Privacy notice
AIM Education Last updated: 12 October 2026
This notice explains what personal information the AIM Education platform collects, why, who can see it, and what rights you have. I have tried to write it in plain English. If anything is unclear, please email me at hello@aimedu.co.uk.
Who I am
AIM Education is run by me, Mia Romem. I am the whole business: I design the programme, run the platform and answer your emails.
- Legal name: Mia Romem, trading as AIM Education
- Contact for anything in this notice: hello@aimedu.co.uk
I am based in England, so UK data protection law applies to me: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
What AIM Education is
AIM Education is a self-paced online professional development programme about generative AI for teachers in international and independent schools. Schools buy access and invite their staff. I do not use any AI or large language model to process your information, I do not run analytics or advertising, and I do not sell or share your information for marketing.
Who is responsible for your information
Responsibility is split, depending on the information.
Your school is in charge of your learning records. When your school buys the programme and invites you, the school decides that you will take part and what it wants to learn from the programme. For the learning records created as part of that (your progress, worksheets, reflections, checks, evaluation answers and uploaded work), your school is the "controller" and I am a "processor". That means I hold and use this information on your school's behalf, under a written agreement with the school, and only to deliver the programme. If you have questions about why your school is using the programme, please ask your school first.
I am in charge of some information myself. I am the controller for:
- enquiries sent through the website (the contact form and the "book a call" form);
- the interest list;
- accessibility reports;
- the basic account details I need to run the platform and keep it secure (your name, email address and sign-in details);
- anything you agree to let me use for research.
If you are not sure who is responsible for something, email me and I will tell you.
What I collect, and where it comes from
If you visit the website or contact me
| What | Where it comes from |
|---|---|
| Your name, email address, school or organisation, role and your message (contact form) | You |
| Your email address and which page you signed up on (interest list) | You |
| The page address, your device and browser, any assistive technology you use, a description of the problem, an optional screenshot, and optionally your name and email (accessibility report form) | You |
| The subject you teach, the year groups you teach and what you have already tried ("book a call" form) | You. This is passed to Cal.com, my scheduling tool, when you continue to book. I do not store it on the platform. |
If you have an account
| What | Where it comes from |
|---|---|
| Your email address, a securely stored version of your password, and your sign-in history | You |
| Your full name, school name, subject, a short bio if you add one, your role on the programme (teacher or leader) and your programme track | You, and your school when it invites you |
| Your school membership and role (teacher, admin or owner), and the invitation sent to your email address | Your school |
| Your progress through lessons, which tab you were on, and the dates you completed steps | Created as you use the platform |
| What you write in worksheets, workbooks, reflections and saved reflection PDFs | You |
| Your answers to unit checks, the baseline and end-of-programme questionnaires, follow-up questionnaires and (for leaders) leader questionnaires, plus the scores worked out from them | You, and calculated by the platform |
| Work you upload (artefacts): the file, its type and size, a reference code, the version and date, whether you confirmed names were removed, and which colleagues worked on it with you | You |
| In Unit 11 only: whether you said a record involves a safeguarding concern, and whether your Designated Safeguarding Lead (DSL) has confirmed a referral route exists | You |
| Forum threads and replies | You |
| Live session bookings, your feedback rating and comment, and your reminder settings | You |
| Your choices about research use and sharing your work | You |
| Unit records: a record code and the date it was issued when you complete a unit | Created by the platform |
I do not keep the original name of any file you upload.
If you are a school administrator
As well as the above, I hold the school's name and display name, logo, email domain (if your school lets staff join by domain), seat limit, programme start date, term breaks, organisation audit answers and the role of the second person who took part in the audit.
Peer visits
Peer visit notes are never typed into or stored on the platform. They stay with the teacher who was visited. If you choose to save the optional record, I store only: your school, the week of the visit, which of the six prompts were used, and an optional short theme of up to 150 characters. I do not store who saved it.
Pupil voice surveys
Schools can choose to run short anonymous surveys with pupils, using a link that starts /pv/. Before a school can open a survey, it must confirm that its DSL has reviewed the survey and the plan for running it, and that parents and carers have been told in advance.
What I collect from pupils:
- which survey round it was (which tells me the school);
- the age group the pupil chose: 8 to 11, or 11 to 18;
- their answers to fixed multiple-choice questions (any question can be skipped);
- the date the answers were sent.
What I do not collect from pupils:
- no name, class, teacher or email address;
- no sign-in or account;
- no free-text box, so pupils cannot type anything in;
- the platform does not store their device details or IP address with their answers.
Because of this, I treat pupil voice answers as anonymous. Schools may also enter paper survey results as totals only.
Like any website, my hosting providers may briefly keep technical logs (such as IP addresses) to keep the service secure and working. These are not linked to survey answers.
Information you should not give me
I do not ask for "special category" information, such as health, religion, ethnicity, sexual orientation or trade union membership, or information about criminal offences. I also do not want any personal information about pupils.
Some parts of the platform have free-text boxes and file uploads. Please do not include:
- names, faces, candidate numbers or identifiable handwriting of pupils or staff;
- details of any safeguarding case;
- your own or anyone else's health or other sensitive information.
If something like this is uploaded by mistake, tell me and I will delete it.
Why I use your information, and my lawful basis
Where your school is the controller, the school decides the lawful basis for its learning records. I use those records only to deliver the programme to you and to give your school the reports it has paid for.
