Data protection impact assessment (DPIA): draft

Tool: WellWired Supplier: Arthur Turing (trading as WellWired; no limited-company name published)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-05). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	AI literacy / adult learning for over-50s
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: no - plain-English AI education for adults over 50; privacy says designed for adults; no pupil or classroom accounts [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	controller (consumer educational site); OpenAI processes Try AI / contact-helper chatbot messages on WellWired's behalf
Where data is stored	UK operator (London E1 address stated); website and database hosted by Cloudflare (locations not named); chatbot messages processed by OpenAI (US); email via Resend; optional Google Analytics if cookies accepted - transfer safeguards not stated
Trains AI on inputs	no - privacy says the OpenAI API is used so models are not trained on chatbot conversations; WellWired does not store chatbot conversations on its servers
How long inputs are kept	chatbot conversations not stored by WellWired; contact form messages and article feedback kept up to 12 months then deleted; Google Analytics 14 months; quiz and course progress only in browser local storage
Data processing agreement	Not stated by the supplier. [School to complete: DPA reference or date signed] Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier]
Supplier DPO / UK representative	hello@wellwired.ai (UK operator; London postal address stated; no separate DPO named)
Minimum age	18+ (aimed at adults over 50) - privacy says designed for adults and does not knowingly collect data from children under 13; no pupil or classroom accounts
Other safety notes	consumer site for older adults learning AI in plain English (free guides, scam checker, Try AI chatbot, paid Academy); not built for schools; chatbot answers can be wrong - not professional advice; Stripe handles payments (card details not stored by WellWired); England and Wales law
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Red, pupils Red.

Risk	Suggested measure	Likelihood / severity	Residual risk
Data may be stored outside the UK/EU (Mixed)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
No data processing agreement published	Request a DPA before use, or limit use to non-personal data.	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 18+ (aimed at adults over 50) - privacy says designed for adults and does not knowingly collect data from children under 13; no pupil or classroom accounts	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
Supplier not confirmed as a processor acting on school instructions	Clarify roles in the contract.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://wellwired.ai/privacy-policy
https://wellwired.ai/terms
https://wellwired.ai/cookie-policy
https://wellwired.ai/trust
https://wellwired.ai/