Privacy Notice
This notice explains how Neurodiversity Debugged and the SEND Rights Helper handle your data. It is written in plain English because that is what a privacy notice should be.
Last updated: March 2026
Who is responsible for your data
Nic Whippey — an individual, not an organisation. Neurodiversity Debugged (neurodiversity-debugged.co.uk) is a personal project built to help families navigating the SEND system in England.
Contact: empowertech.send@gmail.com
Your conversation is not stored by us
Your conversation with the SEND Rights Helper happens on Poe (by Quora). We do not have access to your conversation unless you explicitly choose to share data with us through the feedback or lived experience process described below.
Poe has its own privacy policy. Please read it at poe.com/privacy.
Data we may collect (only with your consent)
At the end of your conversation, the AI may offer to collect two types of data. Both are entirely optional. You can say no to either or both. Your help from the tool is never conditional on sharing data.
1. Feedback data
What: Anonymised observations about what worked, what was confusing, and what was missing in the tool. This is compiled by the AI from your conversation — you are shown exactly what will be submitted and can edit or remove anything before it goes anywhere.
Why: To improve the tool for future families.
What is stored: A unique reference code, your region (local authority area — not your address), your situation type (e.g. “child out of school”), and the feedback summary.
What is NOT stored: Your name, email address, specific dates, school names, or anything that could identify you or your child.
Can I withdraw it? Feedback data has no email attached — it is truly anonymous. Once submitted, it cannot be linked back to you, so it cannot be withdrawn. You see and approve everything before submission.
2. Lived experience data
What: An anonymised summary of your family’s journey through the SEND system — compiled from what you already shared in the conversation. No additional interview. You see exactly what will be submitted and can edit or remove anything.
Why: To build evidence about where the system fails families, for future service redesign and research. The specific future use may not yet be defined — if it is used, you will be asked for separate consent for each use.
What is stored: A unique reference code (UID), your region, situation type, and the anonymised journey summary.
Can I withdraw it? Yes — see below.
How your data is stored — the two-store model
If you provide lived experience data, we use a two-store model designed to protect you:
| Store | Contains |
|---|---|
| Experience store | Your unique reference code (UID) + anonymised journey data. No email. No name. |
| Contact store | Your unique reference code (UID) + your email address. Nothing else. |
These two stores are physically separate. If either is compromised, the data in it is meaningless without the other. Experience data has no email. Contact data has no experience.
Data is stored in Supabase, which provides encryption at rest and is hosted on infrastructure within the EU/UK.
Only Nic Whippey has access to the data. It is not shared with anyone unless you give specific, separate consent.
Lawful basis
Consent (Article 6(1)(a), UK GDPR). You actively choose to share data. You can withdraw that consent at any time.
How to withdraw your data
When your data is submitted, you receive a unique reference code (UID). To withdraw your data:
- Email empowertech.send@gmail.com with your UID
- We look up your UID, delete your record from the experience store, delete your record from the contact store
- We confirm the deletion to you by email
Withdrawal is as easy as giving consent. Your data is fully deleted, not just hidden.
If you have lost your UID but can provide the email address you submitted, we can look it up in the contact store and delete from there.
How long we keep your data
Feedback data: Retained indefinitely (it is anonymous and cannot be linked to you).
Lived experience data: Retained until you withdraw it, or until this project ends — whichever comes first. If the project ends, all data in both stores will be deleted and you will be notified at the email address in the contact store.
Contact data: Retained only as long as the corresponding lived experience data exists. Deleted when you withdraw, or when the project ends.
Your rights under UK GDPR
You have the right to:
- Access — ask what data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data (see withdrawal process above)
- Withdraw consent — at any time, without affecting the help you received
- Complain — to the Information Commissioner’s Office if you believe your data has been mishandled
Children’s data
We do not collect data directly from children. All data is provided by parents or carers. The anonymisation process removes all information that could identify a child — names, school names, specific dates, and any identifying combinations.
Changes to this notice
If this privacy notice changes, the updated version will be published here with the date. If you have data stored with us and the changes are significant, we will notify you at the email address in the contact store.
Contact
For any questions about your data or this privacy notice: