This page explains your rights under the General Data Protection Regulation (GDPR) and equivalent data protection laws, and how to exercise those rights when your personal data is processed by or through Scolah, Inc.’s services.
This page supplements our Privacy Policy. We recommend reading both pages together — the Privacy Policy contains full details of what data we collect and why.
1. Who This Applies To
GDPR applies to individuals located in the European Union (EU), European Economic Area (EEA), or the United Kingdom (UK) whose personal data is processed by an organisation — regardless of where that organisation is based.
Even if GDPR does not technically apply to your location, we extend these rights as best practice to all users of our services where technically and legally feasible.
2. Who Controls Your Data
Understanding who is responsible for your data determines who you should contact with a rights request.
Scolah, Inc. as Data Controller
Scolah, Inc. is the data controller for:
- Accounts you create directly with Scolah (Parent App, Scolah Care)
- Authentication and identity data managed by the Scolah SSO service
- Usage analytics and server logs generated by your use of our services
As controller, we determine the purposes and means of processing your data and are responsible for honouring your GDPR rights directly.
Scolah, Inc. as Data Processor (Scolah Compass and Scolah Care)
For Compass, the NGO, government agency, or programme operator that deployed Compass is the data controller for:
- Beneficiary records (name, national ID, contact details, residential information, health data, etc.)
- Applicant records and submitted form data
- Case files, visit records, assessments, and disbursement history
- Uploaded documents (ID cards, medical records, etc.)
For Scolah Care, the care facility that deploys the platform is the data controller for:
- Resident profiles (name, date of birth, allergies, prescriptions, advance directives)
- Daily care logs (medication administration, activities, meals, mood, sleep)
- Wellbeing trends and health incident records
- Photos and weekly summaries shared with family members
- Family member access and relationship records
In both cases, Scolah, Inc. processes this data solely on the controller’s instruction and does not use it for any other purpose. We act as a data processor under Article 28 GDPR, bound by a Data Processing Agreement (DPA) with each operator.
If you are a programme beneficiary, care home resident, or a family member accessing resident data through Scolah Care, please direct data rights requests to the agency or care facility that holds your record. They are required by law to respond within the applicable statutory timeframe. We will assist them in fulfilling your request as required by our processor obligations.
3. Legal Bases for Processing
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract (Article 6(1)(b)) — necessary to deliver the services |
| Sending service notifications (email, SMS, push) | Contract (Article 6(1)(b)) — necessary to deliver service |
| Security monitoring, fraud prevention, audit logging | Legitimate interests (Article 6(1)(f)) — to protect service integrity and users |
| AI-powered features | Legitimate interests (Article 6(1)(f)) and, where applicable, consent |
| Firebase Analytics (mobile app telemetry) | Consent (Article 6(1)(a)) via device-level permissions |
| Payment and subscription processing | Contract (Article 6(1)(b)) |
| Compliance with legal obligations | Legal obligation (Article 6(1)(c)) |
Special Category Data (Article 9)
Both Compass and Scolah Care may process data that falls under Article 9 GDPR “special categories”:
- Compass may process health information (via intervention records), national identification data, and data about minors enrolled as beneficiaries
- Scolah Care processes health data by design — medication records, allergies, advance directives, mobility and wellbeing logs for elderly residents
In both cases, this data is processed by the deploying agency or care facility as data controller. The legal bases applicable to special category data (such as Article 9(2)(h) for health or social care purposes, or Article 9(2)(g) for social protection purposes) must be established by the operator, not by Scolah, Inc.
4. Your Rights Under GDPR
Right of Access (Article 15)
You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data along with information about how it is used.
To submit an access request, email privacy@scolah.com with the subject line “Data Access Request.” We will respond within 30 days.
Right to Rectification (Article 16)
If your personal data is inaccurate or incomplete, you have the right to have it corrected. Most account data can be updated directly in your profile settings. For data you cannot update yourself, email privacy@scolah.com.
