Data Handling & Security

Roles and Responsibilities

For the purposes of this agreement, and in accordance with UK data protection legislation:

• You (the participating organisation) are the Data Controller.
• Imosphere acts as the Data Processor on your behalf.

Imosphere processes this data solely for the provision and improvement of the AI functionality within Formulate for SEND, under your instruction and with appropriate safeguards in place.

All data processing activities are conducted in compliance with:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018 (DPA 2018)

Security Measures and Hosting

Imosphere implements a range of technical and organisational measures to protect personal data, including:

• Encryption in transit via HTTPS with SHA-256 and RSA encryption
• Secure UK-only hosting using Microsoft Azure UK data centres and managed UK based hosting.
• No processing or storage outside the UK

AI processing is conducted in-memory and discarded immediately after use. No personal data is retained or shared with third parties, including Microsoft or OpenAI.

Further technical details are outlined in AI Functionality and System Design.

Data Storage, Retention & Fingerprinting

We retain only the minimum data required to enable functionality and maintain quality during the assessment process.

When starting a new assessment:

• The uploaded EHCP is encrypted and stored temporarily for use in generating the assessment.
• An anonymised fingerprint (cryptographic SHA-256 hash) is generated to verify future document re-uploads.
• Once the assessment is complete, the EHCP and any associated personal data are securely deleted. Only the fingerprint is retained.
• We also retain small snippets of anonymised output that have been generated by the AI for quality assurance purposes.

When requesting a Funding Justification Report:

• The EHCP is re-uploaded and verified against its fingerprint.
• Supporting documents may also be uploaded and are processed solely for the generation of the report.
• All files and AI-generated content are deleted once the report is generated and delivered to the user.

At no point is any personal data retained beyond the duration of the active session or case unless otherwise required by law or agreement.