Free EYFS Profile Software

[SimpleSi]

One of my school headteachers found this

https://orbit.so

 

which seems to be a fully functional, free EYFS Profile builder a la 2Simple's 2BuildAProfile and FingerTips.

 

They say they intend to keep the app free for schools and get income from advertising to parents.

 

regards

 

Simon

[jmak]

Anyone else using this? I demonstrated the 2simple app to our head today which went down quite well. This looks to good to be true - which always makes me nervous.

[elsiegee40]

Just a simple point... Whatever you do, please make your SLT consider the Data Protection implications of the devices on which it is used. Personal devices are unencrypted and could be lost, stolen, sold... all with personal data of the EYFS children on them. The fines are MASSIVE!

 

In my opinion, it should NEVER be used on personal devices of staff.

 

As it can be used to take photographs of the children, this would be contrary to our Staff AUP which expressly forbids using their personal phones and cameras for photographing children.

 

I'd be interested in @GrumbleDook 's opinion on this.

Edited November 28, 2012 by elsiegee40

[jmak]

Just a simple point... Whatever you do, please make your SLT consider the Data Protection implications of the devices on which it is used. Personal devices are unencrypted and could be lost, stolen, sold... all with personal data of the EYFS children on them..........

 

As it can be used to take photographs of the children, this would be contrary to our Staff AUP which expressly using their personal phones and cameras for photographing children..

 

Completely agree. This was always implied in our AUP, but it's just been made explicit. If we do go with this or another system, devices will be bought for the purpose and secured in school. I would also employ the apps which allow remote wiping of devices in the event of loss. iOS devices should be encrypted if you use a pass code or PIN, but I haven't seen that demonstrated.

 

One of the reasons I asked the question is to find out if orbit have any kind of reputation. My biggest concern with both of these systems is what happens to the data off the devices - they all sync to the providers' servers. Orbit's website gives details of their registration with the ICO. I spoke to the people from 2simple and it is UK hosted and encrypted with no access for their employees.

 

On the up side, I think they could be transformational in terms of the ease of gathering evidence of attainment against the hundreds of criteria in the Early Years framework.

[elsiegee40]

On the up side, I think they could be transformational in terms of the ease of gathering evidence of attainment against the hundreds of criteria in the Early Years framework.

I couldn't agree more

 

iOS devices should be encrypted if you use a pass code or PIN, but I haven't seen that demonstrated.

But what is to force the staff to put a PIN on a personal device? What incentive is there for them to use a number that's not easily guessed? And what stops them from removing it or changing it on a school owned one?

Edited November 28, 2012 by elsiegee40

[jmak]

But what is to force the staff to put a PIN on a personal device? What incentive is there for them to use a number that's not easily guessed? And what stops them from removing it or changing it on a school owned one?

 

Hopefully a combination of their professionalism the advice we offer and the mention of disciplinary action, individual criminal liability and large fines.

 

And adhering to the AUP!

[GrumbleDook]

Just a simple point... Whatever you do, please make your SLT consider the Data Protection implications of the devices on which it is used. Personal devices are unencrypted and could be lost, stolen, sold... all with personal data of the EYFS children on them. The fines are MASSIVE!

 

In my opinion, it should NEVER be used on personal devices of staff.

 

As it can be used to take photographs of the children, this would be contrary to our Staff AUP which expressly forbids using their personal phones and cameras for photographing children.

 

I'd be interested in @GrumbleDook 's opinion on this.

 

I would also go with never on a personal device due the camera function ... I would have to see if it sticks a copy of the picture in the local camera roll. If not then you could get away with it ... It depends on what else it stores locally, but remember the amount of personal data that a teacher may have on a home machine due to marking, planning, etc ... It is hard to say never on a personal device.

 

The fact that it is a mobile phone makes it more accessible as a target for theft or increasing the chances of loss. This has to be taken into consideration in your risk analysis on the data protection. The locking of IOS devices (complex pass phrase and not just a PIN) combined with setting the device to wipe after x attempts (10 by default but can be set lower via application of a profile via MDM) is a good move on school *and* personal devices. Explain to staff about people seeing all their text messages, accessing their personal FB account, personal emails, etc and see how quickly they lock their phones!

 

To be honest, they seem have done a lot of work on this and it could be a good app. Before I would use I would have to take a closer look at their entry with the ICO to see who they are sharing data with (their data protection section only talks about how they will process it, not who it might be shared with or who will process it as a result) and I *really* don't like the section about me owning the data, but they have the rights to use, repurpose, etc forever ... If I upload a photo of a child's work I do *not* want them to have eternal rights to it ... but that is a personal stance on IPR.

