Acceptable use policy

Draft. This policy has not yet been reviewed by a qualified adviser. Text in square brackets will be completed before the service is offered.

This policy applies to the Inclusion Studio service, which is still in development and not yet available for real learner data. We publish it now so that organisations considering the pilot can see the rules in advance. It will form part of the agreement between Tech Geek UK Ltd, which operates Inclusion Studio (“we”, “us”), and each organisation that uses the service (“the organisation”), and applies to everyone the organisation gives access to, including staff, learners and employer contacts (“users”).

Who is responsible for following this policy?

Each user is responsible for their own use. The organisation is responsible for making sure its users know about this policy, for deciding who gets access, and for removing access when someone leaves or no longer needs it. The organisation remains the controller of its learners’ data and is responsible for using the service lawfully.

How must learner data be used?

Users must:

• use the service only for supporting learners, and for the purposes the organisation has authorised;
• record only information that is relevant, accurate and necessary for the learner’s support;
• respect the learner’s voice: record what the learner says helps in their own words where possible, and record disagreement rather than hiding it;
• follow the organisation’s data protection, retention and information-sharing policies;
• not export, download, copy or share learner information except as the organisation’s procedures allow.

Users must not use the service to discriminate against anyone, including on grounds protected by the Equality Act 2010.

How must accounts and permissions be treated?

Users must:

• keep their sign-in details private and never share an account;
• use multi-factor authentication where the organisation or the service requires it;
• not try to see records or fields their role does not allow, including by changing web addresses, IDs or parameters;
• tell the organisation’s administrator straight away if they think their account has been compromised or they can see information they should not.

Hiding a button is not how the service protects data; permissions are checked on our servers. Trying to get around them is a breach of this policy even if it fails. See permissions and roles.

What are the rules for apprenticeship employers?

Employer contacts may use the service only to see and act on the workplace adjustments shared with them and to record their own actions. They must not try to obtain a learner’s wider history, and must not copy information from the service into employment or occupational health records without a lawful basis and the organisation’s agreement.

What are the rules for AI drafts?

Where the organisation has switched on AI drafting, users must:

• read and check every AI draft before saving it, and take responsibility for what they save;
• remove anything inaccurate, speculative or not supported by the source notes;
• never use AI drafts to diagnose, to refuse or reduce support, or to make decisions about a learner;
• never record that support was delivered unless it actually was.

See our AI principles.

What must not be stored in the service?

Inclusion Studio is not a safeguarding case management system. Users must not use it to record safeguarding concerns, disclosures, referrals or child protection records, or to store occupational health or clinical records. These belong in the organisation’s specialist systems. See safeguarding boundaries.

Users must also not upload:

• malware, or files they know or suspect to be harmful;
• material that is unlawful, defamatory, or infringes someone else’s rights;
• passwords, payment card details or other credentials;
• information about people with no connection to a learner’s support.

What security rules apply?

Users must not:

• probe, scan or test the security of the service, except under our responsible disclosure policy or with our written permission;
• attempt to access another organisation’s data;
• interfere with or overload the service, for example by automated scraping or denial-of-service activity;
• reverse engineer the service except where the law allows;
• use the service to send spam or unlawful messages.

Some of these actions may be offences under the Computer Misuse Act 1990.

What happens if this policy is breached?

We may suspend access for a user or organisation where we reasonably believe this policy has been breached and suspension is needed to protect learners, other organisations or the service. Where we can, we will tell the organisation first and work with it to resolve the issue. [Further enforcement, notice and appeal wording to be completed after legal review.] Where the law requires, we may report a breach to the relevant authorities.

How do I report a problem?

Report suspected misuse, a security issue or a data incident to the organisation’s administrator and to us through our contact page. [A dedicated incident contact for live customers will be added before the service is offered.]

Can this policy change?

Yes. We will tell organisations about material changes in advance, as set out in their agreement. The date at the top shows when this policy was last updated. See also our website terms.