Privacy Policy
Last updated: 17 September 2026
One School at a Time ("OSaaT", "we", "us") operates the osaat.vision website and the OSaaT vision-screening application (the "App"). This policy explains what information we collect, why we collect it, who we share it with, and the choices and rights available to schools, parents, guardians and the eye-care professionals who use the App.
The App is a professional tool. It is not intended for use by children directly. Screening records are created and managed by trained technicians, optometrists and ophthalmologists acting on behalf of a school programme or implementing partner.
Who is responsible for your data
OSaaT acts as the data controller for programme and account information, and as a processor on behalf of the school, ministry of health or implementing partner that runs a screening programme. Where local law requires a named contact, write to info@osaat.vision.
Information we collect
1. Professional user accounts (App users)
- Name, work email address and password credentials
- Professional role, registration or licence reference where applicable
- Organisation, country and assigned schools or screening sites
- Login and activity logs, device model, operating system version and app version
2. Child screening records (health information)
- Child's name or programme identifier, date of birth or age, sex, school, grade and class
- Parent or guardian name and contact details where a school provides them for referral follow-up
- Reported complaints and observations (for example squinting, night blindness, eye swelling)
- Visual acuity results per eye, refraction and prescription values, and clinical notes
- Referral status, diagnosis notes entered by a clinician, and spectacle dispensing records
- Photographs only where a school or guardian has given written consent
3. Website information
- Details you submit through our contact form (name, organisation, email, country, message)
- Aggregate, anonymised usage statistics; we do not use advertising cookies or ad networks
The App does not collect precise location, contacts, photos from your gallery, SMS, call logs or advertising identifiers. We do not sell personal information, and we do not use screening data for advertising or profiling.
Consent for children
Screening takes place under a written agreement with the school and, where required by local law or programme policy, with opt-in or opt-out consent from a parent or guardian. A child may decline to take part at any time. If a guardian withdraws consent, the record is removed from active programme reporting at their request.
How we use the information
- To carry out vision screening, referral and spectacle dispensing for a child
- To let a clinician review a child's history at a follow-up visit
- To let authorised programme staff generate and download reports (including CSV exports) of the screening data collected under their own programme, for programme management, referral follow-up and reporting
- To produce anonymised, aggregated reports for schools, ministries, partners and donors
- To authenticate users, keep records secure and prevent misuse of the App
- To improve the accuracy, reliability and accessibility of the App
Our legal bases, where the GDPR or a comparable law applies, are consent, the performance of our agreement with the school or partner, our legitimate interest in operating the programme safely, and, for health data, the provision of health care and public-health purposes.
Who we share information with
- Clinicians and implementing partners directly involved in a child's care
- The school, and the parent or guardian, for referral and dispensing outcomes
- Health authorities where reporting is required by law or by programme agreement
- Research collaborators, using de-identified data only and under a written agreement
- Service providers that host and secure our systems, bound by confidentiality terms
Donor and public reporting uses aggregated figures only. We never publish a child's identity or clinical record.
Storage, transfers and security
Data is encrypted in transit (HTTPS/TLS) and encrypted at rest on our managed cloud infrastructure. Records held on a device for offline screening are stored in the App's private storage and sync to the server over an authenticated connection. Access is restricted by role, so a user only sees the sites and records their role requires. Data may be processed in a country other than the one where it was collected, under appropriate safeguards such as standard contractual clauses.
How long we keep information
Child screening and dispensing records are retained for as long as the programme or applicable health-records law requires, and are then deleted or irreversibly anonymised. Account records are deleted within 30 days of an account being closed. Contact-form messages are kept for up to 24 months.
Your rights and account deletion
You may ask us to access, correct, export, restrict or delete personal information, to withdraw consent, or to object to a particular use. Parents and guardians may exercise these rights on behalf of a child. App users can request deletion of their account and associated personal data by emailing support@osaat.vision from their registered address, or through the request page at osaat.vision/data-deletion.
We respond within 30 days. Clinical records that we are legally required to retain are kept for the statutory period and then deleted; we will tell you if this applies to your request.
Children's online safety
The App contains no advertising, no in-app purchases, no social features and no user-generated public content. It is distributed for professional use and is not designed or marketed to children.
Changes to this policy
We will post any change on this page and update the date above. Material changes affecting screening data are also communicated to partner schools and organisations.
Contact
One School at a Time — privacy enquiries: info@osaat.vision or support@osaat.vision.