At a glance
HomeCode helps families living in temporary accommodation keep their children learning. We send one short message a day over WhatsApp, and we provide a tablet with learning activities on it.
In plain terms:
- We collect very little: first names, your phone number, your child's age group, your preferred language, the housing area you live in, which tablet we have lent you, and whether you want your keyworker to be told if you stop using it. The full list is in section 3.
- The tablet does not send anything back to us. It works without internet. What your child does on it stays on it.
- We never sell your information, and we never advertise to you or your child.
- We check the messages you send us. We have to, because a message might tell us a child is in danger. If it does, the alert goes to a real person. They look at it as soon as they can, though not instantly. The check is automatic and can miss things, so in an emergency always call 999.
- You can stop at any time by replying STOP, and you can ask us to delete your information.
- If you are unhappy, you can complain to us or to the Information Commissioner's Office.
The rest of this notice explains all of that in full.
1. Who we are
Imara Systems Limited is the data controller for the information described in this notice. That means we decide why and how it is used, and we are responsible for looking after it.
| Company | Imara Systems Limited |
| Registered in | England and Wales, company number 16256656 |
| Address | 167 - 169 Great Portland Street, London, England, W1W 5PF |
| Data Protection Officer | Wale Oyepeju, wale@imarasystems.com |
| General privacy contact | legal@imarasystems.com |
2. What this notice covers
This notice applies to the HomeCode service: the WhatsApp messages, the website at homecodebyimara.com, the family and staff dashboards, and the learning tablet provided to your child.
It explains how we handle information about you (the parent or guardian), your child, and keyworkers who support families.
3. The information we collect
3.1 Information you give us when you join
| What | Why we need it |
|---|---|
| Your first name | So messages are personal rather than anonymous |
| Your child's first name | So activities can be addressed to them |
| Your child's age | To choose activities at the right level. We store an age group, not a date of birth |
| Your mobile phone number | It is how we message you. WhatsApp will not work without it |
| Your preferred language | So we can serve you properly as we add languages |
| The housing area you live in | To understand where the service is reaching and to work with the right local team |
| Whether you agree to your keyworker being told if you stop engaging, and if so their name and phone number | So your keyworker can check in. This is your choice and you can change it at any time |
We do not ask for, and you should not send us: your address, your date of birth, your National Insurance number, bank details, immigration status, or any document.
Information we receive about you from others. Your family is referred to HomeCode by a housing or family support service. They give us the contact details we need so that you can be invited to take part. You start the conversation with us yourself, and we do not send you daily messages until you have agreed to receive HomeCode messages on WhatsApp (see section 4).
3.2 Information created as you use the service
| What | Detail |
|---|---|
| Your messages to us | The words you send, kept for 30 days and then deleted, unless they relate to a safeguarding concern (see §5) |
| Our messages to you | Which activity was sent and when |
| Engagement records | Whether you replied, when, and how often. Used to see whether the service is working |
| Safeguarding records | If a message suggests a child or adult may be at risk, we record that a concern was raised, what triggered it, and what was done about it |
| Website and dashboard use | Basic technical records needed to keep the service secure and working |
| Tablet loan records | Which tablet is lent to your family (its serial number or asset tag), when it was lent, and when it is returned, lost or reported damaged. We keep this so we can get the tablet back and lend it to another family |
| Family dashboard | It shows only information we hold, such as which activities we sent you and whether you replied. It cannot show what your child did on the tablet, because that never leaves the tablet. |
| Complaints and requests | A record of any complaint or request you make about your information, and what we did about it |
3.3 Information on the tablet, which stays on the tablet
Your child's progress through the activities is stored on the tablet itself. It is not sent to us, it is not sent to anyone else, and the tablet does not need an internet connection to work.
The tablet is made by Samsung and runs Google's Android software. Those companies may process technical information through the device in the ordinary way any Android tablet does. That is outside our control and is covered by their own privacy notices. HomeCode itself sends nothing from the tablet. If your family connects the tablet to the internet, Samsung and Google may receive more technical information through it.
3.4 Information about keyworkers
If you are a keyworker, we hold your name, work email address, work phone number, your role, and a record of your access to family information, which we keep so that access can be audited. If a parent names you as their keyworker, we hold the name and phone number they gave us for you, and we will tell you this when we first contact you.
