Data Protection Impact Assessment: learners using AI

This page is for parents, carers and teachers who want to know exactly what happens when learners use AI in RUJL. It is written in plain English and describes only the protections RUJL actually enforces today.

Summary

RUJL lets learners aged 13 or over revise with AI: it can write a summary of a lesson objective, set an exam-style question, give a hint, give feedback on the learner's answer and show a model answer. Learners have no RUJL account and never give their name or email; they enter a 6-character class code from their teacher, and only the lesson text and the learner's answer are sent to the AI. AI is off unless the learner's teacher or parent turns it on, every request is built by RUJL's server from fixed templates, and the safety controls below check, limit and anonymise what is sent and shown. When a learner submits an answer, the AI also scores it from 0 to 9 against the lesson's rubric. RUJL keeps only that number, with an anonymous code for the browser session, so the teacher can see the class's progress; the answer itself is never kept.

Who is responsible

This section is under professional review: it has not yet been checked by a data protection professional and may change.

RUJL is the controller for the AI processing that happens when learners use AI in RUJL. RUJL decides how requests are built, what is sent, and which safeguards apply.
The teacher, or home-schooling parent, who signed up decides whether their learners may use AI at all. They turn it on or off with 'AI processing' in Privacy settings (in the website footer), or when they register. Either way, turning it on also confirms 'I confirm that I have read and understood the Privacy Policy, including how AI is used.'
Teachers sign up to RUJL as individuals. If you work at a school, please check with your school before turning on AI for your learners.
OpenAI provides the AI service and acts as a processor for RUJL. It is the only AI provider learner requests are sent to; RUJL refuses learner AI for any other provider.

What data, from whom, and where it goes

From the lesson: the lesson objective, taken from RUJL's database (not from the learner's browser), and any summary or exam question the AI has already written for that objective, or a summary or question the teacher saved on the objective. When scoring an answer, the lesson's rubric (its learning objectives and their levels) is also sent.
From the learner: only the answer they type, up to 2,000 characters. Learners are asked not to type personal details such as their name, address or school.
Browser session id: with each answer, the learner's browser sends a random id it made for that browser session, kept in session storage and cleared when the session ends. It is never sent to the AI. RUJL's server turns it into a salted, one-way code, different for each class, and keeps only that code, so a learner's answers in one session can be linked without anyone knowing who they are.
Not collected: learners have no accounts, names or email addresses in RUJL. No learner name or personal detail is added to AI requests.
Anonymous class identifier: each request carries a salted, one-way code made from the class code. It lets misuse be traced to a class, not to a person, and cannot be turned back into the class code.
Where it goes: from the learner's browser to RUJL's server, which builds the request and sends it to OpenAI. OpenAI may process it outside the UK.
What RUJL keeps: RUJL does not store learners' answers or the AI's replies. For each request RUJL records only the class code, the teacher's account and subscription numbers, the AI provider, the model, the number of tokens used and the cost - never what the learner typed or what the AI replied.
Class grading: for each answer RUJL also keeps the score from 0 to 9, the class (lesson schedule), the learning objective, the time and the anonymous one-way code described above. Nothing else. Only the teacher who created the class, the owner of the scheme of learning and teachers they have authorised can see the scores. Scores are deleted when the class or the learning objective is deleted.
How scores are worked out: the AI is asked to score the answer against the lesson's rubric: 0 is no relevant answer, a low score meets only the lowest level, and 9 fully meets the highest level. The score is written on the first line of the AI's reply and removed before the learner sees it. If no valid score comes back, nothing is recorded. The teacher sees, for each objective, how many learners answered, the average of each learner's first score, the average of each learner's latest score, the change between them, and how many learners' latest scores are 0-3, 4-6 and 7-9. An objective is suggested for a recap once at least 3 learners have answered and their latest scores average below 4. A learner who starts a new browser session counts as a new learner.
Suggestions for the teacher: a teacher can ask AI to suggest what to recap next lesson. Only the learning objectives, their levels and the numbers above are sent, using the teacher's own AI provider. The suggestion is shown to the teacher and not kept.
What RUJL asks of OpenAI: every learner request tells OpenAI not to store it (store=false).
OpenAI's own policy: this is OpenAI's commitment, not a control RUJL enforces. OpenAI's API business terms say it does not use API data to train its models, and it may keep API data for a limited time to detect abuse.

Why AI is needed and proportionate

AI gives learners instant, personal revision support: explanations, practice questions, hints and feedback on their own answers, when a teacher is not available. RUJL sends only what is needed for that: the lesson text and the learner's answer.

AI is optional at three levels:

Teacher or parent: AI is off until they turn on AI processing and confirm 'I confirm that I have read and understood the Privacy Policy, including how AI is used.' Learner AI also only works while their My RUJL plan is paid, and only for schemes of learning whose target age group starts at 13 or over.
Learner: when AI is allowed, each learner is asked whether to allow AI processing. Choosing Allow confirms they are 13 or over. Learners who choose not to allow it can still use RUJL without AI.
Session: the learner's choice lasts only for the browser session, and they can change it at any time with the box at the bottom of the page.

Risks and what we do about each

The likelihood and severity ratings below are a draft and are reviewed by the owner of RUJL.

