Data Protection explained clearly

Baobab is built for schools handling sensitive SEND information. We keep data secure, limit who can access it, and give your Data Protection Officer the documents they need.

UK/EU Hosted. GDPR compliant.

Handling sensitive data

What schools usually
want to know

When you are recording EHCP details, SEND provision and pupil progress, data protection matters. Baobab is designed to help schools manage that information responsibly, with secure systems, clear controls and straightforward documentation for DPO review.

1. Your school stays in control
Your school is the data controller. Baobab is the data processor. We only handle personal data on your school’s instructions and for the purposes of delivering the service.

2. Sensitive pupil data is handled carefully
Baobab supports SEND record-keeping, including EHCP information, provision tracking, progress updates and supporting documents. That can include special category data, so the controls around access, storage and processing matter.

3. Data is stored in the UK and EEA
Identifiable pupil data is stored and processed within the UK and EEA. If a limited transfer outside those locations is ever needed, appropriate safeguards are used.

4. Access is tightly controlled
Baobab uses encryption at rest and in transit, mandatory two-factor authentication, school-scoped access controls, and audit logging.

How AI is handled

Where AI features are used, pupil-identifying information is removed before data is sent for processing. Names are replaced with labels such as Child A, and details like dates of birth and UPNs are stripped out. AI providers do not receive identifying pupil data, do not retain inputs, and do not train on your school’s data.

Need to know more?

Our DPO pack contains:

• A Data Processing Agreement under Article 28 UK GDPR
• A statement of data storage locations
• A summary of security standards
• A sub-processor register

You can download the DPO Pack here.

]Any questions, please just reach out to us at [email protected]

FAQs

Frequently Asked Questions

Q: Is this compliant with UK data protection requirements?

Yes.

Baobab is UK/EU hosted and GDPR compliant. School data remains secure and is never used to train external AI models.

Before any EHCP or other document is sent for AI processing, all identifable child data is stripped, and an anonymised EHCP is sent across. The student data is then added back by Baobab.

Q: How does this support the SEND Whitepaper 2026?

We are keeping a very close eye on the changes suggested in the latest SEND Whitepaper 2026, and will ensure BAOBAB meets the criteria.

At present, children without an EHCP can still be added to Baobab, you just add them manually. Once we have clarity on the ISP structures, children with ISPs will also be able to be added and supported, automatically.

So in short, yes! You'll be fine.

Q: How does the EHCP/ SEND Document upload work?

You upload the child’s EHCP (or any other SEND document) as a PDF. Baobab strips the identifable student data, and sends the rest for parsing, automatically extracting:

- Section B needs

- Section F provision

- Section E outcomes

- Review dates

- Anything else from the document

The student data is then added back into the mix and everything is structured into a live profile that can be tracked and updated termly. All in a matter of moments!

(PS. You can edit anything at any time!)

Q: What if our EHCPs are complex or inconsistently written?

Baobab is designed around real UK EHCP structure and language. In fact, it was built based on our founder's son's very complex (and frankly, rather messy!) EHCP (thanks Kent County Council).

Extracted sections can always be edited, refined or adjusted to reflect your professional understanding, however in most cases, you won't need to do this.

Q: Does Baobab write EHCPs or change statutory wording?

No.

Baobab does not replace professional judgement or statutory responsibility. It structures and connects what already exists, helping you track delivery and progress clearly.

All suggested updates or review summaries remain fully editable before use.

Q: Is Baobab more work to maintain?

No.

Baobab is designed to sit inside the work you already do. When you upload an EHCP, it structures Section F provision, Section E outcomes and review dates automatically. As you add updates, evidence builds in the background.

There is no separate reporting process to maintain.

Q: Will this replace my existing provision mapping tools?

Baobab is not just a provision map.

It connects provision, outcomes, updates and review reporting into one continuous structure.

Baobab can be used alongside existing systems - but for EHCP delivery, it becomes the central layer.

Q: What happens after the 30 day trial?

You can explore the full system during the trial, including sample data to see how reports and reviews look over time.

No commitment. No data lock-in.

Q: How much does Baobab cost?

£395 per school, for the year - regardless of how many learners or staff you have.

Q: Why the name Baobab?

The Baobab tree is a marvel.

It grows in hot, dry, arrid lands. Though everything is seemingly working against it, the Baobab thrives. It succeeds despite its environment, not because of it.

We couldn't think of a more suited name for our app.