our condition for doing so is [owner to confirm: the Article 9 condition, likely your explicit consent, and how it is recorded].
SEN Patterns never diagnoses, scores or rates a child, and nothing it shows you is medical advice.
Why we use it
- To provide the app: keeping what you record and showing it back to you, including as charts, patterns and summaries.
- To send the emails and notifications you switch on.
- To run the AI features, while they are on.
- To take payment for Family, and keep track of it.
- To keep the service secure and working, and to find and fix problems.
- If you say yes, to understand which parts of the website are used, so that we can improve it.
- To answer you when you write to us, including proof of benefits for the half-price year, and deletion requests.
Our lawful bases are: contract, for providing SEN Patterns to you; your consent, for AI features, notifications, summary emails and website analytics, each of which you switch on and can switch off; legitimate interests, for keeping the service secure and limiting misuse; and legal obligation, for payment records and for answering requests about your information.
Children
- SEN Patterns is for adults who look after a child. You must be 18 or over to create an account.
- Children do not have accounts, do not sign in, and are never contacted by SEN Patterns.
- Only a few answers are needed to set up a child’s profile. Everything else you tell us about your child is up to you, and can be changed or removed later.
- Another adult who cares for your child can join your household with an account of their own. Who you invite is up to you. Once they accept, they can see, add to and edit everything recorded about the children in your household, including what was logged before they joined.
- What a carer adds becomes part of the child’s record, kept with the account that added the child. If you remove them, they lose access straight away and what they logged stays. Deleting their own account does not delete the child’s records; deleting yours deletes your children and everything recorded about them.
- If you have turned AI features off, nothing about your child is sent to Gemini, even when a carer in your household has turned them on.
AI features
SEN Patterns can use Google’s Gemini AI. You are asked once whether to use it, and you can change your answer at any time in Settings, under “Use AI features (Google Gemini)”. While it is on, this is what each feature sends:
- A short note after you save an entry: your child’s first name, their diagnosis, and the entry.
- A summary of the week, each morning: your child’s first name and diagnosis, and averages and counts from the last seven days of sleep, mood, meals, behaviour and school.
- Voice logging: on the phone, your recording, which SEN Patterns does not keep once it has been turned into text; on the website, the text your browser made from it. To sort it into entries, Gemini also receives your child’s first name and their usual bedtime and wake-up time. Nothing is saved until you check it.
- Reading a meal photo: the photo, and the food names the app already uses.
Voice logging and meal photos only run when you press their button. Notes written by AI are labelled as written by AI. They can be wrong, and they are not professional advice.
With AI features off, none of this is sent, and everything else in SEN Patterns keeps working.
Google’s own terms decide what Google may do with what it receives. [owner to confirm: which Gemini terms apply, and what they allow]
Where your information is kept
Your records are kept in a database in London (Neon, in Amazon Web Services’ eu-west-2 region). Photos and documents are kept by Cloudflare R2, and we ask Cloudflare to store them in Western Europe. The website, and the server the phone app talks to, are hosted by Vercel, and our server runs in London.
Most of the services listed below handle information outside the UK, many of them in the United States. Where they do, it is protected by [owner to confirm: UK adequacy regulations, the International Data Transfer Agreement, or the UK Extension to the EU–US Data Privacy Framework, as applies to each service].
Who else handles it
These services handle information for us, to do the job listed. Some also use it for purposes of their own, under their own terms: Google, to provide and improve its products; Cloudflare, to improve its checks for automated sign-ups; and Stripe, to prevent fraud. [owner to confirm: a data processing agreement is in place with each]
Neon
- What for
- The database. Everything you record in SEN Patterns is kept here.
- What it receives
- Your account details, your children’s profiles, every log, note and school record, contacts, settings, your saved location, and the records of any subscription.
- Where
- London, United Kingdom (Amazon Web Services, eu-west-2)
Clerk
- What for
- Signing in, and the household you share with other carers.