[elsiegee40]

... I *really* don't like the section about me owning the data, but they have the rights to use, repurpose, etc forever ... If I upload a photo of a child's work I do *not* want them to have eternal rights to it ...

I don't think the child's parents would be too impressed either. We have to get permission to take photos for school purposes. taking photos for school purposes and storing them where someone else claims ownership is "well dodgy"! It feels like a facebook clause!

[Jamman960]

I really like the idea of getting our EYFS dept to ditch the digital cameras and stop printing dozens of pictures in full colour for the kids folders, I'd much rather have the data on site and not be locked into Apple hardware though

 

The 2simple software isn't all that expensive really but again the data's kept on their servers

[SimpleSi]

Shall we take a reality check

 

A photograph of little Tommy building a house with Lego with some text saying look how he's doing - he's now at level 1 in construction is not a danger to Tommy.

 

Now, if it had his home address and the nights his mother goes out to bingo and leaves him with his 12 yr old sister babysitting on her own then their might be some cause for concern.

 

 

Simon

[elsiegee40]

We are not talking paedophiles here @SimpleSi

 

The issues are:

 

1. Data Protection

EYFS Data is incredibly detailed information about the progress of a child... or lack of it which happens to use photos as part of the evidence. If it were to get into the wrong hands, it would definitely be a DPA breach.

 

Security of the device is paramount.

 

2. Ownership of data.

Assuming the parents give permission for the school to photograph the child, have they given permission for the company storing the data to use those images? Grumbledook suggests that is what the T&Cs say could happen. As a parent I'd be furious were this to happen.

 

I feel that my most major concern is option 1. If not managed properly by the school, it turns an incredibly useful bit of software into a fast-track massive DPA fine.

[GrumbleDook]

@SimpleSi as a parent, if I found that little Eric's picture had been taken I would be fine with that and sign an agreement on it ... If the school / nursery wants to use it in their website / marketing materials or as part of a resource for staff CPD or to help other children / families in the school / nursery I could agree to it ... But to have the school host that photo with a company that has the right to reuse it for its own sales and marketing, long after little Eric has left the nursery ... Then I would take umbrage.

 

The fact that I might not have given the school / nursery to hand that data over to a third party to be processed (privacy notices folks!) or if I have and it is subsequently used for things I did not agree to (sales and marketing) is a breach of the DPA on the part of the school.

 

I am careful where I store pics of my little one and this is especially important for looked after children / children in care / vulnerable children. There seems to be no way of including them as an exception so in my initial risk analysis that would rule this system out. Perhaps with dialogue with the provider things could be sorted ... But not right now.

Edited November 28, 2012 by GrumbleDook

[OrbitApplications]

We would like to comment on some of the queries raised in this thread:

 

Orbit Early Years is a web based application with a complementary iOS app, therefore does not need to be used exclusively on iOS devices. The Orbit Early Years app does allow the taking of photographs, but these (and any other information stored in Orbit) are not stored on the device when taken through the app. All information recorded through Orbit is immediately saved to our secure cloud storage, therefore if devices are lost or stolen there is no data loss and from a safeguarding perspective this mitigates the risk of information falling into the wrong hands.

 

We do not, and will not, ever use images stored with us for marketing or publicity purposes, and we are very clear about this on the terms on our website. We do not use data stored with us for any commercial benefit. You retain ownership of the data, however we need a licence to use the data that is input in order to provide the service to other users, such as your colleagues and the children's parents.

 

If anyone has any further questions about our software please contact us via our website and we will be happy to respond.

 

The Orbit Team.

[elsiegee40]

We would like to comment on some of the queries raised in this thread:

 

Orbit Early Years is a web based application with a complementary iOS app, therefore does not need to be used exclusively on iOS devices. The Orbit Early Years app does allow the taking of photographs, but these (and any other information stored in Orbit) are not stored on the device when taken through the app. All information recorded through Orbit is immediately saved to our secure cloud storage, therefore if devices are lost or stolen there is no data loss and from a safeguarding perspective this mitigates the risk of information falling into the wrong hands.

 

We do not, and will not, ever use images stored with us for marketing or publicity purposes, and we are very clear about this on the terms on our website. We do not use data stored with us for any commercial benefit. You retain ownership of the data, however we need a licence to use the data that is input in order to provide the service to other users, such as your colleagues and the children's parents.

 

If anyone has any further questions about our software please contact us via our website and we will be happy to respond.

 

The Orbit Team.

Thank you for this. I feel much happier about this now. How about you @GrumbleDook?

[GrumbleDook]

Many thanks for your reply ... it covers off a lot of concerns but there are a few things that you might want to word a little better.

