Scope and why this note exists
The Children’s Code, formally the Age Appropriate Design Code, is a statutory code of practice setting fifteen standards for online services likely to be accessed by children. The code does not apply to schools processing student data for education. It can, however, apply to an education technology provider whose service is used in or by a school, where that service meets the definition of an information society service. Halved treats the code as applying to its platform and aspires to all fifteen standards as good practice. This note records, proportionately to pilot scale, how Halved meets each standard. It is not a substitute for the school’s own duties as controller, with which the best interests standard aligns.
The platform serves students in Year 6 to Year 13, aged ten to nineteen, provisioned and accessed through the school. Most are children. Some students in Year 13 are eighteen or nineteen and so are adults, and standard 3 says what applies to them and to the youngest students.
The fifteen standards
| # | Standard | Halved position |
|---|---|---|
| 1 | Best interests of the child | The primary design principle. The platform provides learning support, guides students towards answers rather than giving them, and never replaces teachers. A safeguarding pipeline screens for risk and escalates to school staff. Its detection is not the same in every language, and this note says so rather than leaving the sentence before it to imply otherwise. The fixed list of terms that carries the abuse, neglect and exploitation categories is English, so a child disclosing those things in another language is not detected and no alert is raised; the content classifier behind that list does work in other languages for self-harm, suicide, sexual content and violence, and a concern it finds there does reach the school. The response that stops the reply and puts support information in front of the child runs at the highest severity only, which in measurement was reached through the English term list, in every language including English. Halved is lowering that threshold and adding terms in other languages, and neither is in place at this version. Section 5 of the Data Flow and Data Handling Summary sets this out in full. |
| 2 | Data protection impact assessments | A DPIA is completed for each school deployment through the DPIA Support Pack, covering the processing, risks and mitigations. |
| 3 | Age appropriate application | Students are in Year 6 to Year 13, aged ten to nineteen, and are provisioned by the school, so age is established through the school rather than by self declaration. Halved holds a student’s year group and not their date of birth, and applies the code standards to every student whatever their year group. Under thirteen. The youngest students, in Year 6 to Year 8, are covered by every standard in this note. The lawful basis for the processing is the school’s public task rather than consent, so the age of thirteen in Article 8 of the UK GDPR, which governs a child’s own consent to an online service, does not apply to it, and a parent’s involvement runs through the school as standard 11 sets out. Eighteen and over. A student in Year 13 may be an adult. The code protects children and does not apply to an adult as such, but Halved cannot tell an adult student from a child and gives them the same protections. An adult student exercises their own data protection rights, through the school. A safeguarding concern an adult student raises is screened and escalated to the school’s designated safeguarding lead by the same route as a child’s, and what the school does next is a matter for its own arrangements for learners aged eighteen or over. |
| 4 | Transparency | Privacy information is provided in plain language through the Privacy Policy and the school’s AI Student Policy, written to be understood by the age group. |
| 5 | Detrimental use of data | Student data is used only to provide learning support. It is not used for advertising, nor in ways known to be detrimental to a child’s wellbeing. |
| 6 | Policies and community standards | Halved upholds its published governance pack and the school’s student policy, including behaviour and acceptable use rules. |
| 7 | Default settings | Privacy is high by default. The platform does not seek or require special category data, and processing is limited to what learning support requires. Where Halved asks a question at all, of a student or of a school, the question is fixed-choice and the available answers are set by Halved: students are asked how they prefer to learn, how they approach their work, what they are interested in and whether they find particular kinds of task difficult, and schools are asked for year group, reading age, whether the student is working at age expectation in English and in maths, and their judgements of how the student manages words in a task, instructions and longer pieces of reading, which a Halved operator enters from the school’s own records, including its support plans. A student’s answers about how they prefer to learn and how they approach their work are not shown to school staff, and the school’s answers are shown to its SENCO and school administrator rather than to class teachers. None of these questions asks about health, disability, SEND status, a diagnosis or any other special category of data, and none of them offers a free-text answer. Where a student includes sensitive information in free text or an upload, it is processed only on the school’s documented instructions. A profile photograph is optional and off by default: no photograph is set when an account is created, and the platform is fully usable without one. Only the account holder can set their own. A student’s photograph is shown to that student and to staff at that student’s own school, being the class teachers the student is linked to and the school-wide roles the platform admits: head teacher, SENCO, pastoral lead, designated safeguarding lead and school administrator. That is the audience which already sees the student’s name. It is not shown to staff at any other school and no Halved staff surface displays it. Halved holds a facial image where a child chooses to upload one, and treats it as personal data. It is not special category data: Halved performs no facial recognition and no biometric matching, and does not use a photograph to identify a child or to infer anything about them. The image is moderated before storage and the path fails closed, so an image that cannot be checked is refused rather than stored. |