- What it receives
- Your email address, name, username and password, how you sign in (email, Google or Apple), which household you belong to, and the email addresses of anyone you invite to it.
- Where
- The United States, where Clerk keeps its data with Google Cloud and Cloudflare; it offers no other location
Cloudflare R2
- What for
- Storing the photos and documents you add.
- What it receives
- Photos of your child, of you and of meals, and the behaviour plan documents you upload. A photo opens for anyone who has its web address, which is very hard to guess. A document opens only through SEN Patterns, for someone signed in to your household.
- When
- Only when you add a photo or a document.
- Where
- Western Europe — where we asked Cloudflare to keep them, which is a request rather than a legal guarantee
Trigger.dev
- What for
- Running scheduled jobs: summary emails, the morning AI summary, reminders, and refreshing the services near you.
- What it receives
- Whatever each job reads from the database while it runs — the child names and logs a summary or reminder is built from, and your saved location for nearby services.
- Where
- The United States (Amazon Web Services, Virginia), where Trigger.dev stores every job’s data, wherever the job itself runs
Google Gemini
- What for
- The AI features: a short note after you save an entry, a summary of the week, turning a voice recording into entries, and reading the foods in a meal photo.
- What it receives
- Your child’s first name, with their diagnosis (for the note and the weekly summary) or their usual bedtime and wake-up time (for voice logging), and the entry, week of logs, recording or transcript, or photo the feature is working on.
- When
- Only while AI features are on in Settings. Voice logging and meal photos also only run when you press their button.
- Where
- Any country where Google or its agents have facilities, as Google’s Gemini API terms say
Google Maps Platform
- What for
- Finding services near you, and their details.
- What it receives
- The postcode or place you search for, and the map position of the area being searched.
- When
- When you set a location or use nearby support.
- Where
- Google’s servers around the world; Google does not name a location for Maps
postcodes.io
- What for
- Turning a postcode into a map position, and a map position into a postcode.
- What it receives
- A postcode you type, or your device’s position when you choose to use it.
- When
- When you set a location or search for one.
- Where
- Not published. postcodes.io is run by Ideal Postcodes, in London, and requests reach it through Cloudflare’s network.
OpenStreetMap (a public Overpass server)
- What for
- Finding services near you that Google does not list.
- What it receives
- The map position of the area being searched.
- When
- When the services near you are refreshed.
- Where
- Austria, where the volunteer-run server this search uses is hosted
OpenWeather
- What for
- Showing the weather where you are on the daily overview.
- What it receives
- The rough map position of the area you saved for nearby support, to within about a kilometre. It is sent from our server, so OpenWeather does not see your IP address.
- When
- Only when you have saved an area, and while “Weather on the banner” is on in Settings.
- Where
- Germany: OpenWeather, a company in London, answers from servers in Germany and says it keeps neither the positions it is asked about nor the addresses asking
jsDelivr
- What for
- Serving the emoji pictures the website shows.
- What it receives
- Your IP address and which emoji picture is being shown, as with any picture a browser loads. Your browser asks for them directly.
- When
- On the website, on pages that show an emoji picture.
- Where
- A worldwide network: jsDelivr, a UK company, delivers through Cloudflare, Fastly and others, which serve UK visitors from London
Resend
- What for
- Sending email.
- What it receives
- Your email address and each email’s contents: a welcome email when you finish setting up, and weekly or monthly summaries if you switch them on, which include your child’s name and what was logged.
- Where
- The United States, where Resend stores every email and its records, whichever server sends it
Stripe
- What for
- Taking payment for Family when you subscribe on the website.
- What it receives
- Your email address, an SEN Patterns account number, and the payment details you enter. Stripe holds your card details; SEN Patterns never sees them.
- When
- Only if you subscribe on the website.
- Where
- The United States and other countries: UK businesses contract with Stripe Payments Europe, and the data goes to Stripe, LLC in the United States
RevenueCat
- What for
- Keeping track of subscriptions bought in the App Store or Google Play.