4. Why we use your information, and our lawful basis
Under data protection law we must have a lawful basis for everything we do with your information.
| What we do | Whose information | Lawful basis |
|---|---|---|
| Send you daily learning messages and reply to you | Parent, child first name | Consent — UK GDPR Article 6(1)(a). You give it by starting the conversation with us and answering a separate question that asks whether you agree to receive HomeCode messages on WhatsApp. This is separate from accepting our Terms of Service. You can withdraw it at any time |
| Record that you consented, and the wording you were shown | Parent | Legal obligation — Article 6(1)(c). We must be able to show consent was given |
| Tell your keyworker if you stop engaging | Parent, child first name | Consent — Article 6(1)(a). Only if you have agreed, and only to the keyworker you named |
| Act on a message that suggests someone is at risk | Parent, child, anyone named | Legitimate interests — Article 6(1)(f), and where urgent, vital interests — Article 6(1)(d). See §5 |
| Understand whether the service works, using engagement records | Parent, child | Legitimate interests — Article 6(1)(f). Our interest is in running a service that helps; we use the least information that answers the question |
| Keep the service secure, and keep audit records | All | Legitimate interests — Article 6(1)(f), and legal obligation for some records |
| Publish anonymised findings about whether the approach works | None, once anonymised | Legitimate interests — Article 6(1)(f). Once information is anonymised it is no longer personal data and this notice no longer applies to it. We do not publish figures for groups so small that a family could be recognised. |
| Lend you a tablet and get it back | Parent | Legitimate interests: Article 6(1)(f). We need to know which family has our equipment so we can get it back and lend it to others |
| Deal with a complaint or a request about your information | Parent | Legal obligation: Article 6(1)(c). The law requires us to deal with these |
| Receive your details from the person who referred you | Parent, child first name | Legitimate interests: Article 6(1)(f). We need your contact details so that you can be invited to take part |
Where we rely on legitimate interests, we have weighed our interest against your rights and recorded that assessment. You can ask us for it, and you can object (see §10).
Providing your information is not a legal requirement. You do not have to use HomeCode. If you choose not to give us your phone number we cannot send you messages, which is the whole service.
5. Safeguarding — the most important section
HomeCode serves children in difficult circumstances. Sometimes a message contains a sign that a child or an adult may be at risk of harm.
We check every message you send us for those signs. We use a fixed list of words and phrases, run automatically the moment a message arrives. It is not artificial intelligence, it does not learn, and it does not make decisions. The list can miss things, such as unusual wording, spelling mistakes or languages it does not cover.
If a message matches, three things happen:
- A record is created.
- You receive an automatic reply with emergency contact numbers, including 999 and Childline. That message is written by a person in advance and never changes.
- A real person is alerted: our Designated Safeguarding Lead. They look at it as soon as they can, though not instantly, and then decide whether anyone else, such as your keyworker, needs to be told, and when.
Every decision about what happens next is made by a qualified person, never by the system.
Information of this kind may be special category data, for example information about health, or it may concern possible criminal offences. Where it is, we rely on:
- UK GDPR Article 9(2)(g) (substantial public interest) and, in an emergency, Article 9(2)(c) (vital interests), and
- Data Protection Act 2018, Schedule 1, Part 2, paragraph 18 — safeguarding of children and of individuals at risk. We keep the Appropriate Policy Document this requires, and you may ask to see it.
For information about possible criminal offences, the same Schedule 1 condition applies through UK GDPR Article 10 and section 10(5) of the Data Protection Act 2018.
We may share safeguarding information without your consent where we believe a child is at risk of significant harm. We would share it with your keyworker, our Designated Safeguarding Lead, and where necessary the local authority children's services, the police, or emergency services. We will normally tell you if we do this, unless telling you would put a child at greater risk.
We keep safeguarding records for six years after a case is closed, because they may be needed for a serious case review. They are held separately, encrypted with their own key, and only the Designated Safeguarding Lead and named staff can reach them. A case is closed when the Designated Safeguarding Lead records that no further action is needed.
6. Who we share your information with
We do not sell your information. We do not use it for advertising. We only share it with the people listed below, for the reasons given. Meta, the police and the local authority decide for themselves how to use what they receive, under their own legal duties and policies.
| Who | What they do | Where |
|---|---|---|
| Meta Platforms Ireland Limited (WhatsApp) | Carries the messages between you and us. Meta can see your phone number and message content because it operates the messaging service | Ireland, with onward transfers to the United States |
| Amazon Web Services EMEA SARL | Hosts the service and stores the information | London, United Kingdom |
| Your keyworker and their organisation | Supports your family. Only if you consented, or where safeguarding requires it | United Kingdom |
| Local authority, police or emergency services | Only where a child is at risk of significant harm | United Kingdom |
Companies that handle information on our behalf, such as Amazon Web Services, are bound by a written agreement requiring them to protect your information and use it only as we instruct. Meta, the police and the local authority have their own legal responsibilities.
A note on WhatsApp. HomeCode uses WhatsApp because it is what families already have. Messages are encrypted in transit, but Meta operates the service and processes your phone number and message content. Meta's own privacy policy governs what Meta does with it. If you would prefer not to use WhatsApp, tell us and we will discuss alternatives.
7. Where your information is stored, and transfers abroad
All information we hold is stored in the United Kingdom, in Amazon Web Services' London region.
