Introduction

BloomBridge is a school psychological intervention app developed by Anagata IT Solutions. This Privacy Policy explains how we collect, use, store, and protect data within the BloomBridge platform. We believe children’s data is sacred, and this policy reflects our privacy-first design philosophy. By using BloomBridge, schools agree to the practices described in this policy.

Data Collection

BloomBridge collects the following categories of data:

• Teacher observation notes: Behavioral observations logged by teachers in plain language.
• Student age group: Age categorization (3–6, 7–12, 13–18) for age-appropriate intervention calibration.
• Focus area categorizations: AI-generated behavioral focus areas with confidence scores.
• Action plans: Generated weekly intervention plans with daily classroom steps.
• Progress logs: Teacher follow-up entries on intervention outcomes.
• Parent communication records: Sent templates and communication history.
• Emergency alerts: Triggered alerts when observations include indicators of self-harm, aggression, or immediate danger.

We do not collect: student names (we use initials), student photos, biometric data, location data, browsing history, or any data unrelated to behavioral observation and intervention.

Data Use

Data collected through BloomBridge is used exclusively for:

• Generating structured action plans for teachers.
• Tracking intervention progress and outcomes.
• Providing aggregated, anonymized reporting to school management.
• Triggering emergency alerts when safety indicators are detected.
• Improving the AI categorization model (using anonymized, aggregated data only).

We do not use children’s data for advertising, marketing, profiling, or selling to third parties. Ever.

Data Storage & Encryption

All data is stored on encrypted servers with the following security measures:

• AES-256 encryption for all data at rest.
• TLS 1.3 encryption for all data in transit.
• OAuth 2.0 authentication with school single sign-on (SSO).
• Role-based access control (RBAC): Teachers see only their own cases. Principals see aggregated data. No cross-visibility without explicit permission.

Servers are hosted in India to comply with DPDP Act data localization requirements. Data is backed up daily with encrypted backups stored in geographically separated facilities.

Data Sharing

BloomBridge does not share children’s data with third parties. This is a non-negotiable principle. We do not sell data. We do not share data with advertisers. We do not share data with analytics providers. We do not share data with any external organization unless legally required by a court order or government mandate, in which case we will notify the school before compliance (unless legally prohibited from doing so).

Data Retention

Data retention periods are as follows:

• Teacher observation notes: Until school requests deletion.
• Focus area categorizations: 90 days post-intervention.
• Action plans: Until school requests deletion.
• Progress logs: Until school requests deletion.
• Parent communication records: 12 months.
• Emergency alerts: 24 months (compliance requirement under DPDP Act).

Schools can request deletion of any data at any time. We process deletion requests within 30 days.

User Rights

Schools and parents have the following rights regarding their data:

• Right to Access: Request all data stored about their students.
• Right to Deletion: Request permanent deletion of any student’s data.
• Right to Export: Export all data in standard formats (CSV, JSON).
• Right to Audit: Request audit logs of all data access for a specified period.

To exercise these rights, contact hello@bloombridge.app. We respond to all requests within 7 days.

Children’s Data Specific Protections

As a platform handling children’s behavioral data, we apply additional protections:

• We do not collect student full names — only initials are used.
• We do not collect biometric data, photos, or location data.
• We do not track children’s behavior across other apps or websites.
• We do not use children’s data for behavioral advertising or profiling.
• AI categorization uses only the observation text provided by the teacher — no external data sources.
• All AI processing happens on secure servers. No data is sent to third-party AI APIs.

DPDP Act Compliance

BloomBridge is fully compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India:

• We are registered as a Data Fiduciary under the DPDP Act.
• We process children’s data with explicit consent from schools (verifiable parental consent for children under 18).
• We do not track, target, or profile children for behavioral advertising.
• We comply with data localization requirements — all data is stored in India.
• We provide the rights to access, correction, erasure, and grievance redressal as required by the DPDP Act.

Data Breach Response

In the unlikely event of a data breach, we follow this protocol:

• Immediate containment: Affected systems are isolated within 1 hour of detection.
• Assessment: Our security team assesses the scope and impact within 24 hours.
• Notification: Affected schools are notified within 72 hours of breach confirmation, as required by the DPDP Act.
• Remediation: Vulnerabilities are patched, and affected data is restored from encrypted backups.
• Post-incident review: A detailed report is shared with affected schools within 30 days.

Contact Information

For any questions, concerns, or requests related to this Privacy Policy:

• Email: hello@bloombridge.app
• LinkedIn: linkedin.com/company/anagata-it-solutions
• Website: bloombridge2.anagataitsolutions.in