- What it receives
- Your SEN Patterns account id and the purchase records Apple or Google send about your subscription.
- When
- Only if you open Plans, subscribe or restore a purchase on a phone.
- Where
- The United States (Amazon Web Services), where RevenueCat stores all customer data
Apple (App Store, Sign in with Apple) and Google (Google Play, Continue with Google)
- What for
- Taking payment for Family when you subscribe on a phone, and signing you in with Apple or Google if you choose to.
- What it receives
- The payment, under their own terms. Apple and Google tell SEN Patterns whether a subscription is active, not your payment details. If you sign in with Apple or Google, they confirm who you are and know that you signed in to SEN Patterns: Apple sends your name and your email address or a private address that forwards to it, and Google sends your name, email address and profile picture. When you delete your account, a one-time code from Apple is sent back to Apple so that SEN Patterns no longer has access through your Apple ID.
- When
- Only if you subscribe on a phone, or sign in with Apple or Google.
- Where
- Under Apple’s and Google’s own terms
Expo, with Apple Push Notification service and Firebase Cloud Messaging
- What for
- Delivering notifications to your phone.
- What it receives
- A code that identifies your phone for notifications, and each notification’s text. Notifications never name your child or say anything about them.
- When
- Only if you turn notifications on.
- Where
- The United States, where Expo keeps the code for your phone and handles each message before deleting it; Apple’s and Google’s push networks work worldwide
PostHog
- What for
- Understanding which parts of the website are used, and catching errors.
- What it receives
- The pages you open, where you click (without the words on screen), and any errors you meet. Also which kinds of entry you save — for example, that a meltdown, a behaviour, a meal or a night’s sleep was logged, whether it was breakfast or a nap, and how many items it had. All of it is linked to an identifier for your account. Never what you wrote, or which triggers, foods or behaviours you chose.
- When
- Only on the website, only if you say yes when asked, and never on Meltdown support. You can change your answer in Settings. The phone app does not use it.
- Where
- Frankfurt, Germany (PostHog’s EU cloud); its contract allows some processing elsewhere, including the United States
Vercel
- What for
- Hosting the website and the server the phone app talks to.
- What it receives
- Every request passes through it: your IP address, the page or action requested, and what is sent and received.
- Where
- London, United Kingdom, where our server runs; Vercel’s own records, including its request logs, are kept mainly in the United States
Your web browser’s speech recognition
- What for
- Turning your voice into text for voice logging on the website.
- What it receives
- What you say while recording. Your browser’s maker handles it — in Chrome, that is Google. The phone app does not use this; it sends the recording to Google Gemini instead.
- When
- Only when you record a voice log on the website.
- Where
- Decided by your browser
Read-aloud voices
- What for
- Reading words aloud: the communication cards on Meltdown support, and sections of the website when you use read aloud.
- What it receives
- The words being read. SEN Patterns uses a voice on your device where your browser has one. A voice marked “online” in Settings, or the only voice a browser has, sends the words to the company that makes it — Google in Chrome, Microsoft in Edge. On a phone, the phone’s own speech engine reads them: on an iPhone that happens on the phone, and on Android it depends on the speech engine, which can use Google’s online voices.
- When
- Only while something is being read aloud.
- Where
- Decided by your browser or phone
Cloudflare Turnstile
- What for
- Checking that a new account on the website is being made by a person rather than an automated program. Our sign-in provider, Clerk, runs it.
- What it receives
- Your IP address and details about your browser and device, which Cloudflare uses for the check. Your browser talks to Cloudflare directly.
- When
- When you create an account on the website. The phone app does not use it.
- Where
- The United States and the European Economic Area, where Cloudflare mainly keeps information, though its network works worldwide
Microsoft 365, through GoDaddy
- What for
- Our email: receiving and answering what you send us, including requests about your information or your account.