The one exception is WhatsApp messages. Meta Platforms Ireland Limited operates from Ireland and transfers information to Meta Platforms, Inc. in the United States. Those transfers rely on the EU-US Data Privacy Framework and its UK Extension, and on standard contractual clauses with the UK International Data Transfer Addendum where the Framework does not apply.
8. How long we keep your information
| What | How long |
|---|---|
| The words of your messages | 30 days, then deleted |
| Messages connected to a safeguarding concern | Until the case is closed, then six years |
| Safeguarding records | Six years after case closure |
| Records of whether you engaged (not the words) | Kept, and anonymised 12 months after the project ends |
| Records of which messages we sent you | Kept, and anonymised 12 months after the project ends |
| Tablet loan records | Until the tablet is returned and reset, then deleted within 30 days |
| Complaint and request records | Three years after the matter is closed |
| Referral details, if you do not join | Deleted after 30 days |
| Your consent records | Six years after you leave HomeCode, because we may need to show that you agreed |
| Records of staff access to your information | Three years |
| Keyworker accounts | Deleted 30 days after the account is closed |
| Anonymised information, which is no longer personal data | Kept indefinitely for research |
9. Keeping your information safe
- Everything is encrypted when stored and encrypted when travelling over the internet. Your phone number and your child's name are encrypted individually, with keys held in a separate hardware-protected service.
- Only staff who need to see your information can, and every single time a member of staff opens a family record it is logged.
- All staff accounts require two-factor authentication.
- The service is tested by independent security specialists before families join.
- Safeguarding records are held separately, under their own encryption key.
10. Your rights
You have the right to:
| Right | What it means |
|---|---|
| Be informed | To know what we do with your information. That is this notice |
| Access | To get a copy of the information we hold about you |
| Rectification | To have anything wrong corrected |
| Erasure | To ask us to delete your information. See the limits below |
| Restriction | To ask us to pause using it while something is resolved |
| Portability | To receive information you gave us in a reusable form |
| Object | To object to processing based on legitimate interests |
| Withdraw consent | At any time, without giving a reason |
To exercise any of these, contact us at legal@imarasystems.com, or reply to a HomeCode WhatsApp message and ask. We will respond within one month. It is free.
Limits on erasure. We can delete almost everything. We cannot delete safeguarding records within their retention period, because we may be legally required to produce them, and doing so could harm a child. We will always tell you exactly what we have kept and why. We also need to keep the record of which tablet we lent you until the tablet has been returned.
To stop the service entirely, reply STOP to any HomeCode message. We stop immediately.
11. For children and young people
This part is for you if you are the child or young person using HomeCode.
What we know about you. Your first name. How old you are, roughly. That is nearly everything.
The tablet. What you do on the tablet stays on the tablet. We cannot see which activities you did, how long you took, or whether you got things right. Neither HomeCode nor anyone who works for us can.
Your messages. You do not message us — your grown-up does. But if a message tells us that you might not be safe, a real person will find out, so that someone can help you.
We never show you adverts, and we never sell anything about you to anyone. Not ever.
Your rights. You can ask us what we know about you, ask us to fix it if it is wrong, and ask us to delete it. Ask your grown-up to contact us, or ask your keyworker. If you are old enough to understand what you are asking, you can ask us yourself. We will not be annoyed and we will not charge you.
If you are worried about anything, you can call Childline free on 0800 1111, at any time of day or night. They are not part of HomeCode, and they will not tell us you called.
12. Decisions made about you, and artificial intelligence
No decision that affects you is made automatically. A person always decides.
The safeguarding check described in §5 is a fixed list of words, not artificial intelligence. It does not decide anything. It tells a person to look.
We do not profile you. We do not use your information to target advertising. We never will.
13. Cookies and similar technologies
The HomeCode website and dashboards use only the cookies necessary to make them work, such as keeping a member of staff signed in securely.
We do not use advertising cookies, tracking pixels or third-party analytics that identify you. We do not track children.
14. Changes to this notice
If we change this notice we will update the date at the top and publish the new version at homecodebyimara.com/privacy. If a change materially affects you, we will tell you over WhatsApp before it takes effect.
We keep previous versions, and we record which version you were shown when you consented.
15. How to complain
Please tell us first, at legal@imarasystems.com or wale@imarasystems.com. We would rather put something right than have you go elsewhere unheard. You can complain in any way that suits you, including by replying to a HomeCode WhatsApp message. We will confirm we have received your complaint within 30 days (and usually much sooner), look into it without undue delay, keep you informed, and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
0303 123 1113 · ico.org.uk/make-a-complaint
16. Contact us
| Privacy questions | legal@imarasystems.com |
| Data Protection Officer | Wale Oyepeju, wale@imarasystems.com |
| Post | Imara Systems Limited, 167 - 169 Great Portland Street, London, England, W1W 5PF |
| Reply to any HomeCode message |
Imara Systems Limited. Registered in England and Wales, company number 16256656.