Right to Erasure — “Right to be Forgotten” (Article 17)
You have the right to request deletion of your personal data where:
- The data is no longer necessary for the purpose it was collected
- You withdraw consent (where consent is the legal basis)
- You object to processing and we have no overriding legitimate grounds
- The data has been unlawfully processed
- Deletion is required to comply with a legal obligation
How deletion works in Scolah:
- You initiate account deletion from within the app settings or by emailing privacy@scolah.com
- A 30-day grace period begins during which you may cancel the deletion and restore your account
- After 30 days, your account undergoes full anonymisation: all identifying fields (name, email, phone number, address) are replaced with opaque anonymous identifiers
- You will not be able to log in after anonymisation is complete
- Anonymised records may be retained in non-identifiable form for statistical and audit purposes
Note that we may retain certain data where required by law (such as financial transaction records) even after an erasure request.
Right to Restrict Processing (Article 18)
You have the right to ask us to pause processing of your data where:
- You contest the accuracy of the data (while we verify it)
- The processing is unlawful and you prefer restriction to deletion
- We no longer need the data but you require it for legal claims
- You have objected to processing (pending verification of our legitimate grounds)
Email privacy@scolah.com to submit a restriction request.
Right to Data Portability (Article 20)
Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV), and to transmit it to another provider.
To request a data export, email privacy@scolah.com with the subject line “Data Portability Request.”
Right to Object (Article 21)
You have the right to object to processing based on legitimate interests (Article 6(1)(f)). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.
Rights Related to Automated Decision-Making (Article 22)
We use AI-assisted features (such as risk scoring in Compass) to support decision-making. These outputs are advisory only — a qualified caseworker or supervisor must review and approve any eligibility or disbursement decision. We do not make solely automated decisions that produce legal or similarly significant effects without human review.
If you believe an automated output was applied to a decision affecting you without human oversight, you have the right to request human review. Contact privacy@scolah.com.
5. Data Transfers Outside the EEA
Our services are hosted on cloud infrastructure which may involve processing in countries outside the EEA, including the United States. Where such transfers occur, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Our AI features are powered by our own self-hosted model and do not involve transmitting data to a third-party AI provider.
For a full list of sub-processors and applicable transfer safeguards, email legal@scolah.com.
6. Data Retention
For full retention periods, see the Privacy Policy — §6 Data Retention. In summary:
- Active account data: held while your account is active
- Uploaded media: 90 days
- Logs: 30 days
- Accounts: anonymised after a 30-day grace period following a deletion request
7. How to Exercise Your Rights
Email privacy@scolah.com with:
- Your full name and the email address associated with your account
- The right you wish to exercise
- Any additional context to help us locate your records
We will acknowledge your request within 72 hours and provide a substantive response within 30 days. If your request is complex, we may extend this by a further two months and will notify you if so.
We will not charge a fee for reasonable requests. If a request is manifestly unfounded or excessive, we may charge a reasonable administrative fee or decline and will explain our reasons.
8. Right to Lodge a Complaint
If you are not satisfied with how we have handled a data rights request, or believe we have processed your data in breach of applicable law, you have the right to lodge a complaint with a supervisory authority.
In the EU, contact the data protection authority in your country of residence. A list of EU supervisory authorities is available at edpb.europa.eu.
In the UK, contact the Information Commissioner’s Office (ICO): ico.org.uk.
We would appreciate the opportunity to address your concerns before you approach a supervisory authority. Please contact privacy@scolah.com first.
9. Data Processing Agreement
Compass agencies requiring a DPA in accordance with Article 28 GDPR may request one by emailing legal@scolah.com. The DPA covers subject matter, data types, duration, processor obligations, sub-processor list, security measures, breach notification (72-hour notification to you as controller), and deletion procedures at contract end.
10. Contact
For GDPR enquiries, data rights requests, or to request a Data Processing Agreement:
- Privacy & data rights: privacy@scolah.com
- Legal & DPA requests: legal@scolah.com