Your Child's Data Is Redacted Before AI Ever Sees It

When parents use Pathway, they upload some of the most sensitive documents that exist: draft EHCPs, GP letters, educational psychology reports, LA correspondence. These files are full of your child's name, date of birth, NHS number, home address, and school.

Most AI tools for SEND parents — and most general-purpose AI tools — take those files and send them directly to the AI. We do not. Before any document reaches Claude, Pathway runs every file through a custom PII redaction pipeline. The AI receives a clean copy. Your original document never leaves your account.

What gets redacted before Claude sees anything

Our redaction pipeline targets every identifier that UK GDPR classifies as personal data for a child. This is not a keyword blocklist. It is a purpose-built extraction layer that handles the messy reality of real EHCP documents: names buried mid-paragraph, NHS numbers written with different spacing, dates in every format.

The pipeline runs on our own infrastructure. If redaction fails for any reason — a parsing error, a corrupted file, anything — the request is rejected. There is no fallback that sends raw bytes.

It works on images too

Many parents scan documents rather than uploading digital PDFs. The same redaction applies. Images are parsed, text is extracted, identifiers are stripped, and only the clean version is passed through. This was not a trivial thing to build, but it matters: a scanned letter from a paediatrician is just as sensitive as a typed one.

The test results

We run PII redaction tests against every push to production. The test suite covers eight representative document types — the kinds of files parents actually upload. Here are the results from our most recent run:

None of these documents used real children's data. The test suite uses synthetic records with realistic identifiers — names, NHS numbers, postcodes, UPNs — that are verified clean after redaction. The table above is from a real test run, not a projection.

What Claude actually receives

Redacting the identifiers does not destroy the clinical value of the document. Here is what our AI extracted from an educational psychology report after redaction — with zero personal identifiers present:

Cognition: Processing Speed Index PSI 69 (Extremely Low) — "the most functionally limiting factor in the classroom"; Working Memory Index WMI 74 (Borderline)

SEMH: School attendance 78% (2024–25), "most absences linked to anxiety-related school refusal on Monday mornings"

Communication: Written expression Standard Score 70 (2nd percentile); "produces minimal text and relies heavily on adult scribing"

Gaps identified: No SALT report referenced — direct SALT assessment does not appear to have been completed prior to this report; no formal CAMHS or clinical psychology involvement noted

The clinical detail your tribunal needs reaches the AI. The data that identifies your child does not.

Why this is the right approach under UK GDPR

UK GDPR Article 32 requires "appropriate technical and organisational measures" to protect personal data. For a parent processing a child's health and education records, that is the highest bar in data protection law. Most AI tools either send raw documents, rely on client-side filtering you cannot audit, or point to a vendor's privacy page and trust you to accept it.

We chose a different design: strip the data before it leaves our infrastructure. The original document stays in your account. Only the redacted copy reaches Claude. That is not a policy — it is an architectural constraint.

This also protects you from the other risk: AI hallucination. When an AI is given your child's real name, school, address, and NHS number, it can produce outputs that mix real identifying data with invented facts. Removing the identifiers before analysis means there is nothing real for a hallucination to attach itself to.