 

When you upload or otherwise submit data content to Orbit Services, you give Orbit Applications Limited a worldwide license to use, host, store, reproduce, modify, communicate, publish, and distribute such content. The rights that you grant in this license are subject to the terms of our Data and Privacy Policy and are for the limited purpose of operating, promoting, improving, and developing Orbit Services. This license continues even if you stop using our services.

 

The above really does give you a carte blanche to do a fair few things that you have said you won't, if you look at it carefully. You don't explicitly mention that you are processing the data purely to deliver the service you are supplying to the school / EYP. A company without ethics could take the above to mean that operating simply means delivering the service, promoting means sales and marketing (remembering that I have just signed all rights over to you on this even though you have just said you won't use the data for this), improving and developing (always a good thing ... but who looks at the data to help with this? Do you have a 3rd party development team or is it purely in house?)

 

And then you say that you can do any or all of the above even after we have stopped using the service? Can you outline your processes for what would happen if an EYP provider says that all data has to be removed and destroyed (part of their risk analysis around data protection).

 

I know it might seem that I am being very negative but I am just trying to show how things can have emphasis in the hands of the wrong people ... there are some dodgy operators out there.

[OrbitApplications]

GrumbleDook,

 

Thank you for your comments. We do appreciate and understand the concerns raised here, as you say, there may be some "dodgy operators out there". We obviously would like to state that we are not one of them!

 

Our 'Terms of Service' (as quoted by you) are supported by our 'Data & Privacy Policy' which is also available on the public-facing section of our website. This Data & Privacy Policy does contain further detail than our Terms of Service on how we deal with data and information that is stored with us. The following is quoted from it:

[h=2]"OUR SPECIFIC POLICY TOWARDS THE DATA RECORDED ABOUT CHILDREN IN ORBIT SERVICES[/h]We only use this information for the purpose of providing Orbit Services. We do not share this information with any third-party except unless we are required to do so for the purpose of complying with the law. Specifically, this information is not used for marketing, promotion, advertising, or any other revenue generating purpose."

 

With regard to the removal/destroying of information, through general use of the software, users/EYFS Practitioners with administration rights within their provider can access and delete information stored with us.

 

Regards,

 

The Orbit Team

[jmak]

Thanks for taking the time to engage with us. I spent some time reading the T&Cs on your website last week and further to the comments above, I'm more reassured, but still not at a point where I could recommend going ahead.

 

Firstly, I'd need to know where you host your data and statements that you process data in line with EU law when you process it abroad - the ToS specifically mentions a worldwide licence to use and host the data.

 

Secondly, the Terms of Service and the Data and Privacy Policy seem to contradict each other, for example over use of data for promotion of your product. The D&P policy would meet my requirements by itself, but I haven't found anything which says these take precedence over the ToS.

 

Thirdly, while you have said above that users would be free to delete data whenever they choose, the ToS states that your licence to use our data would continue if we stop using your services. This doesn't seem compatible with allowing us to remove our data.

 

On the up side, your terms are commendably clear and concise and the product looks great. I'm not trying to be negative - if I didn't think you were concerned or thought that the product wasn't a good idea, I wouldn't bother taking the time to think about it. As schools we have legal responsibility to protect the data we hold and process about our pupils and take it seriously.

 

I hope to be able to trial your services soon.

[OrbitApplications]

jmak,

 

You're welcome. There is no benefit to us in shying away from our users' concerns and questions. We appreciate your positive comments and understand your concerns. We obviously need terms and conditions to protect us as a business, but do understand that these could (through not being transparent or concise enough, or indeed by being misinterpreted) serve as a reason for potential users to be unsure about how we conduct our business activities and deal with the data and information that is stored with us. We will, therefore, be carrying out a review our Terms and Conditions along with our Data & Privacy Policy in the very near future.

 

In the meantime, in response to your queries:

 

Our servers are located (and therefore our data is hosted) within the EU and we do process all data in line with EU law. The Terms and Conditions specifically mention a worldwide licence because we do have many registered users from countries outside the EU.

 

We appreciate your comment that the Terms and Conditions may be viewed as contradicting the Data & Privacy Policy. This will be considered as part of the aforementioned review. For clarity, however, we do not and will not use images stored with us for promotional or marketing purposes.

 

Regarding the use of data after users have stopped using the service: Our software allows the sharing (given the required permissions) of a child's data between their EYFS providers and parents, and in the future hopefully their Key Stage 1 and Key Stage 2 (and so on) education providers. As the data is related to the child and is important to the child we would hope that providers (even if they themselves have chosen to stop using Orbit) would not object to the data remaining associated with the child and therefore their parents and other education providers. That is the reason why this is included in the Terms and Conditions.

 

We hope that you do trial our software (it is free to register and start using), and as with all our users, we would be happy to hear your comments about it should you do so.

