# Outleap AI Safety Policy (School-Facing Template)

Status: Approved baseline template. Adapt through your school safeguarding and governance process before local adoption.

## 1. Purpose

This policy defines how AI-assisted feedback in Outleap is governed so that student outcomes, fairness, and safeguarding are protected.

## 2. Scope

Applies to Outleap usage by:

- outleap_admin
- school_admin
- teacher
- student

## 3. Operating Principles

1. **Human accountability:** School and authorised staff remain responsible for decisions and published guidance.
2. **Safeguarding first:** Any welfare concern takes priority over workflow speed.
3. **Transparency:** AI feedback is named as AI feedback in this policy and in Outleap's privacy notices, and is advisory.
4. **Minimum necessary data:** Only required context is sent to an AI service provider, for feedback, drafting support the student asks for, sorting evidence or reading a page.
5. **No hidden student profiling:** No automated high-stakes decisions are made solely by AI output.

## 4. Intended Use

Current intended use (the processing in place today):

- Help students structure their own evidence into reusable Evidence Bank records.
- Generate structured, advisory feedback on UCAS three-question statements. Feedback is bounded to the student's own draft and is visible to staff through normal product views; automated safeguarding alert delivery, staff routing and review holds are not part of the service.
- Support consistency and efficiency across feedback rounds.
- Provide advisory feedback on students' own CVs, cover letters and application answers where enabled for the school. When a student asks, Outleap can also build a first CV from the student's own evidence (where the school's CV setting allows it) and reword one CV point the student chooses; neither changes the student's work unless the student chooses it. Feedback on a cover letter or an application answer can include suggested wording, which is stored with the feedback in the student's record and is not shown in the product views.
- Provide staff with context for coaching conversations.

## 5. Prohibited Use

- Treating AI output as final without authorised review.
- Using AI output as the sole basis for safeguarding judgments.
- Entering unrelated sensitive personal data into prompts/workflows.
- Sharing student statements or feedback outside approved school/supplier systems.
- Presenting AI feedback as approved school guidance; it is AI-assisted support, not school-authored advice.

## 6. Safety Controls in Service Operation

- Role-scoped access controls and school-level tenancy boundaries.
- Audit logging for key admin and publication actions.
- Logging policy that avoids student statement text and AI output content in application logs.
- Statement feedback is advisory and visible to staff through normal product views. Safeguarding escalation remains owned by the school's usual route; automated alert delivery and routing are not part of the service.
- Suggested wording, where used (a first CV built from the student's own evidence, a reworded CV point, or wording stored with feedback on a cover letter or an answer), must stay bounded to the student's own material, changes nothing until the student chooses it, and must not be presented as approved school guidance.

## 7. Current Rollout Model

- **Student:** own records only.
- **Teacher:** assigned-student workspaces only.
- **School admin:** school-scoped settings, cohorts, and compliance.
- **Outleap admin:** provisioning, cohort setup, support and recovery operations in the current first-school product. Outleap staff are not the normal educational release owner.

## 8. Safeguarding Handling

If content raises concern (for example self-harm, violence, hate, or safeguarding risk):

1. Follow the school's safeguarding policy and DSL route.
2. Record handling actions in approved staff systems.
3. Restrict safeguarding notes to authorised staff only.
4. Do not expose safeguarding-only notes in student-facing views.

## 9. Quality and Bias Review

- Review sample outputs regularly for quality and fairness.
- Record incidents, near misses, and corrective actions.
- Update prompts/processes through controlled change and testing.

## 10. Roles and Accountability

- **School policy owner:** `[Name + role]`
- **School safeguarding lead:** `[Name + role]`
- **Supplier contact:** Jesse Merrigan (Director, Outleap Limited). General, privacy and data-rights contact: hello@outleap.io
- **Last review date:** `[YYYY-MM-DD]`
- **Next review date:** `[YYYY-MM-DD]`

## 11. Related Documents

- Data Processing Agreement
- DPIA
- Data Retention Policy
- School safeguarding policy
- School acceptable use policy