- What it receives
- Your email address, what you write, any attachments, and our replies.
- When
- Only if you email us.
- Where
- The United Kingdom, where Microsoft stores a UK customer’s mailboxes
What we never do
- Sell your information, or let anyone use it for advertising.
- Show adverts.
- Share it with your child’s school, your local authority or any health service. Only you can do that, by printing or exporting it yourself.
We share information only when the law requires it, such as a court order, and only what is required. Where the law allows, we tell you first.
How long we keep it
- Until you delete it. You can delete a single entry, a child’s whole profile, or your account.
- Deleting your account removes your records, your children’s profiles, the photos and documents you uploaded, and your sign-in. It also cancels a subscription bought on the website. A subscription bought on a phone has to be cancelled in the App Store or Google Play. The delete your account page says exactly what goes and what stays.
- Deleted information can remain in the database’s change history for up to seven days, after which it is gone.
- The record of access is kept for a year and then deleted. It goes with your account if you delete it.
- Stripe, Apple and Google keep their own records of payments, as the law requires them to.
- Emails already sent stay in your inbox, and files you exported stay wherever you saved them.
- The services listed above keep their own records, for their own periods:
- Vercel, its logs of requests to our server: up to a day, though its terms let it keep its own records of traffic for longer.
- Trigger.dev, the logs of each scheduled job: a day after the job runs. It keeps a record of each job — when it ran, whether it worked and how many it dealt with — for a period it does not publish.
- Resend, each email we send and its delivery record: 30 days.
- PostHog, if you said yes to analytics, what it counted: at least a year.
- OpenWeather, nothing about your request: it says it keeps neither the rough position of your area nor the address asking.
- The others do not publish how long they keep their logs.
Your rights
- To see what we hold: Settings, then Backup and export, downloads all of it as a data file (JSON). In the phone app you can also download a document to read or print, which holds your notes, logs and school days but not everything in the data file.
- To correct it: any entry or detail can be edited in the app.
- To delete it: an entry, a child’s profile, or your whole account.
- To take it elsewhere: the data file (JSON) is in a form other services can read.
- To object to how we use it, or ask us to limit it: write to us.
- To withdraw consent: for AI features, switch them off in Settings; for website analytics, switch counting off in Settings, under “Privacy & data”.
You can write to us about any of these at privacy@senpatterns.com. We reply within one month.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner’s Office, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Phone and browser permissions
The phone app uses the camera or your photo library only when you choose to add a photo, and the microphone only while you record a voice log. It asks about notifications only when you turn them on, and it does not use your phone’s location. On the website, your browser asks before sharing your location, which is then used to set your area for nearby support.
Keeping it safe
- Everything sent between your device and SEN Patterns is encrypted.
- Each account can reach only its own household’s records, and this is checked on the server for every request.
- What you write about your child, such as notes, diagnosis notes, medicines and voice transcripts, is also encrypted in the database, with a key kept apart from it.
- Our staff can look up an account’s plan and status to help with support, never your child’s records. Each look-up is recorded, and shows in your data export.
- Documents you upload are kept in private storage, and open only through SEN Patterns for someone signed in to your household.
- Photos are kept at web addresses that are very hard to guess. Anyone who has a photo’s address can open it without signing in.
People featured in Brains Like Mine
Brains Like Mine shows a different person or story character each day. The real people on it are public figures who have said in public, in their own words, that they are autistic or have ADHD. We show only what they have said, with a link to where they said it, and we keep nothing else about them. People from history are never described as having a diagnosis.
Their photos are used under free licences, and each one is credited beside it. None of the people or characters featured is connected with SEN Patterns, and none has endorsed it.
If you are featured and want something changed or removed, email privacy@senpatterns.com.
Changes to this notice
If we change this notice in a way that affects you, we will say so in the app before the change takes effect.
Contact
Write to us about this notice or your information at privacy@senpatterns.com. For help with the app itself, see support.