 

Regards,

 

The Orbit Team.

[jmak]

All of the above makes sense and is reassuring.

 

One of the things that I liked about your ToS was that they were concise and in straightforward language, so I feel slightly reluctant to ask for more information to be added. However, I think I'd need the extra level of detail to cover off my responsibilities.

 

The concept of sharing the data with the parents / carers and other education providers seems like a really good idea and arguably the data belongs to the child. I'm just trying to work out how we'd deal with permissions. I think we'd need to set up an agreement with parents. We'd also need to work out who had the rights to delete data. We wouldn't want to keep the data once the child had left, but the parents might want to. Anyone else have any thoughts?

[GrumbleDook]

@jmak as this is for Early Years then the children will be under 13 so the data belongs to their legal guardian / parent.

[jmak]

as this is for Early Years then the children will be under 13 so the data belongs to their legal guardian / parent.

 

That's what I was assuming, but my query is how to deal with it. Presumably the same holds true for any / all pupil data that we collect or hold on our systems, but with all of the systems we currently use, we destroy the data when the child leaves our school - there's no process in operation to offer it to the parent or carer.

 

We'd like a system like this to record EYFS progress and had only really considered it for internal use. However the reply from Orbit suggests that the parents could continue to access the data after the pupil leaves our setting, which sounds like a "good" thing to do - an extension of the original plans to provide online reporting to parents. I haven't worked out how to deal with our obligation not to hold personal data for longer than needed for our business purposes and the fact that the data is not actually being held by us and the parent may also be using it. I think it might be something along the lines of "now that your child is leaving our school, we won't hold their personal data anymore. If you wish to continue to have access to the records held on the Orbit system, please let us know. Otherwise we will permanently delete it". I just hadn't thought through this scenario before.

 

Do we have an obligation to delete it, or is it not ours to delete in the first place?

[GrumbleDook]

This is where it gets into a 3 way deal.

 

I have seen with other folk in the market where the data is collected and processed by the data controller (a school), with the services provider being the data processor insomuch as their system performs that tasks at the request of the data controller. The data owner (the parent) is then included in the agreement and the services provider will also complete tasks for them ... which also makes the Data Owner into a separate Data Controller, but using the same data.

 

At the end of the agreement the school is removed as a data controller and that role is handed solely to the parent (who has already taken on the role). It is not between the parent and the services provider as to what happens with the data.

 

The school does need an end-of-agreement document which clearly shows that the sole relationship is between the parent and services provider and that they no longer have any role to play. The fact that the parent agrees to a separate agreement to start with helps.

 

It can be a tad murky and to some extent you are not requesting it be deleted but ensuring that you no longer have access to it and that the only people who do have access are the data owner / controller and the services provider. If this agreement cannot be put in place then yes, you have to insist that the data is deleted. Also you must make sure that if there is any data that the parents don't have the right to access (is data related to the teachers which the parents do not need such as dob, etc) then you have to ensure that this is deleted.

 

It gets a little murky and so you need to go through the data classes and data sets used and mark off which as just for the school, just for the parent or actually for both ... whilst the child is in the school / nursery. You also need to check your information and record management retention schedule to find out how long you have agreed to retain data ... remembering that this can also be in hard copy (ie print off reports and then get the online stuff wiped!)

[stevenlong1985]

Hi all, not sure if I should make a new post or dig up this one, since its 2 years old.

 

I've done some back ground checks about Orbit.so and I have spoken to the ICO (Information Commissioner's Office)

and they have said that orbit Registration (Z3286401) with the ICO had expired back in June 2013 and would need to re-register with the ICO again.

currently as its expired it is criminal offence.

@OrbitApplications are you aware of this?

[jmak]

Thanks for updating on here. We never got beyond a trial as other priorities took over in school. However we were looking again in July 14 and I noticed that their registration had lapsed. I wrote to them and they replied that they were in the process of rectifying it. I followed up a few weeks ago and have had no reply to my email. I fear that their business model hasn't worked out and they are in trouble. I definitely wouldn't consider this system as an option any more. A shame, as it had potential.

[stevenlong1985]

Just another updated.

 

 

Orbit.so is closing down

 

 

May 12, 2015 20:16

It is with great sadness that I am writing here to inform you that Orbit will be closing down at the end of this summer.

 

 

DON'T PANIC!

We will be keeping the site up and working to the end of the academic year in order for you to complete the year and download all your data (learning journies etc). I hope to be able to develop a quick solution that will enable to you 'request all your data' that would package everthing up into a simple downloadable package.

 

More information will be posted regarding exact close dates.

 

I would personally like to thank you all for the last few years. Having visted a few schools myself and seen how Orbit has been put to use (in ways I didn't even think of) is amazing. David