Risk	Likelihood	Severity	What we do about it	Remaining risk
Harmful or unsuitable replies	Possible	Significant	Content check screens the AI's reply before it is shown and hides anything flagged. The age-appropriate instruction tells the AI the user is a school learner aged 13 or over and to stay on the lesson. Requests are built only from fixed templates. Short answers limits reply length.	Low
A learner shares personal details	Possible	Moderate	Learners are told not to type personal details. RUJL adds no names or personal details, does not store answers, and asks OpenAI not to store requests. The age-appropriate instruction tells the AI never to ask for personal details.	Low
Misuse of the AI, such as trying to make it ignore its instructions	Possible	Moderate	Learners can only type their answer (up to 2,000 characters); RUJL's server writes every instruction. The summary, question, feedback and model answer boxes are read-only, and earlier AI outputs are signed so they can't be altered. Content check screens the answer before it is sent.	Low
Wrong or misleading answers	Likely	Moderate	AI help is for revision only; RUJL does not use it to make decisions about learners. Every request is tied to the teacher's lesson objective. Learners are told on the page that AI can make mistakes, to check its responses carefully and to ask their teacher if unsure.	Medium
The AI provider uses the data for its own purposes	Unlikely	Significant	RUJL sends learner requests only to OpenAI, asks it not to store them (store=false) and sends only an anonymous class identifier. Separately, OpenAI's API business terms say it does not use API data to train its models.	Low
Learners under 13 use AI	Possible	Significant	The teacher or parent must confirm they have read and understood the Privacy Policy, which says learner AI must not be used by learners under 13, before turning it on. Learner AI is turned off for any scheme whose target age group starts under 13 (7 - 11 and 11 - 14 yr old). Each learner confirms they are 13 or over by choosing Allow. The age-appropriate instruction and content check apply to every request. RUJL cannot verify a learner's age.	Medium
Someone uses a class code without permission	Possible	Moderate	All the safety controls apply to every request, whoever sends it. AI only works while the teacher allows it and their plan is paid, and the teacher can turn it off at any time. The anonymous class identifier lets misuse be traced to the class.	Low
Wrong or unfair scores	Likely	Minor	Scores are a guide for the teacher only; RUJL does not use them to make decisions about learners and learners never see them. Each score is anchored to the teacher's own rubric. The teacher sees class averages and counts rather than single scores, is told how scores are worked out, and is reminded that AI can make mistakes. Anything other than a whole number from 0 to 9 is not recorded.	Low
Scores give a misleading picture of the class	Possible	Minor	Repeat answers from the same browser session count as progress, not as new learners, but a learner who starts a new session counts again, and someone using the class code without permission could add scores. Recaps are suggested only once at least 3 learners have answered. The teacher sees the number of learners and answers for every objective, and the AI's suggestions are advice for the teacher to check.	Low
A score is not recorded	Unlikely	Minor	The AI is asked to give the score first, so a reply shortened by the Short answers limit still has it. If the AI gives no valid score, or the score can't be saved, the learner still gets their feedback and that answer is simply left out of the teacher's view.	Low
A learner is identified from their scores	Unlikely	Minor	Scores hold no name, answer or account. The browser session id is random, cleared when the session ends, never sent to the AI, and stored only as a salted, one-way code that is different in each class, so it can't be traced back to a browser or linked across classes. Teachers see class totals, not individual learners.	Low
A data breach	Unlikely	Moderate	RUJL does not store learners' answers or the AI's replies, and learners have no accounts. RUJL's AI records hold only the class code, the teacher's account and subscription numbers, provider, model, token counts and cost. Class grading records hold only scores, the class, the learning objective, the time and an anonymous one-way code.	Low

Safety controls

Teachers and parents see these controls in Privacy settings, under AI processing, in the same two groups. They apply to every class the teacher owns. Learners never see or change them.

Control	Can the teacher turn it off?	What it does
Student AI (AI processing)	Yes - off until the teacher turns it on	Learner AI only works while the teacher's latest choice allows it. Turning it on requires confirming 'I confirm that I have read and understood the Privacy Policy, including how AI is used.'
Student portal
Content check	Yes - on by default	The learner's answer is checked with OpenAI's moderation service (omni-moderation-latest), using the teacher's AI account, before it is sent, and the AI's reply is checked before it is shown. Anything flagged is not shown. If the check can't run, no reply is shown.
Fixed question templates	No - always on	RUJL's server builds every AI request. Learners can only type their answer; the other boxes are read-only, 'Ask for help' gives a hint, and earlier AI outputs are signed so they can't be altered.
No personal details sent	No - always on	No learner names or personal details are added to AI requests, and RUJL never records what the learner typed. Class grading keeps only a score and an anonymous one-way code.
Sent to the AI
Age-appropriate instruction	Yes - on by default	Tells the AI the user is a school learner aged 13 or over, to stay on the lesson objective, to refuse anything off-topic, harmful or personal, and never to ask for personal details.
Short answers	Yes - on by default	Caps each AI reply at 400 tokens (roughly 300 words).
Anonymous class identifier	No - always on	Sends OpenAI a salted, one-way code made from the class code, so misuse can be traced to a class, not a person. If RUJL's server is not set up to make this code, learner AI is refused.
Not stored by the AI provider	No - always on	Every learner request asks OpenAI not to store it (store=false).

Your rights and choices

Teachers and parents can turn AI processing off at any time in Privacy settings; learner AI stops straight away.
Learners can choose not to allow AI processing, or untick the box at the bottom of the page at any time.
Teachers can delete a class's scores by deleting the class (lesson schedule).
You can object to this processing, ask for a person to review any AI output, or tell us what you think about it.
To ask a question or exercise your rights, contact RUJL's data protection contact at dpo@rujl.net.

Review

This assessment was reviewed on 30 October 2026, when class grading was added. It will next be reviewed by 30 October 2027, or sooner if RUJL's use of AI changes.