Privacy Policy

This policy explains what information Skill Bloom collects, why we collect it, and what you can do about it. If anything here is unclear, please ask us.

Who we are

Skill Bloom is run by Skill Bloom Limited, registered in England and Wales, company number 16805373. We are the data controller for the information described below.

Skill Bloom is a social skills app for neurodivergent children aged 4 to 12. A parent or carer creates the account and sets up a profile for each child. Children then practise everyday social situations through short illustrated scenarios.

You can reach us about this policy at info@skillbloom.co.uk.

What we collect

We collect what we need to run the app and to personalise it for your child.

Your account

• Name and email address. Used to create your account, verify it, and contact you about the service.
• Password. Stored only as a secure hash. We cannot read it.
• Parent gate security question and answer. Optional. You set this so children cannot open the parent area on a shared device.

Child profiles you create

• First name or nickname, age group and avatar. Shown in the app so your child recognises their own space. Gender is optional.
• Conditions, social challenges and interests. What you tell us your child struggles with, and what they enjoy. Scenarios are built around these.
• Personal goal and calm kit. The skill you want your child to work on, and the strategies that help them settle.
• Reminder preference. The time of day you want to be reminded to practise.

Activity in the app

• Daily check-ins. How your child says they are feeling, plus any context or focus chosen for the day.
• Scenarios and choices. Which scenarios were played, what was chosen, and when.
• Progress. Points, streaks, badges and level progression, which feed the child dashboard and your reports.
• Generated content. The scenarios, images, narration and daily wrap-ups created for your child. We store these so they can be replayed.

Things you write to us

• Parent notes. Notes you add in the parent area about a current problem, situation or safe space.
• Messages. Anything sent between you and the Skill Bloom team inside the app, and emails you send us.

Technical information

• Session data. A cookie that keeps you signed in, and a token that protects forms.
• Server logs. Standard technical logs, which may include your IP address and browser type. We use these to keep the service running and secure.

Information about a child’s conditions and wellbeing counts as special category data under UK data protection law. We process it only with your explicit consent, which you give when you set up a child profile, and only to personalise the app for that child.

How we use it

• To run the service: creating and securing your account, showing each child their profile, and saving progress.
• To personalise scenarios, using age group, interests, goals, conditions and the daily check-in so each scenario fits how your child feels and what they are working on.
• To show you progress through the parent dashboard, daily wrap-ups and reports.
• To contact you: verification and password reset emails, in-app messages, and replies to anything you send us.
• To keep the app safe, by preventing abuse, rate limiting login attempts and investigating problems.
• To improve the product by looking at which scenarios help children most, in aggregate.

Our legal bases are performing our contract with you, your explicit consent for child profile and wellbeing information, and our legitimate interest in keeping the service secure and improving it. We do not use your data for advertising or marketing profiling.

AI-generated content

Skill Bloom uses AI to write each scenario and to create the illustrations, short animations and voice narration that go with it. All AI-generated content is subject to occupational therapist review and is checked against our neuro-affirming clinical standards by a qualified OT.

To generate that content we send our AI providers a small, pseudonymised profile.

What is sent

• Age group, for example 7 to 9, and gender if you provided it
• The conditions, social challenges and interests you selected
• The personal goal and calm kit strategies you set
• Today’s check-in mood and any context chosen for the day
• The storyline of previous scenarios, so each level builds on the last

What is never sent

• Your child’s name or nickname
• Your name, email address or any account details
• Parent notes or messages you have written to us

Our AI providers act as our processors. They generate content on our instructions and may only use what we send them to produce that content for us. You can see everything your child sees.

Children’s privacy

Children use Skill Bloom but do not have accounts. Only an adult can register, and every child profile is created, managed and deleted by that adult. We collect information about a child from the parent, and from the child’s own activity in the app.

• The child area has no advertising, no external links and no in-app purchases.
• Children cannot message anyone, share content, or contact other users.
• The parent area is protected by a security question, so children cannot change settings or read reports.
• We follow the ICO’s Age Appropriate Design Code in how the child experience is built.

If you think a child has given us information without a parent’s involvement, contact us and we will remove it.

Who we share it with

We do not sell personal information. We share it only with:

• Service providers who help us run the app, covering cloud hosting and storage, AI content generation, and email delivery. Each may only use the data to provide their service to us.
• Occupational therapists who review AI-generated content for us. They work under confidentiality obligations and have no access to your account or your child’s identity.
• Schools, only where a school has bought Skill Bloom for your child and you have agreed to share progress with them.
• Authorities, where the law requires it, or to protect the safety of a child or anyone else.
• A successor business, if Skill Bloom is ever bought or merged, under the same protections as this policy.

Cookies

We use only strictly necessary cookies, so there is no cookie banner:

• Session cookie. Keeps you signed in as you move around the app.
• Security token (XSRF). Stops another site submitting forms on your behalf.

We do not use analytics, advertising or social media cookies, and we do not load third-party trackers on any page. Fonts are served from Google Fonts, which may see your IP address when they load.

Retention and deletion

We keep your information for as long as you have an account, so your child’s progress and history are there when you come back.

• Deleting your account. Go to Settings, then Profile, and choose “Delete account”. This permanently removes your account, every child profile, and all check-ins, scenarios, generated media, wrap-ups, notes and messages. If you cannot sign in, use our account deletion request form instead.
• Backups and logs. Copies may remain in encrypted backups and server logs for up to 30 days before being overwritten.
• Legal records. We keep billing records for as long as tax law requires.

Your rights

Under UK GDPR you have the right to:

• Access a copy of the information we hold about you and your child.
• Correct anything inaccurate. Most profile details can be edited in the app.
• Delete your data at any time, from Settings or by using our account deletion request form.
• Withdraw consent to the processing of child wellbeing information, by deleting that child’s profile.
• Restrict or object to certain processing, and port your data to another service.

To use any of these, email info@skillbloom.co.uk. We will respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would rather try to sort it out with you first.

Security

• Traffic between your device and Skill Bloom is encrypted with HTTPS.
• Passwords are stored as salted hashes and are never visible to us.
• Email addresses must be verified before an account can be used.
• Login and parent gate attempts are rate limited to slow down guessing.
• Access to production data is restricted to the staff who need it.

If we ever find a breach affecting your data, we will tell you and the ICO as the law requires.

International transfers

We are based in the UK and store your data in the UK or European Economic Area where we can. Some of our service providers, including our AI providers, process data in the United States. Where that happens we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, to keep the same level of protection.

Changes to this policy

We may update this policy as the app changes. If a change materially affects how we use your or your child’s information, we will email you before it takes effect. The date at the top of this page shows the current version.

Contact us

Skill Bloom Limited
Registered in England and Wales, company number 16805373
info@skillbloom.co.uk