Product Privacy Policy

‍Effective Date: June 30, 2026
‍Version: 2.0

Trellis ("we", "us", or "our") is an AI scribe for Special Education Needs admin. 

We are fully committed to protecting the privacy of educators, students, and their families through a strict framework of Data Protection by Design and by Default.

Data Protection Roles: Processor vs. Controller

Under the UK General Data Protection Regulation (UK GDPR), Trellis operates as a Data Processor. The respective Local Authority, School Governing body, or Academy Trust utilising our tool acts as the Data Controller. The Data Controller maintains ultimate decision-making authority over the data and is responsible for establishing the lawful basis for all processing activities.

1. Information We Process

To deliver our services, Trellis processes the following categories of information entered or uploaded by authorised educational professionals:

• Meeting Audio Data: Audio recordings of planning meetings or educational support reviews, captured directly via the Trellis application.
• Supporting Documentation: Written context including pastoral notes, pupil or student statements detailing the views of the learner, parent, or carer uploaded to assist document generation.
• Child Information: Child’s name and school details.
• Special Category Data: Because the audio and documentation natively describe student support accommodations, learning adjustments, emotional needs, and health-related notes, the processing may involve Special Category Data under Article 9 of the UK GDPR (specifically health and disability data).
• System Audit Logs: Pseudonymous user IDs, timestamps, and event logs used to track user login activity and administrative changes for security compliance and auditing.
  

2. Artificial Intelligence and Processing Philosophy

Trellis leverages artificial intelligence models to transcribe meeting dialogue and convert unstructured educational notes into structured drafts. Our deployment adheres to the following core safeguards:

• Human-in-Command Framework: Trellis functions under a Human-in-Command architecture. The AI acts as a supportive drafting assistant and never makes autonomous decisions or recommendations. Generated drafts must be manually reviewed, edited, and validated by a qualified professional before being finalised or migrated to a school's local filesystem.
• Zero Model Training: We maintain data isolation. No pupil data, audio files, uploaded documents, or written summaries are ever used to train our underlying AI models or those of our infrastructure partners.
  

3. Data Residency, Subprocessors, and Transfers
Data Residency

• Storage at Rest: All personal data, files, and metadata are hosted and stored at rest exclusively within the United Kingdom inside the Microsoft Azure UK South (London) region.
• Transient Processing: Document generation occurs within the UK. Audio transcription tasks are routed transiently to a deployment of the Whisper model based within the European Union (EU). Whisper processes the audio streams to generate text and does not retain or store any data locally after processing.
• Disaster Recovery & Failover: In exceptional cases of catastrophic regional data failure, service continuity is safeguarded via encrypted routing through Azure's North Europe (Dublin) or West Europe (Amsterdam) regions. All data remains within European Economic Area (EEA).
  

Authorised Subprocessors

Data is processed only by infrastructure partners bound under Data Processing Agreements (DPAs):

• Microsoft Ireland Operations, Ltd / Microsoft Inc.: Provides the underlying cloud infrastructure, database hosting, Azure OpenAI models, and Whisper transcription APIs. Microsoft is contractually prohibited from reusing or viewing our data for its own corporate purposes.
• Google Cloud EMEA Limited: Utilised for administrative business communications via Google Workspace.

4. Data Retention and Deletion

Trellis enforces data minimisation principles by ensuring sensitive files are not stored on our systems indefinitely.

• Default Retention Window: By default, all personal data, meeting audio recordings, and generated text drafts are preserved within Trellis for 60 days.
• Data Controller Configuration: Depending on the explicit instructions and policies established in the contract with your Local Authority, school or trust, this window can be customised.
• Automated Purging: Upon reaching the retention deadline, automated Azure lifecycle policies permanently delete and purge the files from our servers, leaving the data entirely unrecoverable. No personal data is extracted or retained in internal metrics or reports.
  

5. Technical Security and Safeguards

We implement multi-layered technical and organisational controls to protect sensitive educational data:

• Data Encryption: All personal data is encrypted at rest using industry-standard AES-256 keys and encrypted while moving across networks using secure TLS/SSL protocols.
• Perimeter Security: System access is restricted via IP address allowlisting, preventing logins from unauthorised or non-council/non-school network environments. Administrative access requires Multi-Factor Authentication (MFA) and is isolated through Azure Bastion.
• Compliance Standards: Trellis maintains an active focus on information security management aligned with ISO/IEC 27001. Our cloud subprocessors maintain their own compliance certifications, including ISO 27001, 27017, and SOC 2.
• Penetration Testing: We undergo continuous automated vulnerability monitoring and regular independent penetration testing executed by external cybersecurity specialists, NCC.
  

6. Data Subject Rights and Control

Children receiving additional support or special educational provision, along with their parents or guardians, hold statutory rights under the UK GDPR. However, because educational bodies generally process this data under the lawful basis of performing a Public Task in the exercise of their official authority, certain statutory rights are restricted by law.

• Available Rights: Individuals maintain the absolute right to be informed about how their data is used, the right of access (to request a copy of their data via a Data Subject Access Request), and the right to rectification (to correct factual inaccuracies in meeting minutes or logs).
• Exemptions (Erasure and Portability): Under Article 17(3)(b) and Article 20 of the UK GDPR, the right to erasure (deletion) and the right to data portability do not apply to processing carried out for a Public Task. This means Local Authorities, schools, and Academy Trusts are generally required to preserve these documents and are not legally obligated to delete them upon request.
• Right to Object: Individuals have the right to object to their data being processed. However, the Data Controller may refuse this objection if they can demonstrate compelling, overriding legitimate grounds to continue processing for the child's educational or safeguarding welfare.
• Exercising Rights via the Controller: Because Trellis acts purely as a Data Processor, we do not independently manage or directly respond to individual rights requests. Individuals wishing to exercise their rights must submit their requests directly to their respective Local Authority, school or trust (the Data Controller). 
• Our Support Role: Upon instruction from the Data Controller, Trellis will promptly assist them in executing any authorised data access, rectification, or restriction within our active retention window.
  

7. Contact Us

For any questions regarding this Privacy Policy, our data protection practices, or to coordinate controller compliance requests, please contact our designated escalation point:

• Contact Name: Angela Bradbury, COO
• Corporate Entity: Trellis Education Limited
• Email Address: angela@trellis.scot

Trellis Education Ltd, a company registered in England and Wales ("Trellis", "we", "us", or "our"), is committed to respecting your privacy and handling your personal data in an open and transparent manner. This Privacy Policy explains how we collect, use, share, and protect your personal information when you interact with us or use our services, including our website, products, and applications (collectively, the "Services").