Child and Participant Data Schedule

This Child and Participant Data Schedule applies when Philomathia processes identifiable information about a child, young person, learner, NDIS participant, student, support recipient, or other person receiving support through Philomathia.

It is designed for conservative Australian privacy practice and should be read with the Privacy Policy, Terms of Service, Master Services Agreement, Data Processing Addendum, and any signed customer agreement.

Australia does not use a single under-13 privacy consent threshold. Where individual capacity assessment is not practicable, Philomathia treats individuals under 15 as not having capacity to consent for the collection of identifiable child or participant data, unless a legally reviewed deployment says otherwise.

For individuals under 15, and especially children under 13, child or participant data may only be submitted where a parent, guardian, school, support provider, or customer has authority to provide it and the required notice, consent, or approval has been obtained.

The child, young person, or participant should still be involved in privacy choices as far as practicable, in language and formats they can understand.

Covered data may include name, contact details, age or date of birth, school or support setting, learning activity, prompts, reflections, support notes, supporter relationships, goals, progress, behavioural observations, regulation patterns, communication preferences, NDIS context, and AI-generated observations.

Sensitive support context, disability-related information, health-adjacent information, diagnoses, therapy records, school records, behaviour support records, and third-party information should only be submitted when necessary for the agreed support purpose and when the person submitting it has authority.

Philomathia should collect the minimum identifiable data needed for the agreed support, learning, coaching, or pilot purpose. Customers and users should avoid submitting full clinical records, detailed therapy notes, unnecessary diagnoses, family disputes, or identifiable third-party information unless expressly agreed and authorised.

Public contact forms and early-stage enquiries should use practical support context rather than detailed sensitive records.

Deployments involving child or participant data must define visibility controls before launch. This includes which administrators, parents, guardians, teachers, support workers, allied professionals, managers, mentors, or Philomathia staff may see each category of information.

Supporter access should be limited to the role, relationship, and support purpose approved for that person. Learner or participant control, summary-only sharing, and revocation should be used where the product supports those controls.

Philomathia may use AI systems to generate practice activities, summaries, feedback, recommendations, support signals, and observations. AI outputs are assistive only and require human review before use in support, education, NDIS, employment, health, or similarly significant contexts.

AI outputs must not be used as the sole basis for decisions about admission, discipline, employment, support withdrawal, diagnosis, therapy, NDIS eligibility, funding, safeguarding, or any other consequential decision.

Customers and users must not use Philomathia to create unsupported clinical conclusions, replace qualified professional judgment, make automated consequential decisions, surveil a child or participant outside the agreed support purpose, or pressure a learner to disclose sensitive information.

Philomathia must not be presented as diagnosis, therapy, behaviour support plan approval, NDIS approval, school outcome guarantee, employment outcome guarantee, or legal advice.

Before storing identifiable child or participant data, the product workflow should record whether the data subject is under 15, 15 to 17, or an adult. For under-15s, the workflow should record consent source, authority type, timestamp, consenting party, scope, and withdrawal status.

Before customer pilots involving children or participants, Customer should confirm authority to provide data, receive the Data Processing Addendum and this schedule, identify admin roles, define visibility rules, agree retention expectations, and identify deletion or export contacts.

Parents, guardians, authorised organisations, learners, and participants may request access, correction, deletion, export, consent withdrawal, or visibility review, subject to identity verification, safety, legal obligations, and the customer agreement.

Where an organisation controls the deployment, Philomathia may direct requests through that organisation so the request can be handled consistently with the relationship, authority, and legal context.

This schedule should be reviewed before any material change to child or participant data collection, AI processing, subprocessors, retention, admin visibility, or customer deployment model.

The OAIC Children's Online Privacy Code is expected to be finalised and registered by 10 December 2026. Philomathia should review this schedule again once the final Code is available.