Where I am the controller:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, keeping the platform secure, and preventing misuse | Legitimate interests: running a safe, working service for the schools that pay for it |
| Replying to your enquiry or contact form | Legitimate interests: answering people who contact me |
| Sending you news through the interest list | Consent. You can unsubscribe at any time. |
| Investigating and fixing accessibility problems you report | Legitimate interests: making the platform usable for everyone |
| Sending live session reminders by email, if you switch them on | Legitimate interests, and you can turn them off in your settings |
| Using your work or answers in research or published evaluation, only if you have opted in | Consent. You can withdraw it at any time. |
| Improving the programme using combined, de-identified results | Legitimate interests: making the programme better |
| Keeping business and tax records about schools that buy the programme | Legal obligation |
| Dealing with legal claims | Legitimate interests |
Where I rely on legitimate interests, I have weighed my interests against yours. You can ask me for details, and you can object (see "Your rights").
I do not make any decisions about you using automated means that have a legal or similarly significant effect.
Who can see what
You can see everything you have written and submitted. You will not see scores or rubric levels for your checks or uploaded work. Your work is not marked for you.
Your school's administrators see results only as totals for groups of 5 or more people. Anything for a smaller group is shown as "Not reported". Themes from free-text answers are only reported when at least 3 people raised the same theme. School administrators cannot read individual evaluation answers. Peer visit records are shown to schools only as counts per term. Pupil voice results are shown only as totals.
Results are never used for performance management. The programme, its checks and its records are for professional learning. They are not designed for, and must not be used for, appraisal, capability or any other performance process. This is part of my agreement with every school.
Colleagues at your school can see your name next to your forum posts, and can see your name if they want to add you to a team artefact.
Participants from other schools can read forum posts. They see your name only as "Teacher".
Me. As the person running the platform, I can access the information on it when I need to: to provide support, fix problems, check the programme is working, score samples of anonymised artefacts (identified only by a reference code), and comply with the law. I do this only when needed.
I do not sell your information or share it with advertisers.
I may have to share information if the law requires it, for example to comply with a court order.
Service providers I use
I use a small number of companies to run the platform. They act on my instructions and must keep your information safe.
| Provider | What they do |
|---|---|
| Lovable (Lovable Cloud) | Builds and deploys the platform |
| Supabase (through Lovable Cloud) | Database, sign-in and file storage. |
| Cloudflare (through Lovable) | Runs the website. |
| Resend | Sends emails such as invitations, sign-in links and reminders. Region: EU (Ireland) |
| Serves the website's fonts, which means your browser sends your IP address to Google when a page loads. | |
| Cal.com | My scheduling tool, only if you use "Book a call" |
International transfers
Some of these providers are based in, or use servers in, other countries, including the United States. Where your information is sent outside the UK, I make sure it is protected by UK adequacy regulations or by appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask me for more information.
Schools outside the UK
Many schools on the programme are outside the UK. Your school may also have duties under the law of its own country (for example the EU GDPR). This notice explains how I handle information under UK law. Your school can tell you how local law applies to its use of the programme.
How long I keep information
| Information | How long |
|---|---|
| Accounts and learning records | While your school's subscription is active, then deleted or fully anonymised within 6 months after it ends, unless your school asks me to return or delete it sooner |
| Unit records (record code, unit and date) | Up to 6 years after issue, so you can show your professional development history |
| Uploaded artefact files | Deleted once any sampling and scoring for that window is complete, and no later than 12 months after the upload window closes. The reference code and date stay with your learning record. |
| Forum posts | As for learning records. You can delete your own posts at any time. |
| Contact form and enquiries | 2 years after our last contact |
| Interest list | Until you unsubscribe. I will check every 2 years whether you still want to hear from me. |
| Accessibility reports | 2 years after the issue is closed |
| Pupil voice answers and peer visit records (anonymous) | For the length of the school's programme plus 2 years, then deleted |
| Information I have used in research with your consent | De-identified before use. Kept as stated in the research information you agreed to. |
| School billing records | 6 years, as required for tax |
Combined results that cannot identify anyone may be kept longer.
How I keep information secure
- Each person can only reach the information they are allowed to see. This is enforced in the database, not just on the screen.
- Small-group results are suppressed before they reach any school report.
- Uploaded files are stored privately and can only be opened through short-lived links.
- Files are stored under a random reference code, not your name or the original file name.
- Passwords are never stored in plain form.
- Information is encrypted in transit.
No system is perfectly secure. If a breach happens that is likely to put you at risk, I will tell your school, the ICO and you where the law requires it.
Your rights
You have the right to:
- ask for a copy of your information;
- ask me to correct it;
- ask me to delete it;
- ask me to restrict how I use it;
- object to how I use it (including where I rely on legitimate interests);
- ask for your information in a portable format;
- withdraw consent at any time, where I rely on consent (this does not affect anything done before).
For learning records where your school is the controller, you can contact your school, or contact me and I will pass your request to your school and help it respond.
To use any of these rights, email hello@aimedu.co.uk. I will reply within one month. I may need to check who you are first. There is usually no charge.
Complaints
If you are unhappy with how I have handled your information, please tell me first at hello@aimedu.co.uk. I will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
If your school is outside the UK, you may also be able to complain to the data protection authority in your country.
Cookies and browser storage
I do not use analytics, advertising or tracking cookies. The platform uses only a small number of items stored in your browser that are needed to keep you signed in or to remember choices you have made, such as your accessibility settings. The full list is on the Cookies and storage page.
Changes to this notice
I will update this notice if the platform or the law changes. I will change the date at the top, and if a change matters, I will tell you by email or on the platform before it takes effect.
Contact
Mia Romem, trading as AIM Education hello@aimedu.co.uk