| 8 | Data minimisation | The learning profile stores observed behaviour as coarse bands, not raw content. Files a student uploads are minimised, and the period they are kept for is set by a purpose rather than by a round number. A student deletes their own uploaded work and notes whenever they choose, using the in-product control, and anything not deleted is capped at 24 months. 24 months is the span of a two-year programme of study. A student revising in the summer of Year 11 may need work they made in the September of Year 10, at the start of the same GCSE course, and that is 22 months earlier; the cap carries a margin over the longest ordinary need rather than being picked for tidiness. The same holds for a two-year A-level course. Everything goes on contract end plus 90 days regardless. The Data Retention Policy records the same reasoning, so the two agree by argument rather than by coincidence. For all categories other than the one below, only data needed for the active element of the service is collected. Activity records are the exception to the coarse-band pattern, and are recorded here as an exception rather than presented as though they were not one. The three outputs (total active minutes, the proportion of those minutes spent with Halved’s support, and a distribution of when in the day a student works) do not each require second precision, so a record stored to the second is finer than the reporting need. Version 1.4 of this note left open whether a coarser record would serve the same three outputs, and recorded that it was not resolved in Halved’s favour. It is now resolved, against the finer record: interval start and end times are truncated to the minute, so that what is stored matches what is reported rather than exceeding it. The length of each interval is a separate matter and is deliberately not coarsened. It is computed before truncation and stored exactly, in seconds. Hourly totals were considered as the coarser alternative and were rejected. A child who works in twelve-minute blocks, which is a real pattern for some students with SEND, disappears into an hourly total and is legible in minute-level intervals; a coarsening that erased how that child actually works would be minimising against the wrong measure, since the purpose of the record is to show a student and their teachers the shape of their own working time. Rounding the lengths themselves would reintroduce a smaller version of that same loss, which is why the truncation is applied to the clock times and not to the durations. Minute precision is the coarsest record of when a student worked that serves the three outputs and still represents that pattern. The truncation is enforced by the database as a constraint on each stored timestamp, rather than by the code that writes it, so it holds against a later endpoint or a direct insert rather than depending on every future writer to apply it. Halved’s minimisation position for this category rests on granularity, scope and retention together: clock times held to the minute and enforced there; interval lengths exact; a record holding a start time, an end time, which of six surfaces the student was on and an optional session reference, and holding no content, no location and no device identifier; and a 12-month cap. |
| 9 | Data sharing | Children’s data is not disclosed beyond the school as controller and the named sub-processors in the Sub-processor Register. Children’s data is stored in the United Kingdom. AI inference for the chat function is performed in Microsoft Azure Sweden Central, in the European Union, and the Data Flow and Data Handling Summary sets out that exception and three qualifications. |
| 10 | Geolocation | The platform does not track or use student geolocation. |
| 11 | Parental controls | Access is mediated by the school. Parental engagement runs through the school as controller. The platform does not monitor children covertly, and this standard is met by what the student can see rather than by the absence of any record of use. Everything Halved records about a student is set out in the Privacy Policy and the Data Flow and Data Handling Summary. The category this standard turns on is the activity record: when a student was working, on which surface, and for how long, including evenings and weekends, since Halved does not restrict when a student may use the platform. The student dashboard shows a student their own activity record, including a version of the when-in-the-day view, so that a child can see the same picture of their working time that their teachers see. The sequence is what makes this standard hold, so Halved recorded it in advance as a binding commitment rather than an intention: the timer that creates activity records ships with the student view, not before it. That commitment was met. The timer, the child’s own view and the teacher view were released as a single change, so there is no build in which a child’s working time is recorded while the child has no way to see it, and the release record evidences the sequence rather than Halved asserting it. Sign-in records, added for pilot reporting on 30 September 2026, are the exception to what the student can see, and are recorded here as one rather than presented as though they were not. Each holds a date and the number of times the student signed in that day, with no time of day, device or location, is shown to Halved’s own operators only, and is kept for 12 months at most. A student cannot see these records, and the student notice does not yet say they are kept: one sentence telling a child is held for review in the student-notice batch. The record is switched on in an environment by a deliberate setting after the Privacy Policy and the Data Flow and Data Handling Summary describe it, so it can be on in an environment schools use before that sentence reaches the student notice, and until then a child there is not told. Staff activity records are about staff and do not bear on this standard. |
| 12 | Profiling | The learning profile and the communication register are profiling solely for learning support, in the child’s best interests. The communication register is a coarse language-pitch value (1 to 7) that adjusts the vocabulary and sentence complexity Halved uses; it is a setting for how Halved talks to a child. It is derived from the child’s year group, from the reading age and the answer about words in a task that the school supplies, and from how the child responds during use. It is not itself a record of ability, attainment or reading age, and it is not a diagnosis or special-category label. The learning profile is likewise built from observed learning behaviour together with the child’s own fixed-choice answers about how they prefer to learn and the measures the school supplies; the child’s answers to those questions are not shown to teachers. Attainment is recorded separately, as set out in the rest of this row. Band and register numbers are never shown to students. Attainment is recorded as a factual record of performance on work (teacher marks, code-judged answer correctness, and time spent in productive difficulty). It is shown to the student and their teachers as progress over time. It is not used to rank or compare students, is not used for any automated decision about a child, and is not used to infer ability, developmental stage, or any special-category characteristic. Activity records (when a student was working, on which surface, and for how long) are a factual record of use rather than an inference about the student, but Halved treats the reporting of a student’s working time and time-of-day pattern as profiling for this standard and applies the same limits: not used to rank or compare students, not used for any automated decision about a child, and not used to infer ability, developmental stage or any special-category characteristic. Profiling is not used for advertising, and outputs are designed not to feed content detrimental to wellbeing. |
| 13 | Nudge techniques | The platform does not use nudge techniques to draw out unnecessary personal data or to weaken privacy. Mediated questioning supports learning, it does not extract data. |
| 14 | Connected toys and devices | Not applicable. Halved is not a connected toy or internet of things device. |
| 15 | Online tools | Data subject rights, including access and erasure, are supported through the school as controller and at dataprivacy@halved.io, with erasure actioned without undue delay and within one month. |
Review
This note is proportionate to pilot scale and will be reviewed as the service and its user base grow, and against any updated regulator guidance on the code as it applies to education technology.